b6ce406a0d5a107b9c6598d1c956c91da0da39b792e47354b02ef7d710d403c7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Size 13.9MB
Sample260907-pdr2tsgg44
SHA256 b6ce406a0d5a107b9c6598d1c956c91da0da39b792e47354b02ef7d710d403c7
MD5 943552c95741029a1d3736590de3125c
SHA1 a3b4d852fbeb78146867f8439e87612c05801ffd
SHA512 f3a1842d1accde704a19b26b10b457c90067001ac0a06cf75f97b11b6dcb3e897f44b10e34797686945e96278e01b68ad2de9bf5f2fddca985df599f7a4862c7
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+ES+Ep+ES+ES+ES+ES+ES+ES+E1:P1MbQ9yDAD7KjjqkusjmqMhA7pb
TLSH
T11EE67D19FE9680F1E96B94744CEBC37ADA707A1146334B9BDA89C70F6E336915C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
2216	svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
3192	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCCBABCABCACCCCBABACCAABBBBAAABBBCCBBABAACABCABBABCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe"	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBABBCCBBABABACCACBCABBCBBAAACBCBAACCCABBABABAABCCCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe"	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2364	sc.exe
828	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
2792	cmd.exe
4408	cmd.exe
3180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1476	schtasks.exe
3680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
2216	svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
2216	svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
3192	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
3192	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
Token: SeDebugPrivilege	2216	svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
Token: SeDebugPrivilege	3192	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3180	880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	102
PID 3180 wrote to memory of 1476	3180	cmd.exe	104
PID 216 wrote to memory of 2928	216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe	105
PID 2928 wrote to memory of 3444	2928	notepad.exe	106
PID 880 wrote to memory of 4672	880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	110
PID 4672 wrote to memory of 2364	4672	cmd.exe	112
PID 880 wrote to memory of 2792	880	2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe	113
PID 2792 wrote to memory of 828	2792	cmd.exe	115
PID 216 wrote to memory of 4408	216	svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe	118
PID 4408 wrote to memory of 3680	4408	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_943552c95741029a1d3736590de3125c_elex_glassworm_hawkeye_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBABAACBBBCACACCACACABBBACAABBBCCBCCBAABCABABCBCCCCAABACBBBCAABCACCBABACCCCCBACCABBCCAACCAAAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBABAACBBBCACACCACACABBBACAABBBCCBCCBAABCABABCBCCCCAABACBBBCAABCACCBABACCCCCBACCABBCCAACCAAAACABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe" start= auto displayName= "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe" start= auto displayName= "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAABBCABBACCBAABABBBBCBBACCACAABBBACACAACBCABCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCBCABBABCCCBBBBBAACBABACCBAACACABACBAACACABAAABBACABBBBCCCABACCBCBABAABCCACBABBBBBBCBCACCCABCAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCBCABBABCCCBBBBBAACBABACCBAACACABACBAACACABAAABBACABBBBCCCABACCBCBABAABCCACBABBBBBBCBCACCCABCAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBCABBAAACCBABAABABBCBABCACBACCAABBBBACCBCCCBBABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 92e078d9eb704452884d5e4ba1ad4c54addd6f3b6df059b1de6ce450ba8284ee
