2b9f4433fb69b5667b97dcf48b8a6b09c5c41aad889dbacbccd50cc9e19f7ba7

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 10.5MB
Sample260826-e81mcayxhs
SHA256 2b9f4433fb69b5667b97dcf48b8a6b09c5c41aad889dbacbccd50cc9e19f7ba7
MD5 e6db5f63e45a50323dc4e902b91148fc
SHA1 00d75dea6258f1cdb074fc9be9307025df31d1dd
SHA512 6ee9315afd99e22f4cf61407930e556651ef949c914b5535f5dd9f7fc36237f2b9830099f1a39a6c63449c35df42775a04d613523334d25bf1ed95da4f4a62f6
SSDEEP 49152:U+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+ESm+ES+ESI:O1MbQ9yDAD7KjjqkusjmqMh9
TLSH
T1D4B69D29FAA580F1F86B94788CABC376EA717E1148334B5BDA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c58f-25.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
4592	svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe
1660	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCACCACCBCBABACCCAABBABCACCBBBBACBBCCAAABBBBACCAACCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe"	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCCBBABABBBABACAAABBABBBBACCCACAAABBAABABCCBABABACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe"	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5404	sc.exe
5904	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3552	cmd.exe
4444	cmd.exe
4416	cmd.exe
1212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1280	schtasks.exe
3228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1660	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1660	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
4592	svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe
4592	svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
Token: SeDebugPrivilege	1660	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
Token: SeDebugPrivilege	4592	svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3552	3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe	95
PID 3552 wrote to memory of 1280	3552	cmd.exe	97
PID 1320 wrote to memory of 3428	1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe	99
PID 3528 wrote to memory of 4444	3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe	103
PID 4444 wrote to memory of 5404	4444	cmd.exe	105
PID 3528 wrote to memory of 4416	3528	2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe	106
PID 4416 wrote to memory of 5904	4416	cmd.exe	108
PID 1320 wrote to memory of 1212	1320	svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe	111
PID 1212 wrote to memory of 3228	1212	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e6db5f63e45a50323dc4e902b91148fc_amadey_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCAABACCBBACBBCBCCBABBCBABCACCBACBAACABAAACAABBBBBBAAACABCBAABBABABCCABAABAABACACACCACBBABBCCBCCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCAABACCBBACBBCBCCBABBCBABCACCBACBAACABAAACAABBBBBBAAACABCBAABBABABCCABAABAABACACACCACBBABBCCBCCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe" start= auto displayName= "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe" start= auto displayName= "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACCCABCBCBCCCCBACAABCBCBCACCBAAACCBBBAABAABAABACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCCBCACABBBAACBCABCCACBACBCCABCBBBAABBCCCAABCCCCCCABABBBCBABCCAAAACACACBAABCABCBBAAAACABBCBCBAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCCBCACABBBAACBCABCCACBACBCCABCBBBAABBCCCAABCCCCCCABABBBCBABCCAAAACACACBAABCABCBBAAAACABBCBCBAACACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBAACACAABBBABBAABACAAACACAACBBBCACCCCCAABABBAABCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9c93ffedbcf34e43481c64e6dd8ad1de8d5c633bc282116a55349e77218104f9
