5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 10.6MB
Sample260831-hya6gsen8x
SHA256 5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec
MD5 a73b014a009e575b60ebb2fb90152612
SHA1 1e77fbac206821dfa8c03db5fd97b33c8c38c5f3
SHA512 3205d151f9cae159f404c0dcd1d81285b10bc14f62324084f146c290a60e4752f3fa7de85027d878b3149187c272761be6c5e888d97e71c540fcb5d31d1a0b70
SSDEEP 49152:U+ES+ES+ES+EA92+ES+ES+ES+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAh+ES+EI+e:eDAAA61MbQ9yDAD7KjjqkusjmqMh
TLSH
T1A2B64A29EAA480F1E86B947459A7C27EEA717A10C4234F5BC995CECFFFB36514C18231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
4348	svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe
5044	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBACCBBCBBABCBBBCCBCCBCBBBCBCBBBBBACCBCCACACCCABACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe"	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAAAACABBACBAABAAACBCBACAACCBBAABCBCACCABABCBCACBBAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe"	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
764	sc.exe
2512	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
1868	cmd.exe
2716	cmd.exe
6096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4844	schtasks.exe
4968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
5044	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
5044	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
4348	svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe
4348	svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
Token: SeDebugPrivilege	5044	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
Token: SeDebugPrivilege	4348	svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2080	2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	106
PID 2080 wrote to memory of 4844	2080	cmd.exe	108
PID 4352 wrote to memory of 1608	4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe	113
PID 1608 wrote to memory of 4564	1608	notepad.exe	114
PID 2996 wrote to memory of 1868	2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	118
PID 1868 wrote to memory of 764	1868	cmd.exe	120
PID 2996 wrote to memory of 2716	2996	2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe	121
PID 2716 wrote to memory of 2512	2716	cmd.exe	123
PID 4352 wrote to memory of 6096	4352	svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe	127
PID 6096 wrote to memory of 4968	6096	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a73b014a009e575b60ebb2fb90152612_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBACBABCAACBBACCABABCAACBCABBCACCAACBACCCAAABBCCBCCCACAAAACCACBBBACABAAACCCACCBCBCABAABABAAACBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBBACBABCAACBBACCABABCAACBCABBCACCAACBACCCAAABBCCBCCCACAAAACCACBBBACABAAACCCACCBCBCABAABABAAACBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe" start= auto displayName= "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe" start= auto displayName= "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABBCCBCCBABBAACACACAAACBACBAACCCCCBCACACBBACCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBABBCAACBCBCAACCABCBCABABCBCBCCCBCCBABCACCBCCBAABCCABCCBAAABCCACCBCCCBAABABACBCCAABCACCABCBBCBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBABBCAACBCBCAACCABCBCABABCBCBCCCBCCBABCACCBCCBAABCCABCCBAAABCCACCBCCCBAABABACBCCAABCACCABCBBCBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBABBCBAABACACABBBBBCCCBBABBCACCCBCAABCCCCBACBBACAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 01ca6cd0d270d75f8d7b99208320be4fc1c1076e0b330a64a229db4cd17dbce6