MD5 ef1dc6843544cf47503450aee2a399ee
SHA1 c530f701f0b6d4ade005840fc5d3c33b92463cce
SHA512 7ec760d665a28c501ab80d2d754fb276cf455c47cfbc953a30ba4d70be1a77931120ec925735ea447a95923e53de3a0339c859acef4ccf6560780cbc14115803
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 14.3MB
SHA256 956112bd9a2f19a197bf46645c8897d2dc574f54e91804579d57161bb9568811
MD5 13b8b0f0b99a42065ac9aa012cf10b35
SHA1 55caa8c61a99dc287d2ebf02478b4c59344b560f
SHA512 e170dc9e36e08c72414327b61a4405a019a7d1767f11edf0724230464fe963cb4a41070f4151cfaeb33b42cb8d71907c9055233f438eb2860170d8a1db994844
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+ES+Ep+ES+ES+ES+ES+ES+ES+Eh:P1MbQ9yDAD7KjjqkusjmqMhA7pQpi9
TLSH
T1E8E67D19FA9680F1E97B94744CEBC37ADA707A1146334B9BDA89C70F6E336915C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\qap`g`v~dtlq
Size 10B
SHA256 e42a169def613bd3f2d79904fdda7bf620382d11e54fb90c214d1be480940af8
MD5 29ede6824db5e212403d520da3bcf964
SHA1 1e76ae92b3b118ebe088d1b6d4abca7eaed357f1
SHA512 7549aad77ef1964ffefaee3fc6573c41fa1b00887d4f5700929d2fbf185a37348ca37a96c69e715545649b7cfd91a636f7c12bc8d460161df4e0855f288ec042
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 8dfef3b62b7acc2aa8be6d8ccd9f2e62f28e23b663b2db6fb0fd1df4473b5f6d
MD5 127755d7afb2e0ea0b7ea433bb4737b1
SHA1 6b0d599132bb76c3a0b12f99318083f7acf413b3
SHA512 922f09334a132073ef7119ea84d81bfb99c4ad4fb1d68e225a14384ec96fd27e0c98e04a61969aa7093752e0d8bf7610e59dda6bb578d196d91ed116b3f5d282
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\USOShared\Logs\qap`g`v~dtlq
Size 10B
SHA256 6f5e40105161bc556225ae38cdff2a5b5e9b8d0a371e5a2e1a2f102be7abfe56
MD5 fbda7d345057b6d040f232d6fdce288b
SHA1 7cf99d4fbb9143b4d91987bb2f437dd7c987d9c7
SHA512 5300b77b2616f436c8d5762199108315fee30bad357e58ffd7b9e9ee2cf28c14e9d52894f9b86321f4aadac28d6b72b1fd0c040a928dc149b06b51ef510121d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6e7e5ac560d0596922328c7f24103b84f5b937c1aaf1b99253c32acb83937c5e
MD5 03475f98ed5ebbc37c48c0e473a0db24
SHA1 0280c334f1b82d8dcb686cd89f8bc98da3d2d8bb
SHA512 00a613d254fdee87087665fb84f4d5dc829f3928b0811c1115ca6fdd58a8e2ac3e8d770b2eb72951d3aafe7c7e3f386bec76cbcfa226b07910e36dee422bad8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 ab549a7782a6212ce865a801e3306ca6d5d85ba7e49f63a7be7e851f0d7b51ee
MD5 c4c8b824ca8b4937cc781061c5b6129c
SHA1 ea8f85c9031048a03c5128f4f2eac829f61a8362
SHA512 34d1d50177491f419fe95beace3ffc991b1594ab1cf3b8c1609d992581ec8f740091adea3c4ed0fa2d39976f1c507b44d844003059eac77dff2b5aaa17a5dfcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ca294b925b3ab1c454bcdfae3d1ead1ddbb1ffef31f23a7970594d313ff7da4
MD5 8d98a9d8a070e3def4bd6a10e10cc363
SHA1 980aa136a257b2efb51238a0f4c27012f33c6b3e
SHA512 2e62c679fab096dae3e4bcae3b9c63d2b34f0c8604c959bb925892c55f586a7a763cf55d045f3b03aebc7f5a97f21215e9f8d386a2e8e45e4e7dbee820baeb10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77f4b45978e67089e2f2b4c82e97d34b1dd959a9bd5029361fb5c33c019c99b6
MD5 58dd3d54a411ad75b6c96abab5f1919c
SHA1 c6cbaba49e9cc0c552f46f7bf044bb1bc4139e34
