2b40a095d5947f3239ebe99a6817e9a1d352cc496aa55150af33c93aca901daf

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
Size 6.8MB
Sample260907-cvsngaxbpg
SHA256 2b40a095d5947f3239ebe99a6817e9a1d352cc496aa55150af33c93aca901daf
MD5 5fcd50985569df886cf1e82aa5498ae0
SHA1 dba7d3b417a02aba2889861d71c0869a255a9af9
SHA512 f5943159dd9180ba956af60ddabbef9ad7f9b4627fdd35a12349d8e16d4f8ee4a1d3c61d908adeb79c077358c30d55bd25a32b1d459dfcdbf56ad30dd5d7ea9e
SSDEEP 49152:U+EM+EaozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b/:C1MbQ9yDAD7KjjqkusjmqMhr
TLSH
T1DF665C39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
4880	svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe
2648	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABBBBBACAAACBCACAABBBACABAACBACAAABCBBABBCABCACCABAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe"	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCBABBBBCABCCAABAABBABABACCABCBAACBCABBABAABAACBAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe"	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1772	sc.exe
3352	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4240	cmd.exe
1744	cmd.exe
3988	cmd.exe
1212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4508	schtasks.exe
1540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
2648	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
2648	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
4880	svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe
4880	svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
Token: SeDebugPrivilege	2648	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
Token: SeDebugPrivilege	4880	svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4240	2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe	97
PID 4240 wrote to memory of 4508	4240	cmd.exe	99
PID 1612 wrote to memory of 3268	1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe	101
PID 3268 wrote to memory of 884	3268	notepad.exe	102
PID 2064 wrote to memory of 1744	2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe	106
PID 1744 wrote to memory of 1772	1744	cmd.exe	108
PID 2064 wrote to memory of 3988	2064	2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe	109
PID 3988 wrote to memory of 3352	3988	cmd.exe	111
PID 1612 wrote to memory of 1212	1612	svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe	115
PID 1212 wrote to memory of 1540	1212	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_5fcd50985569df886cf1e82aa5498ae0_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACACBBBCCCBACAAAACBABBAABBAAABAACBBBCABBCBCCBBCABBAABAABCCCCACABCABBCBCBBBBCBBBBCCCCCCBACAABABBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACACBBBCCCBACAAAACBABBAABBAAABAACBBBCABBCBCCBBCABBAABAABCCCCACABCABBCBCBBBBCBBBBCCCCCCBACAABABBBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe" start= auto displayName= "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe" start= auto displayName= "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCBBCBBBBCBCCBCBBBBBABAABCBBABACABAAABBABAAABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCAABABCCCCCCBBCACABBBBACBBCBAAACACAABAACBBCCAACCBBBAACAACBBBACBCBCCBCCACBBAABCBBCBCBBCBACCCCAABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCAABABCCCCCCBBCACABBBBACBBCBAAACACAABAACBBCCAACCBBBAACAACBBBACBCBCCBCCACBBAABCBBCBCBBCBACCCCAABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAACBBBCCCBCCBBCBBAABBBACBBAACCBCCBACBCCAABCAABAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a273794ee37fd0f2527e641d6457fe043afce8bfe4ee89342d9ba22c5fc2d688
MD5 515f3ea83435d7391a4a6bc4ffc761da
SHA1 e4948b30cf2b119250bd670d26ca120dd55644b7
SHA512 c8fb5c68318109a6c5deb33cbfb08726ed94e4b3aa86b9f0fbc5b89459521c2776f1de55676bb57c2164ecbd2553710d6af67cf6d1f44804d3702d13bb924ae6
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 7.2MB
SHA256 30294e60118494615431b4519a7227435c6456d428966e2cb2d1e19ded2e1385
MD5 dbbb9ea9993c964d405facdb83587c79
SHA1 dc7c6ae4e1bc8dca2b1b00907fff9036e61297dc
