ffa4fd84dfbfd81720752be1e0d4807d1199c42a8e1b9bc53aefd17df8bef709

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 11.1MB
Sample260910-hq1feazdkc
SHA256 ffa4fd84dfbfd81720752be1e0d4807d1199c42a8e1b9bc53aefd17df8bef709
MD5 24be46e3d15f98db1fbf2d87d68c65d3
SHA1 9dd0cf0b0e8a85a83eafa6364814e162dd6e456b
SHA512 b63a046cd3306ea6f2268e2b3169476046c2c48ad7d35bbf4163b961be3d4022db562be27aeeef24c42b0e6eadd403f723b3b2b9a0efa3fcb070f2c7425a0d3d
SSDEEP 49152:U+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+EF:wmWA91pH2WpjHrgBFFu416AWvQ
TLSH
T112C67C55F59320F9E46FD0B089ABD37AD6707D1341328B9BE76DC6472E23B606C28722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
5312	svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
4592	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBCCCABABCCAABACBBABBABBCCCACBBBABBBBCCAACBCBABABCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe"	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACBCCBAACCABCBCCAAAAACBBBBBBCBBACACCAACACABCBACBACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe"	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4316	sc.exe
5916	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3252	cmd.exe
5376	cmd.exe
3544	cmd.exe
1848	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5872	schtasks.exe
4392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
5312	svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
5312	svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
4592	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
4592	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
Token: SeDebugPrivilege	5312	svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
Token: SeDebugPrivilege	4592	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3252	2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91
PID 3252 wrote to memory of 5872	3252	cmd.exe	93
PID 2360 wrote to memory of 3388	2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe	94
PID 2540 wrote to memory of 5376	2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	97
PID 5376 wrote to memory of 4316	5376	cmd.exe	99
PID 2540 wrote to memory of 3544	2540	2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3544 wrote to memory of 5916	3544	cmd.exe	102
PID 2360 wrote to memory of 1848	2360	svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe	105
PID 1848 wrote to memory of 4392	1848	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_24be46e3d15f98db1fbf2d87d68c65d3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAACBABABBBAAACBCBCBBBCCBAACABCBCBCCCAAAABAABBCBBBABCBACAACACABBCACCCAABACABACABCCCBAACCBAAACACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAACBABABBBAAACBCBCBBBCCBAACABCBCBCCCAAAABAABBCBBBABCBACAACACABBCACCCAABACABACABCCCBAACCBAAACACBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe" start= auto displayName= "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe" start= auto displayName= "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCACCCACBABAAACBBCCCABAACABCBABCABBBBCCBAABCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBACAACCBABBACCBCACCCBBABCAACBAAAAABCBCCCCCCBACBCCBABABCBCBCCBBCCAABBCBBBCABCCAABABABAACBACCACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBACAACCBABBACCBCACCCBBABCAACBAAAAABCBCCCCCCBACBCCBABABCBCBCCBBCCAABBCBBBCABCCAABABABAACBACCACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACAAAACBBACABBCACBCABBACBABCBCCABCBAACCCCAACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 364a13155580a08242d76216ad0d130493c542740602485f0aa10b11f108bcc9
MD5 2456c3dbb4c5d7cc5c740ed53a81608f