MD5 4a53ed1293d9584bd66033236a2f2a22
SHA1 e92a7792a1970b41e709c5d230b5d461143d8e4f
SHA512 59ee93ff7a636a7b01db491773c7d3fd3147500946934bf2608b3d1fddf01febc9f06ec6f2af33b3c680a726dde35182a8c0f8c9111de4888feda09f36ee4053
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 d52a3d18254660686c437c15ca29b05359a563bd84d74ac097f507ecf7209aae
MD5 0e4366b9521b7911070a853c4992f926
SHA1 2a40c706097399e3ce58c6d2e648186676deac2a
SHA512 517a2bbd5733795a7c31662b7b55bb826b6b3b2066a920db100fca36fa656d8916ca07607aac155c20d18cbf88c60b0f434f5e1379afd52fd368028d8fd87264
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\qap`g`v~dtlq
Size 10B
SHA256 d06bbffe53445065b6a5eb44c927093f47d2155dee4d58d4a155efbad2162a10
MD5 df4db6ec127d236682cc8f0299326f57
SHA1 905dcc367bfcb11ab97ee6e84151af53c9b82f7d
SHA512 9d5448654b80f92298bb337317f442195839d6f50897ecb5c5db8e7c39ba4756268caea1ef1548c56f42378cdde34db061eee2abb4517db840a5dc00d7b9ba72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 599e4cd3dc3c5dc09a8073fdf82a6bda9dd0eecac63d20b4d731c5ada9c47142
MD5 1984d8e57f5b40a2febdb5512bc6265e
SHA1 6d587c57a98b92a1b5dffb129d3138c7e049c4ac
SHA512 bf9d0a29507fcde43c903879b81f2e3dd3467a28a32a1617f375da50ae37c766b05d29a47c63d38d123feaaafc32da4a931334e99f2b27477e9f7b91d2d1488e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\qap`g`v~dtlq
Size 10B
SHA256 ee898f9a8d07bec49177601fcd5cc439193b2681b71ef7649085949319c68570
MD5 70efe68ea7988fa7f2453982b8ec6b25
SHA1 bc3a191d1a6e78a8a5d3972f5b48b40c279be37c
SHA512 9b06a6ad1def3b3baf3ad6432279efbef292035006049ef2fea559a1506dfcbf8956c81fa65f9ca2a5d581292dedcf5af0f9954b103b71a2cecffb14975504f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host\qap`g`v~dtlq
Size 10B
SHA256 f5dcee05f9915c9f3402fca9b126dd071d87a3ac292a473cb5987b2425e9f519
MD5 4adadfd25dc5c9cea97b209a3e23b41c
SHA1 eb6de1d48d13553449e5566e8dadc9c62f98981e
SHA512 93b4570d2d255f548d63ab22dd0966d8a12d8432d8d9faef31d925186167732caedc5f66362e9d0513c9e5dc9c118fb825d592fedb5e28760261d39d4cd6d218
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\qap`g`v~dtlq
Size 10B
SHA256 82119359a7bccc68f9615989f7977da322e12bcb2b0468d5df3eed97e64a3b24
MD5 ae089aacf4995545d006e631d997dfd0
SHA1 020a752f8fe7b2edea8b5d04f8266089b1c396c6
SHA512 fcf77846b3a7ab9a05864b739a40cd44b24fd0405e4aa903dd486dba7f8d3b383859386dbbb73fa4cf0f7397f22a3443deb3bc969bd6bc3ae4c47552bb315746
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\qap`g`v~dtlq
Size 10B
SHA256 6560ff2ad96d6aa33e4048023b6d738c1741904a7b467be58e89cc223f19cbe7
MD5 f564f974e7fbfb81d297c627080e4f8f
SHA1 a8523b48dee772076951cec44caeb63d33b464d7
SHA512 20d167310a3bb6592415df1334577970657715f84297858c9d77a8261120f2886e9d23654800d1c719da0086826793146af68d803a1e1dd40ccbcb9e357daf3f
MD5 SHA1 SHA512