SHA512 5c83ac48ec1c145f7bf781e22524ca8a090e887dc5ac5b47d4e516c23a8663526d74c63b53f3f5df624c9b8290043ac8ed59723bd1a45271ccb2be5eac783e14
SSDEEP 49152:U+EM+EaozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2bs:C1MbQ9yDAD7KjjqkusjmqMhgpiy
TLSH
T146765B29ABF4C1E5F9ABD93CA97B8631FA7279510833530B89E1C21E6F336524D18731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\qap`g`v~dtlq
Size 10B
SHA256 ea3382825e4b47945c7d5abd8185d5b61385fcdeeabefc23e0162fc631e7733b
MD5 8cf2246d83376d732e197e861b23aebb
SHA1 59b3db18072ba92dd9670ba6752451fe12c2692b
SHA512 447a6fc7e1f325d2aa4549d8dd8c60cadeb28a598adf97d67917880c117bfcef564c28535331a627437e55313220be5a8a1cce6e58b4c2c4d8ec1054cded5289
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 558e338d3820e9fedf354da87a087ef4442992cd9c4168d1f4ab4760cec60867
MD5 af734b4fc3a08870c7f73a18c79d34bb
SHA1 c10f6704b2018d7e663cf9e19523086f251cc194
SHA512 e9f41375c77b4812f13885bdfc881aad56dac7d5db1960856eedaba0818b04e34691be7b6bfe34c7f3431aa33ef4cc7037b0bf564bc28ea436d9157705abf601
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\qap`g`v~dtlq
Size 10B
SHA256 be385bdcf03c6d81b21724f3f23745fc14a833dbd0b3e43c3e6f4fd18db6ec81
MD5 339451b99fbc0c9e0ef6e429f311bf3d
SHA1 e653de6e96dace285c8449823c615cbcbda4df7e
SHA512 e8d8e8fa15958f6a03954a4d6797b74ab6cd7a03698883ead0b0784b21607037e883bcb29b9cf7be53d4d7b80af89bc76fcb3e7bb5bf6f8bf56a4bbb0b9c72e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 37376adcceb3488edf06cefba1545e485fbb76aa72fc37ea962192c5cfb7441e
MD5 598d3f24b31b574a940068d6a970bcc3
SHA1 f0849d5bc08ad6a6b241e36039fb21c6f1fd9f3f
SHA512 11a3669d3fbe6f56e65eb1751e4f4d15287c6edfd1c30c07f98d0c4305d3264fd1307797f16f4a962ce1a5e9efd43a246fa9c15e55865fc2703f96f5996eda0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96b61baa688abdb3b041e51c2d4caddd215f1eec62d4a146eb20d185546694f9
MD5 6930ec91b865635d3155f3052e3259a8
SHA1 f595f0b71caf978159d3a695cf5355300a8edc56
SHA512 bc334ebdfaad1a6963bd2287d447feb8ca065bffca40bb28005849f49a0aa9d46f83e4b10a146cbe2c7500d2b36a25b6c63a9d533d2b02a5972914baaff4c396
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3640915fdc0463bb83493b22a46132d89f53681395acce238db629ebe134b5b5
MD5 bab6a25067120500f0d595d98b2ed5fb
SHA1 d62533328e14c22395e7d3cd68a1353a56bec0ae
SHA512 148a40a1b6a67077d69dcfa4b1420c31961208b05702107996cdee4f974890def5cfc9b65c94470e8250be18b8db396ea1b358d3757eef2f93ba615b1716e007
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e66e2499312678bb6434588e24179abc55b87d727a376e579e2876ee242f56c9
MD5 a49ea2f72a78acfc2b7fa8f85360e293
SHA1 d21e218b9e0680ccb687e7d088143c20cdbbbb11
SHA512 df022d4732665feab6c9305cb22cdc34fcec78490cd8c12efc111f52601ca837d1d246b7f96597666a5d3197ffc7d586588049ef1290f0daf31f864db130bc52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a31c1661194bf4d806c8300a9efc95e8a82173a8e71ed3f0e46c396966bc4df
MD5 faf5e11f2b70443e2f5b82861a5651dc
SHA1 19f20f8080f74429b131337e82d4935728a2ee58
SHA512 b4bbb0a6cb6207acb8d92a6ec0d81c9b39a9b0c95693ca48bbf511eab77a347fe8c30bafc374f4a479c465651ceb0883631021060bdb1371c73306e8389ebf75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09402583edc5fc02a111de01dee0d50a9045161538a9291fc3846e739c1bb8db
MD5 8b20f1842de69522b92a84e050c96372
SHA1 ccb67222ccc9bf8ceadaa4a9e14142b8a0ad401e
SHA512 6b080686bc7f73b122496f783fea15e4945e12b11acdca20926780f3f4fa7175c1ea539ddb60b2d137a278975a297a886054b7c86e556d6e4f0041b0efc65e53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6308c57f7aee76665b9d841847dff8baffc8df49409f4b492877954dbb3b39b
MD5 0da87b9c3a353f8998eabe9924f9128a
SHA1 2f8cbd34d6d6b7f07c7b6d9d381a868bcaaff408
SHA512 a7102994755812d3d54480f4c564987a71033d3e27c062ca770c625bef26e7c193cc7dc4798ecf8d57727341bba7e82f0b9fc5fae0b5dae9e0a869859f175fa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0ff60982fa735c12ca4a1fabb589cfe4cd142d179641174f9ec592876669ba8
MD5 cb2727b9115124cdbb93821e7f2bac29
SHA1 aadfaedeaec13c0739c993c99732e1295c73a75b
SHA512 0487a05d283d33f679753ce95de4b88f695d9a952a0ee3cd9b51aeaf1f462a314b451ad28d6ca05bfc6d0a5646e7478fa6de4ea49418d9172cda3a2a45b86bc7
MD5 SHA1 SHA512