SHA1 a9906333e4a2fcce86160a2fe0a12adf6bac91ce
SHA512 e1ea630547be50cdbb481e55338eb111c8052b831d9c030f02fe0396b9254d42ee6d9256d338bdb280a9aeb7c8a867cc5a97007a048c3ce298adeeace94710e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\qap`g`v~dtlq
Size 10B
SHA256 da27769edbe1f34ccce89abcc78e51c8511acf0ae73ae39a5df0ccec8d549467
MD5 feb6e974df0e46d328df6a13fae7954c
SHA1 0584671ba6d7ca94f7858c3c3b9e79b2e785ce87
SHA512 1cd18cf1b99bc9135f78f0d41fcba76f5f727c82d440c977fae8efa69135dc4cca864b6d77b61ddc59a968d49159d66388f33f4db515879910e8b1f0b4934aa2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\qap`g`v~dtlq
Size 10B
SHA256 724b670b176498b6839fc3671e2774718edb78342471e08f27ac954612d43eb6
MD5 8633b533ebefffdfc4eff93213dddb8b
SHA1 9972d70011e6b70916e2e3e0745546770f696851
SHA512 f480469b53079e564250b3bdcc94da7454e2d4e23266d7b473f429d81aaf8efe71fad99eebd1a2a0a97fa37e1b104479ca7192d6fe2933d852bcb03517846478
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 11.7MB
SHA256 7d4d63a38a939345b73c53786f59798b719e88ba388ffeaf2e1759616f2402f2
MD5 5e3a9ed55448a8ffd27b819a89b09a68
SHA1 918e2e732cec80daca5de8c2068455d5b1b7c11b
SHA512 daecc6ad6fd253684228a30fbfce825449bf7246051de4394c8174d33895f6dae0024a2ab46a20c0a8de41363821ce9e9e8d97fd2eebd201753642701d0103fd
SSDEEP 98304:wmWA91pH2WpjHrgBFFu416AWvPgZ2Hb9t+2xO:wmWmHpn6F44IAWvPgZ2jO
TLSH
T117C68D55F59310F9E46FD0B189ABC37AD6707D1341328B9BE76DC64B2E23B606C29322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 c2b798ff42b29c93ed6dca81303604a1c08c1bdaf15de6756f2625af5f352b49
MD5 fd10c178f264eb8ecdadb189c98dffed
SHA1 bbd0c7fc8aa0a8b88aca993b52847f5124585d5b
SHA512 240df219de56b293a093c6ed8092b7033a33ed5e383621788ddb3c95b2c7957ac2a030a6983f0eb728f679d0ff98dffae006950dd098e04173e507c77c8d8107
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 8a16456ef2b9887e64e202b76d7fbe6b585e0969210b0c48a35a1fbdd22db18e
MD5 d6ce6f992e7b27997bea0d9dce11dde1
SHA1 deb1211d2673bcb542d130fd6a783bb63865380e
SHA512 26b91ee9291c53d1c612daeb9b1ba9a665b36bf0628cc58d387c06f716f377e12a10ded78d28d30926e0d0c3032ade5f1b10292dd6934e660cd9366527c6318c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\qap`g`v~dtlq
Size 10B
SHA256 e64a84a40b8f4c3d27525e0e75abf9929f51ec9e2825d835934f1c5b1a10f435
MD5 0e6fa8ba1c9526687f556f22093af157
SHA1 701af4daeab9d915e94b115a442651f99dae4640
SHA512 3d15f919e4e146436351601a03a4e46ff4c70bce1114fd5df933d8baa080ceff8cb4c611272b3fbb392ec0e9e1e48c3e7ae6791b4748713dfacc92718d878bc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\qap`g`v~dtlq
Size 10B
SHA256 79df7b41bd4fdceb259d9d613946d9a2eaee96b81d57b14338dd5e08b50956e4
MD5 471f7182cf98f83940c5b5fae97cb2fd
SHA1 f6bba6724b19cf4a843362c1263f0efb8e6a787a
SHA512 acacf2eff2714ed6aeaea1ff559d7c58bf7496fd28743663cbae4c00594d17cab562fff6f9ed7ff5578c5bb8afd67fb1c53b006b7f98afcc829900fc1013f491
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 e7a1716a25216cd03a75ecb3b556711049d1405c92db21dcd2239a3109327fce
MD5 c6676e7a5b98327f66fae7786c2c88ac
SHA1 7f2fc331710396f74f385b4d1d25796aa86f6e00
SHA512 1872ef6aea8ba29b9a153a8d1d3f710672e1e043469792c14d9179c4ce0343d82adde2843ea61def31fae9b994921c7a162bddb90fe04ef95733eba38714982a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 a7038db3df5f316bc42f4f36acacf3013eeb14e09985becc2afc4e11e0fdda21
MD5 2d6baf4ac3a134c92bf50d198a20c1cc
SHA1 3ec8843744358bb1e3755775de9093f65c2521de
SHA512 18c9ac6b993427a21a70c67c0e1094428941f2a342efa548206b99ead60471c3d53d3865e62d1152d76f67dec4209a4a05052804bff10bc8b01852671b4e9ec1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3227a2a6ec69fa97bb95ff367b15f82c85048fbb544e6f6d1e0e3727b08b73f4