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 1.4MB
SHA256 1e4b8e939e3cc62a3336b7285a25b4e0017acea384869eb638d3b8c679e716e2
MD5 243adb921a89136cefabfaacbcd740e1
SHA1 1cd9bfe61d5a0e17a959bab824826767512dec2f
SHA512 23cbfa8330458c19258b387ceccfb24132b5a85b62254cf3ed4bd1af16e0ce7c8bb2f73e527a0d8f5799387cdca2a0d82ade524d6af1f5fe4411f6c7a0b7ec7c
SSDEEP 24576:m9+EM0q9k9+EM0q9+EM0q9k9+EM0q9+EM0q9k9+EM0q9+EM0q9gLc9+EM0q9k9+U:U+ESm+ES+ESm+ES+ESm+ES+ESgq+ESmz
TLSH
T144651A09F94340B1DD2B50F04DCBE3BF8A60BB25C6128EF7EB4DCB5BA923BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 448KB
SHA256 47f3a153bc2c50424fff2a0e43882ff92e9279c0b0fb1c0535b5d4637eb36def
MD5 e3a76b6c271d97905b01930cb5f0c336
SHA1 08886b28309e346f2544e608517d995f63318682
SHA512 7633d1afa38545760c975712694848a63373aebd8000f52cfb91124d7963c0b06f191b75ddc6919533eecd71ba565cc6951bc6074dbcdeae56aa57627dcd45f9
SSDEEP 12288:mgUFgEsnojA9gUFCgUFgEsnojA9gUFgEsnojA9gUFCgUFgEsnojA9A:m9+EM0q9k9+EM0q9+EM0q9k9+EM0qA
TLSH
T1CFA40909F94340B1DD2B50F04DCBE3BF8A60BB25C6128EF7EB4DCB57A923BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57ac5c7541a5bf6d14b246fa0021616c80f911db625a16ddc811dc7067547b08
MD5 198bfe822891e3caadb39de18622c240
SHA1 9792abe9702faaec221bf760cddd1cdd8862f4cf
SHA512 42ba978b562d0a04d84d5f3688cd0770248bfdfddf3bf09af8ce147fedf65249deaa89a559b25afe1133b7349145464896238b4e3d0f713d643f1dc832073c3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d28bb5061d15f6af6d6bd0c40159e9a6cb22b2fda439d6fc33344115f0738793
MD5 3b92d664a4a6663c9d9181d724c27e27
SHA1 c80a4a23422fbfe0144c8a5b9ebe18c05eade399
SHA512 a94a04eb8931b91e04ee1cefc7b6b40b81426fba166b1b9ee899a6ac25aba3cdbbe11b29e2759e52478b3b122756cb88a1ff7da36a8204f23814f97bfe299d6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 536bc5de35f2b9213e089b3a69e60ad4635a1b4dc6c1e51410e08d44364f2ba8
MD5 3f5ce5f1085574d47ae705812a41b53c
SHA1 7413ff18330f8b938b2ba89e09aaf2114bf24466
SHA512 f28df0e7199bf715b55bddffd07006d1df3bcbc2aea91f01cd0942f935ee3133dc73ab6789df7355913e99478d6c8d29524bbb2420b7676803d0c4cc2aaf90d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f378106906edfd098062125764804d632f10474d7993c9ec18ce50113387b689
MD5 444bc67ad20fcf41626beb6f42d94cc6
SHA1 812a5f6df42b332eb08b85d40db642cd63632a63
SHA512 07f3132fa8f1285cd8e1f1b2b195b3995547c88cbccd29b27df5b8e7298a3e0470d13abba595ebfd5d5a73dcc57fdc79b8161c0aba806d5f5c1689d1daca5e4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 387f2f2acd71da845f6cb536f21b0adc52d8bf50b2a6242d91be80c890a0327e
MD5 c7a6cb272a8628105e54e14b2c81cdba
SHA1 2b32cb9d8669e774d5fe6a67c0a485664b4473d9
SHA512 8af732d62348b318843ffc0bb4948a5c5faf70276f2e4a4404d56d12de7232c001bc2e2131d882797891e13f01bbfeee3371e69211934d6eaa861f2deec89531
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d18823679731347d8f43e767fdd19013ba415930c79f1b5b56f621c336ac26d7
MD5 59d32ff6ffaa1e2c7777bc7987226c7e
SHA1 05cd42d69508b6b445c4d899487141380fb66fc0
SHA512 05e0726ff4c1cc492ab753cada6885e5e4f5dcf2d0ec8da6e33926e082bda5893aeb72c98a11ff40989bc40ef16a4603ee5148cd56bbf044662b0134abd25c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 1656a4e8a9b386d934c6731b24657a6df3c4ed9b6ce7f93b648b00f6b02c804a
MD5 1b0fc2a6dd6d8027da1d8ffc3ee5da17
