3cb3afb63be795c17bd5d1fd3407366ea0a11c92c07668be437a7805f0e60d3c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
Size 4.5MB
Sample260827-2la5ha1epb
SHA256 3cb3afb63be795c17bd5d1fd3407366ea0a11c92c07668be437a7805f0e60d3c
MD5 124018e33deabb9e6e2cc99bd52ef506
SHA1 f490c5a7623efa82badc60ea6dcb90e02288aec1
SHA512 93a048277226a170c6ee43ba712df019f804baef51428847379fd0c35afa74477606f32e92cf2a5734ccd05655c09418e1b9b3f286ffa4af156c04234a363e96
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7Y:Evk1vkWp7U
TLSH
T1DD262A05FA8640B1E4270170499BD2BF4670B911CB138EABE3489FDEFBB2BD05A35675
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
1944	svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe
5356	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCAACABBBABCCBCBBAAABCCBCACACBBAABAABBCACCBBBCBACBABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe"	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBBCABBCBACBAAABCAACCCCBBABBCCCABCCCBAACBCBABBCBABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe"	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4412	sc.exe
3856	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe
4968	cmd.exe
3936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
5356	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
5356	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
1944	svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe
1944	svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
Token: SeDebugPrivilege	840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
Token: SeDebugPrivilege	5356	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
Token: SeDebugPrivilege	1944	svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1924	4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe	93
PID 1924 wrote to memory of 5096	1924	cmd.exe	95
PID 840 wrote to memory of 1512	840	svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe	96
PID 4064 wrote to memory of 4968	4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe	99
PID 4968 wrote to memory of 4412	4968	cmd.exe	101
PID 4064 wrote to memory of 3936	4064	2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe	102
PID 3936 wrote to memory of 3856	3936	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_124018e33deabb9e6e2cc99bd52ef506_elex_glassworm_icedid_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABABCCACBBCABBBBBCAABCCCBCCBCABCCAAAABCBCBBABCCCCBCBCCBABBCACCCCCBBBBABBCBBCCABAABCABBABCCCCACBABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABABCCACBBCABBBBBCAABCCCBCCBCABCCAAAABCBCBBABCCCCBCBCCBABBCACCCCCBBBBABBCBBCCABAABCABBABCCCCACBABACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe" start= auto displayName= "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe" start= auto displayName= "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACACACCACABCCBBBCAACBABCCABCBBCCCAACAACCCCCBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCBBABCBABCABACBCCCBCCBBACCCBBCCBABCBCBABCBBBCBABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1c67b8774ee2d9b860041cfd5d4c2c8dd67d67517c40e258f857766d992496d2
MD5 5023f1ddcf0bc3119e45975cc36b5f50
SHA1 a028882a8b55eb738f9b497ca037716cd6f9ad65
SHA512 85cf052bc024ccd3dff94884949710018ce34e05f464121b3ecfac3523aebb2296f69fc3f3ff9536543f2fe24373f49e5a6d576958280681a365e56431a48d35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 d345de6be02778abcfc3d84b96d1de6fc0d419a54d99c23697e8e36dc1599306
MD5 7c2ab6e9032a4fd392db859130f01e3e
SHA1 a562a7d7f264e8a38d71ffdf0e2eeb4bc8b10c11
SHA512 befea90ec6501d55cea9fb822afd7d584bbced4254682c2d0fc695e1de1311eb69b0e5f56ee4c25eb7943264b61807c8ea6e8619fe098977142d53d4f4730c74
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.1MB
SHA256 67d1578a7b65a926b3955c43b5fb4fe6f9a5702ac3c7854468ec684938ba60af
MD5 e95dc602b174125fadddb74300a0f857
SHA1 ec1b0ff483e4db0cd6bc551152423f6e0583d0cb
SHA512 a16b0d209093f8cf63f61a038eb3b57a1fd2b9192b094c84877d3d7ae15f5202d197d3958e79d9d08286e9b53fff3f5bd4455ef4adcbae7ccfd6623dda40bb16
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7d:Evk1vkWp7zgZ2Hb9t+2x5
TLSH
T1E0364C05FA8240B1E4670171489BD2BE5A30B911CB138DABE3489FDEFFB2BD05A35675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\PKIMetadata\qap`g`v~dtlq
Size 10B
SHA256 b0eace5e487e096dcf89c43b509f01f77ac977c9ca5d2f7581066bc12579298a
MD5 1d7f0d239c63fb50752d165d14507267
SHA1 7499ff2e10690766e5f7906a3e77a4f7f8f9dbd9
SHA512 4dad583e9d5dcd84ce75a544ca84b82ec2919fca7ff2e50145fdda7ba5af21f00b479db87c8e6de24281d441ac7ca873527a11dc04a4ecbc64f64fb150d6dbdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\qap`g`v~dtlq