Submit Download

svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBCABABCBCBCCBACCABABCACCACCBCCACBABCABABBCBCACBCBCCC.exe
Size 6.8MB
SHA256 2b40a095d5947f3239ebe99a6817e9a1d352cc496aa55150af33c93aca901daf
MD5 5fcd50985569df886cf1e82aa5498ae0
SHA1 dba7d3b417a02aba2889861d71c0869a255a9af9
SHA512 f5943159dd9180ba956af60ddabbef9ad7f9b4627fdd35a12349d8e16d4f8ee4a1d3c61d908adeb79c077358c30d55bd25a32b1d459dfcdbf56ad30dd5d7ea9e
SSDEEP 49152:U+EM+EaozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b/:C1MbQ9yDAD7KjjqkusjmqMhr
TLSH
T1DF665C39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 00a438cf4753e6eb19b1a8b5251b5ed9b84ac8ec7f8195f8d8084540d902bd7f
MD5 8a9e24f085526d943381670c45732bf8
SHA1 172cd0cd0c3297ac2af1c7fd07786227604fc1be
SHA512 05653c6afa540e1284c5aa0d0257756ea43f76efdde06368360253945fb9d93836f6de2d1c80f65d738a66f9bfec1e8474d92f8ba136ce933f9b5cbe65293a5c
TLSH
T1A911B951F075EC539031A8DF9F198ADB4CE43B86A99CAB98A3095618A715C3F8E024E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 92e3805f257ce9fe469ba36de354873c79f77a4942591d8fcadd697bf51b16ed
MD5 b210bd008e295d1e98421af3eb5643eb
SHA1 8a07ad3a5b71b81c8ce7c1141cc918712efb2aab
SHA512 a637e5f5e44429113d2e37abf21c12206c059165bbba9db7f2ac4d2f2e628354bc6105456c997ce0048cb52fffe8187f43019e07320051a9b4469367c17888e8
TLSH
T15A21DE61F075DC63E030A8CF9F299AD74CA43B86E99C9B88A3095718F755C3F8D064E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 b4d84e73c11a367c12da3ee1eaf9b4f77bb6cb380f8c62ebd01362f12f83b3eb
MD5 1867aaa9c0c573582b76c2cdb3bf63b0
SHA1 0c53161ae0be6e54079f0f53b35eb24ed584d8f3
SHA512 98062e23a910a1adab292e493106804788cf57baea7da39cca100084809e89a4d8e41d95a0a3211011b93abb666de2c0bbdaac810f2e30d648993731f8e35744
TLSH
T13111EB51F075EC53E030A8CF5F198ADB4CE43B86A99CAB5CA3095718A715C3F8D024E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1612-35-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/2064-6-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/2648-2695-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/2648-2899-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/3268-59-0x0000000002920000-0x0000000002921000-memory.dmp

Download

memory/4880-71-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4880-2898-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download