SHA1 5d5288607480f8be3c991684626ed341bed97184
SHA512 9cb24bd00c672638bd287bfd4062c7f97f779d154a5016b65b1259846945303ad4dc731245ec333201ca30564d6f498bbfcde9d082a9e7f904cacf983df2e0d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0689181a1e7cdd3b15621c58e47a250c364c5dd00ac641fe641f6e29e343c21
MD5 c3e695167501aac1603a11ab8bf79f58
SHA1 2318ebb859275799d98861b0b114c6ed5f242798
SHA512 6da0ec5efe918c461617f4c4c8a9d1928d18608a3f02a9e148403b54ea3393d1630666c517d9db52a3f706aa22fb13b4f5e6f56261c987a2f80dcdaa2623357e
MD5 SHA1 SHA512

Submit Download

svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBCCBCACBABABCBAACBCBCABBCBAAABCBCAABABBAACAAACACBAC.exe
Size 10.5MB
SHA256 2b9f4433fb69b5667b97dcf48b8a6b09c5c41aad889dbacbccd50cc9e19f7ba7
MD5 e6db5f63e45a50323dc4e902b91148fc
SHA1 00d75dea6258f1cdb074fc9be9307025df31d1dd
SHA512 6ee9315afd99e22f4cf61407930e556651ef949c914b5535f5dd9f7fc36237f2b9830099f1a39a6c63449c35df42775a04d613523334d25bf1ed95da4f4a62f6
SSDEEP 49152:U+ESm+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+ESm+ES+ESI:O1MbQ9yDAD7KjjqkusjmqMh9
TLSH
T1D4B69D29FAA580F1F86B94788CABC376EA717E1148334B5BDA95C61F6F336514C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 88ff2fd9a66fee4f995bbbff6d394aedad2f4ab49388c41846c5aef32d900589
MD5 605f1a099a567af31fbf69765435e21f
SHA1 9d1664e6b6327e80d1fe8b161165b9144f89e54a
SHA512 5734e57b93073387c8f51f806f9da850ecac8043b85b9bbd619a45d3c5668b63d901caa3ab2b8903d9ceb0550285651f628d48778e563b20957819d28f4c8bc5
TLSH
T14921F97194F6CCB3F7336C8B63168FC62CA5379B685CAA1023094219E6C5C35CDE55E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8ec2ee2c5de9023d0fd433836c01f26fe33791e08b690412265c53b0f9c37fca
MD5 ef8fec6d38dccd378e416df5bca87afd
SHA1 595b1d16091184db53cd2412effb28c9454d2047
SHA512 6ec08748839c1c4d7300df7035b885c0057155182492942b389d16337b9237c954fd620605677e0595d5ea2315044ef9f91abbf208a166d0c564f45dee48a9cd
TLSH
T1F921E631E4F5CCB3F7236CCB631A8FD618A537ABA85CA90012094218E7D5C35CD959E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 df8ad53506a1588fa0c8c417e5a340aeec8234f125dfa6b7197feb8fcf347867
MD5 ab0da48a11f2549a44575e66a0377d4f
SHA1 eb26070a72897efe4e4402881e893e51e0e0a550
SHA512 b5890f9663df098ebdf8fd89829976cb23ce67d2a33382c5462369b3245b8e521cf71bbd6f1fa16174eda5ad77065398a97fd67b696e914333013feef251a253
TLSH
T17A01263194F6D8B7F7336C8B531A4FC62CA537AB685CAA0023094218E785C38CDE15A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-89-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/1320-68-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/1320-46-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/1660-2091-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/1660-4147-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3528-10-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3528-93-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3528-69-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3528-47-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3528-21-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4592-83-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/4592-4145-0x0000000000570000-0x0000000000591000-memory.dmp

Download