MD5 21f84ba1a488ef12757e38c5105428bf
SHA1 413d7346fcf6e48f3d0d6018f8a319044cb9fe90
SHA512 65102db0f1c17f0265fb8221a5158006c52b6e0d80c71aa1b190248e1689b8ef86cf9eac0867b972982c92bbd610f44e970fc0a01b709b3e759ba49cda44e54a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.0MB
SHA256 db28b397601365b2dbbd286e469c4eaa62f34c9554e11fc1735d6d1e500e974e
MD5 a4e762178ff50f8a773ad33483f3fb8c
SHA1 4e645f2756077af4cc4645dfb2e64e03ab81c826
SHA512 6f768aee50d5f4fc07e8ed0011e940c72c9030504c8eb51415108c1baaa9ed064ed0ad8f8c66a18ec2b5b0f7d6339d98415b7085f188e553f4512e97c62c2bfb
SSDEEP 49152:U+ES+ES+ES+EA92+ES+ES+ES+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAh+ES+EI+C:eDAAA61MbQ9yDAD7KjjqkusjmqMh3pi9
TLSH
T1FEC64A29EAA480F1E96B947459A7C27EEA717A10C8334F5BC594CE8EFFB36514C18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 d33378014d151f06b5626b5f72da409ad10bf5e4418ae7ea808e3ba2200dfa7e
MD5 581bfa34832a93ea32c07b0ad07ef565
SHA1 0ad0a6cb6ae24143979c7e01006c5645e2f3ccde
SHA512 f6324d50c3fa1cb24383ffdc7d5bb1502684de60fece76365e092bb2269e25f95f1617bcaf88ee25d71b8335ff5e5142301e9cbfce5d9a71908b631c34aabee3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 9342fc6a730d78dab26a82f34212b6b2ed11a433def1303cdef473e43132bfc3
MD5 aae1e6c09e4001f4c0eb84537eadaf95
SHA1 9c814db2b911c4d185f4731726f9912a7a976780
SHA512 9760c6a0da34de531c4e2666b44ae2139659d93cfe5ed3356fec45e78d3560284514c04d8c2c2b8694277853142ed76680976d4a3b77ca5d59d6d55b5251995e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\or-IN\qap`g`v~dtlq
Size 10B
SHA256 cac8fc61a123fd9e15014263d5b99d019ca7b582a51b170dd726d537cbfddf81
MD5 e8a76207f4d91db783bdd8049df23e3f
SHA1 45647fe5a744ee6136bb119351ed404547c6bc0e
SHA512 25917bc13ec2773d315e0c78af17013bc0c02566086b496da3f46577359ad6da47d21608eec5506e7dc6eb7b8f2ab7c669c7373b74884eb541860bf31f5e19c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 3f45697d5d872532c000f07f564ca7ae708e45340f96dec8fd999951437db24c
MD5 d40a316377b8a2ddb86047436657792a
SHA1 61453261451a3c6d380f60a48a7621f8da2f366b
SHA512 50605cffbfe90696593ab382692be5ace92b4667cf428acabe0f570a9995d4b2eef70e3d96b5941adb44eb849268332848b978afe50396ea390e550b42b3cbf7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e78aea85ed9430b05d42e164714e69d8f48b1ddcb3891284f897e6a7f1b98cbe
MD5 1124f5fe854ff4619b7619a6edb95ab1
SHA1 f53a5581484d5ac2d338c654fe1d257b3b47a67f
SHA512 8f3268e65e588ba11daadede72a4e7cb3aa77dc45310b08ad244865d07ac76bd639a6fa580d84ae998ea020ba4b9ced7cb579e8a8b136a7db2ca7aad2c8dc140
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2b865d368841b72f458c7259df217b4d3bd4cf13ae694100f436e1fde4305dc
MD5 c39082776640a09e89f7e701869af4b7
SHA1 dd043bec89ab57a53c4df43b4e046536869c91fa
SHA512 91f0d72fb2798738488007e68d68e10360db35fcf4f3989b79f2a1612316e5591532c32a209595002abc10def159143f4d8824410fcbd1a5099cc39ab633755b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ddce4ce0a178053822dd17c0ff65026b8293de8fe0b0474a86329a722108e9e4
MD5 e741bf9d3047920fdb46fc9d8c6c3708
SHA1 1153e21a422f07148d061018874640926e0d4ec7
SHA512 aa52b17c5a1bdc2da3dc17c41316f9614d1cc1e031f00fba43f96ea89ceaf8e617b62b1d3891fd64b5cb9d90967ea6558fdd3833c61679fb3302a2bafcf5039a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e04afd6dbe22b5a13847aac882c2fd96c61d601fe1701af89ed689fb7579d117
MD5 cdfbd2940867a4d7cf154be0f04e7bd1
SHA1 06e2d2c71801b518544ed388c08c0b07bc955d3e