Size 10B
SHA256 d677d0a160a791ba1b9d0558d709297a99e9322c0b624cc4efec1ee407f14294
MD5 44baec785728a17b380d1079a4e83b55
SHA1 58f4981b6f96fadb096b3b20d75f03f69be12870
SHA512 7b38acec065c2e086672dbea605f357456cafe2c55ee27a31a46b12cd2725e361ebdd62bd0c0cc8c725c15369f93663199cdaf36eeb80206b74c13662635dd84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\{E3056065-263B-4B92-8B68-454CC0F831E7}\qap`g`v~dtlq
Size 10B
SHA256 e1f885ffa35cfb705684eba6e3619ea0bd5ac7190ac0b326921231236a9a9d19
MD5 55d0323228d9044c7b3c6efdbfd4b8c9
SHA1 8a505f5b527f220d091d1876c47e77858f679460
SHA512 4d8372534cb91d920135078ea50314038ebf0789a65a764538e6493a1bc969adee53daced1be9f91bc5528a57bb5b8ba65c05557fa564bff087eaef329a89fac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73f8ac19eb4da5cd5607e5a67cd2949f40ea94e5812d3dac60946b2008fadacb
MD5 4272fe05dd0161d177d2015f927a0ef5
SHA1 2150b1681ad44a5d27bdf89afefa2f87308f4d1a
SHA512 7a8821fa05eb4437804364fca19a40819cd239a530f81391914e557801cd5381bcd1fffbee35efa8996b9f55c77fb6bdecced726e7d403f948d3f81b8efb6baf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0990b6a13baeaa7ae5349f151c95e26ca71751f4b1b96117d4ef3512f4ff9c69
MD5 af3abedd2335dff6ea7e3c7340b13df5
SHA1 a8e1384f969650772ee15f6a0759de26dc8bcb0f
SHA512 e37d9e559be22a9268814952a5bebfc0c788b0fe51321a04e6052d9d45ba1d7043150afbfdd3c26a9694f8a52e4854e3b7c90f2eefc16fb89b1f6cfea6cce9d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3006e1adb25b81449d1c1d69cae86930c291cef7ea94c464782f550ee7011fa
MD5 368a6cfa90ec37a354c3294c8170a874
SHA1 d0eec7b3f6cc1999cc33dd2f3609c4989473f44e
SHA512 dff28e7ec9ed3fa41820dd218ddaefab3d1cb851368c8c2581a0defc0bf1b2392532d7a43fd79c192b0b0eed5720afa4f29bbcb50b19e82a5f32244979e3e3d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7100230142fa0221e9b30b9c1697efced3de0baf6136b9bb309d375953cb75f
MD5 73c9fe711a505852496f0574de80a942
SHA1 19173a4bd8056cda4ff0b78f1e3f7d10ee8b2e63
SHA512 f02b0fd6de6dc6f3ab8977b7644fed08cde684ef70d28c15bed8c2d08c216497e5e0d58eb66e91f208cd9ee55c6fe9a86b8be47963d4aa18c25f45625ed85c99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28e252976d1a934d3c2af3bd3dbbd2741fd1bc3848cc1e7afee068b367835e09
MD5 9e35ecd506a78be8f16d4a08837223a1
SHA1 5bd928e440a5228f026a1a196858467fd5cca72f
SHA512 87a6033a54c43bf80f5642dc7eae8c0dffc1122bb584251e3130e95b174b80072b212385feb89280f108ac36eab72e7a2df930bd4947ac84a58242c64f40ea90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 7fdf2d2b370a82e5ca173ba4e11535b3c09c5b085b741bc6094bd0035bb46a53
MD5 313c0cdcde515d96404e3529d3adc90d
SHA1 023b7bd34189997f5c9ef75e19be876e77d9b8b0
SHA512 64ca2042c931e8e6f88429f780af60434aca3000415b5b4bd974eb386d020e59c870d6938b388137846963908de9988aeeda92febf316501c306ba5c4eef72af
MD5 SHA1 SHA512

Submit Download

svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCBBACAABBABBBCBCCBBCACBBBCBABCBAACCCACABAAABCAABCCB.exe
Size 4.5MB
SHA256 3cb3afb63be795c17bd5d1fd3407366ea0a11c92c07668be437a7805f0e60d3c
MD5 124018e33deabb9e6e2cc99bd52ef506
SHA1 f490c5a7623efa82badc60ea6dcb90e02288aec1
SHA512 93a048277226a170c6ee43ba712df019f804baef51428847379fd0c35afa74477606f32e92cf2a5734ccd05655c09418e1b9b3f286ffa4af156c04234a363e96
SSDEEP 49152:U+Ecj+E3+ES+E7+EBqatglK+Ecj+E3+ES+E7+EBqatglK+EcNR+Ecj+E3+ES+E7Y:Evk1vkWp7U
TLSH
T1DD262A05FA8640B1E4270170499BD2BF4670B911CB138EABE3489FDEFBB2BD05A35675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a36e942d12b3269297472bd9cf09a8cde6315fd752897763a698bc4e7b4866f8
MD5 9cd1cbd34646d28113f11db1e9897142
SHA1 a52cf8051bedd9265111ba742af359c61067d3b4
SHA512 de296413f0fea9f8355192837384d5deba675efe95ce414dfd85d26567e309433cfe7c3c9211a604f0c8bd89370f3ec45691c1b515b86d21ebaedfa81d532f55
TLSH
T1BB21F954E0F6DC23F83268DF5631EED31C94374E6C286A98130A421867DDC378D590D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e640c5f35823a20fcb925c9dc8aa326c53e5b2fcc311ff50d9e640ce0d913887
MD5 906b66d0c27c4a1fb5d06a8a6be96e2d
SHA1 aaaf77ace7965d4662a3be5df9bfabf75316fc61
SHA512 3f9cfe8672ff374e97d1ab829f2abbbd078a808b9200bc35fdcbe95e01af6a3bf988fdb83effb8b863bdcb2680cd2fd24fb546e29b7e8ba6106c8894176c9068
TLSH
T146110A54E0F6DC27F83268CB9631DED31CD4378F6D386A58231A4618A7DDC368D690E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-33-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/840-23-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/1944-70-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4064-0-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4064-7-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5356-1938-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download