SHA512 deb630243d886cd09ed85bfdad889fd2d566188be01193ffeb0ee54a6f738245b5b39ee1608a8197f372998881bba9778bffeb05586de95c27e1a72d5b64e442
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c2a00911735960eccf67e499df8ffecc0d7fbb760e483337f90f22c56fa7fcd
MD5 2939c197452532b571c5dda94f3ee76b
SHA1 55c139d148fe66b8c2830e08ce30b500b9a31578
SHA512 3a2b8bd27ff49fdff71489a1037c72ff767ed7476635163961be40000f5f4386a3f05268f22ed3e99692a002f3d559d72fcf59da93530827e8bdf4c703b8090a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30a07b0a1189a80367c115f6ff28b62dfa9960a3cb237df525de7116093dbe65
MD5 e65ddbdb00dde1e14db38cae2817ca43
SHA1 d24bef8caad321826bfb762972f862484546edb3
SHA512 069fe4240a9758664c019167125b65e4941bfa5df0677b156563f397e2949b89303a57b771273b33a64afa52bc1db329b2db660ed0c237833f9e5d5115edf9bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 93ae88c39e253946ce1759d6311341e881c2b822b639d89d9e734bc07203d83b
MD5 cecb543f168132f3b44790e5b8932222
SHA1 8920be3bd8451729641b1232ccfbedcbb731bdf1
SHA512 6948cd42f0d1918c57ea57fdc39f68dcffec8904c7afee0b2e3988904278941f6447f65aa33bae1740a115a5f225bd766b75b10b49df252c6a9f1c962a51fc1c
MD5 SHA1 SHA512

Submit Download

svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBAABAACCCCBCCCBBBAABBAAAAACCABACACBCACCCBBACCCABACCB.exe
Size 13.9MB
SHA256 b6ce406a0d5a107b9c6598d1c956c91da0da39b792e47354b02ef7d710d403c7
MD5 943552c95741029a1d3736590de3125c
SHA1 a3b4d852fbeb78146867f8439e87612c05801ffd
SHA512 f3a1842d1accde704a19b26b10b457c90067001ac0a06cf75f97b11b6dcb3e897f44b10e34797686945e96278e01b68ad2de9bf5f2fddca985df599f7a4862c7
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ET+Ee+ES+ES+Ep+ES+ES+ES+ES+ES+ES+E1:P1MbQ9yDAD7KjjqkusjmqMhA7pb
TLSH
T11EE67D19FE9680F1E96B94744CEBC37ADA707A1146334B9BDA89C70F6E336915C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b8a944a14539b350b656b7af0ac2a2100324712d1004dd3199c1f3a03e59fc55
MD5 33fc87fa8fdfb44bda158b74fd919edb
SHA1 6a3f395b47ae849e3ab2b1b2c24c09b9bee9278a
SHA512 d55b8defbc2eef1186a6f31af618586316d9fd30a44f4314889f151acdd1c5784ab440d784f18c38169a4246ecfe936e6b4b5fffdadbd519f728474f4dd865a3
TLSH
T12B21A871E075C8D3E53228CB9F39DA971CA43BDE596C9B0862058318A35AC3E8F154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 cecadba20b42a7aba9543d8cb62bfa8c1ce7fcfba28d04a06379cc297b8d33b3
MD5 ba97dadd3b8348a09339da9cde0ace22
SHA1 358905db144a38874fd74df1e0d15eccc0b319fe
SHA512 ade683d7b18807277970c6d9eacf5a66e4d3cf83238c095a4848853b2fd156325a3b81fe068c0951df41c845c30963661ee4a51bf0b2663b8f7bb24b764f6755
TLSH
T116119861E075D4D3E53128CB5B39DA871DA43BDE696CEB1C2205821DB31AC3E4F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e9cf6e326c963c1db3be7506b0112d11ee2d398aed6b5887881a1434d8431764
MD5 76fce622f6a8bd53d2543e25171b1487
SHA1 5083941a24cfc2112c6bbf3db1b9df90f2afc024
SHA512 2a29c27cf4a3b7722941286f3247b60e15ac0ab7fa9ff1a07564957a4ddfe55aec9aeff28d08ee57d90d74ef6276cb3c83c89f1f9848ff92d2b979ef715962c8
TLSH
T14921C960D0B5D4D3E53228CB9B39DA871CA43BDE696CEB1C22058219B31AC3E4F150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-35-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/880-6-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/2216-84-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/2928-59-0x0000000005200000-0x0000000005201000-memory.dmp

Download

memory/3192-888-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download