SHA512 b2d165ad808aacf8d5bf9eb2155ec18fb3358e06b13d6629f76ffd9d677042f5f63c80f7ac6a7714946ec55f613ce27bfc685cc75b70d5f951fc4552d2ce0616
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 179e8c17e50e36f02c4748e8dd4ac3208cd732f7c7064c187ada37e12877ebe9
MD5 f6cbc4e7fe50f3ed332eaed98194eb6d
SHA1 613c1d30bbdced23583acffc037c8f8be53da9e3
SHA512 f02dd50072364b14bf20c09677e64218f48bce0f223d65ea4f1137947e989cb5432b175a88292a5266c2257d135385e5d1a3e228d600933c6df4f35cef6df764
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd7b18786b4aa677801bf46c2b8ddea24bd9952a599cd77777a5453023c3f8d2
MD5 9a048eb9a9011aa1b43d713aa7def375
SHA1 7c563be8c7410756533cab99b6dc60e67773afb6
SHA512 99dea62df2e6d949e2998c1591d7a3bab225ebb92a52722206274e4d08e7b054bfee2a5a2ceccd05f32623bfa426f3b5d269c2a55ddb1c3f86bd3026e9a3061e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 65cc64db636b12fd4c290c41090c3fd4ab8bc7d99fd5a6e7a9358fdc10f371ae
MD5 2d823edd966b937732eb853da9ab08b6
SHA1 8a6bdef6044b8180c2817a14c4f80b02fe4a0852
SHA512 89e100662344ddfda11797d12f820ca3804a81995080ef782e9d94e317e14f175c276f3dd1e4643378165ed3bfa33c597bc82aff4ce9faddd6c2e930347b63d7
MD5 SHA1 SHA512

Submit Download

svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACABBCACBCBCCBCCBBBACBCBBCBBBABAACABBCCCCBCACCCBAACA.exe
Size 10.6MB
SHA256 5ecbe86789849353ccfc1cee1a34adc95cf4a7ed91f214cf39ab8a4c12211cec
MD5 a73b014a009e575b60ebb2fb90152612
SHA1 1e77fbac206821dfa8c03db5fd97b33c8c38c5f3
SHA512 3205d151f9cae159f404c0dcd1d81285b10bc14f62324084f146c290a60e4752f3fa7de85027d878b3149187c272761be6c5e888d97e71c540fcb5d31d1a0b70
SSDEEP 49152:U+ES+ES+ES+EA92+ES+ES+ES+ES+EAh+ES+EI+ER+ES+ES+ES+ES+EAh+ES+EI+e:eDAAA61MbQ9yDAD7KjjqkusjmqMh
TLSH
T1A2B64A29EAA480F1E86B947459A7C27EEA717A10C4234F5BC995CECFFFB36514C18231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 be1e2feb9e4b231996267227a53ddc6aded0f8756308ebef9456f6175579aa61
MD5 81e38f45e2840de3121743116e7490c1
SHA1 9a37ec827cc000eac525ffbf54e02a5d4d596e7f
SHA512 3c95af09e692250cb74a95d2515ff7fa98cc9696081e890f5e269aa0f73bb48460a7abf8660ee91b54e8e0d3be718bd6b268f9417ab88825617d4685d8d2dcc8
TLSH
T101210860D0E9C89BF83265CFE731CBEB4CE977DB686C6B14230D4119AB59C364E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 49ffc1de3fa3141b45d4e97f31759a2187e215ff95b3e7b4427b2a465a7f8787
MD5 a06dfb625ee3e4f2c074ed280342d544
SHA1 713d576f6c8ffb6beef8b6753c166bf7fadb97fc
SHA512 d9856e73f4401ce2dd599a7ad17f716d826940749fe9fdf83c54bd0794fbe83f7638e15f477f5a674998a561ad12afee26a76159aeabee4eb980f2065dbf690d
TLSH
T1B521FC30F0E4C897E43255CFD731CBE74CA877DB6C5C5A04231D4118AB55C368E154D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d40909d28b7d8e09c1149e9b68b0c6860473b755ad4b38c3a3e5597201d526d9
MD5 f250368cf6e78b5c549ec1f3f06410ce
SHA1 b2ca28f092cb32499d1614d212469858973ef128
SHA512 1a4705f9e5a2da9d07d476993614d620518ce3f7f829c5b4f36e1d60b952ead47a1710ccdbe04a766dd0d72934d29f50089b9d5ec496ff86ffe1e805866cf159
TLSH
T1E4113A20E0E5D89BF83265CFE7318BDB8CE873DB686C6B04234C4219A759C264E154E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1608-59-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/2996-6-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/4348-75-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4348-2873-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4352-35-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/5044-2421-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/5044-2875-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download