MD5 e0b53193ddb08fe8c63404ad2d8cb09c
SHA1 eb130472bfa869b6a0559318a6a66216b37a6d53
SHA512 80c3c853a0699f1a4eeeabbe7894ccadf8e4436e2baa42ae663e55c06634b31f269a4a38d60052b80a6d5f0d8da4fe91d49b617b689ab176763805f2a70dd70d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aacbe0cc884fb144f24f9bc95bd7b6193c53674c7dab8fd359cced2ae8ba8dee
MD5 c621b3c23fd6496cd156d5653681cc59
SHA1 54e3fd0cfa1e4451bf5efe4b1d65f2c0d51f702f
SHA512 0b6fe83c5f01de240c9f0b120f103e4ceab0bc4292b0e2e8c208d7ae3c2d451f4433822b680f1178d0c19a43bba450ba14ccd34df7d9c97380d0e498630d53a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a7def21bb84d85279dcc839d29b00693e2d4ee1fc66599b6d199a059e4a6705
MD5 5c6ec0ec55b65c140b5333c5ff90d78f
SHA1 99216910768e386fc94c6d188c273a7da904bece
SHA512 88ff2f1281c913533e74ed2116035e3560367aa87eaca7177f9bc4ee07530db0938dfc481b4ee9e2da5d0430c95438754f2f5e864daeb41c4827c2dc0dc28d0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52eba24806b98f6b04e79fc3e58243f898b6c987e36fde483f8766c9500a5c04
MD5 eac0c064d1afed6f8e978eb56e41347e
SHA1 31e451b781ef1af103782957c0336d58bbf193d5
SHA512 4a36d35b7a1b54349a59f29c5a284ca69c51af4b97230414958f923654248dcfd2fc8f4d7aec6a7a2bbac5dabcd32f5430b96a4b01e666fd04eb6876be889f22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5572e5765af98725d5dc853b71d7aa6c148a334955b1ccd0b501abe6a6fed903
MD5 7a18e79413808bad66c51f339291bf41
SHA1 d13e9cbf0207866b119665ffe61d2ed175203c2c
SHA512 2c57c435fd02c8aed50b2637668a67bcb31aa8ca038bcdde501881a4426321c0035b0b70a75676ee779d96839a00f05d51d7fac867c5f8fdf558f506f1a8277e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 692e491c75feea97590de559f4e5ae7beedd9213e26bd399e2da8344f45b1ccc
MD5 86c1846b135b9df373baf1ecd195d40d
SHA1 2ad597c8734ecd512ba904d4770371c190622d21
SHA512 fded4ba29b4e0bcec5d00a514f50c46a3adca8b2307af616cf4cddf48c8351a2aae4f03a96274fbf556862312d2f6ff9ee3bebbdf964f9f322c012d3274c7878
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9cb0ea85ba49fdc762e088dd1a81bfd7c2fca38cca5dd62e8ca5339c2d3abe01
MD5 33123412b50174b6e3e103dd939ac4ba
SHA1 042cce3784b4a2402d42ad24fa13b8a981ec9c6a
SHA512 de6f321e9f7addafa941627fd3b18422ab19ae1ff8257287774739f98afff371c5907601822c081ceb37b1dd48121837f177596041a1a7032f88014c2079b10d
MD5 SHA1 SHA512

Submit Download

svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBBBBCABCACBBBAACBBCAAACCCBAAAABBCCAAABBCBCBCCACCAB.exe
Size 11.1MB
SHA256 ffa4fd84dfbfd81720752be1e0d4807d1199c42a8e1b9bc53aefd17df8bef709
MD5 24be46e3d15f98db1fbf2d87d68c65d3
SHA1 9dd0cf0b0e8a85a83eafa6364814e162dd6e456b
SHA512 b63a046cd3306ea6f2268e2b3169476046c2c48ad7d35bbf4163b961be3d4022db562be27aeeef24c42b0e6eadd403f723b3b2b9a0efa3fcb070f2c7425a0d3d
SSDEEP 49152:U+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+EF:wmWA91pH2WpjHrgBFFu416AWvQ
TLSH
T112C67C55F59320F9E46FD0B089ABD37AD6707D1341328B9BE76DC6472E23B606C28722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e24e6f14a117de9a7b50c12c6932c699675dfa7003498d55947faf3032af8091
MD5 0e9622a399682a728fbed6896406943c
SHA1 7fbb9ae15af0dd5dbf1ea5d23c3e9651955008aa
SHA512 b879db3f612118d04ac1f3f78435f252c51816508f4cb39d347e5063b5a905016db65e276dfafd428d9fede52cb5a19e5a3137d8d973e1cd849d452058a75154
TLSH
T180210C72F054CCA3F1325997AA269BD60CA5379FEC58AB14134C8318EF95C36DD158D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9f9b1f8b10f3f3b1f7b6c78d89493449dbe24171291bedeb0dad5e36cd91d87a
MD5 b6d2693222f6693d0b46fb293584a161
SHA1 08ee40834fd729f06df4d18ddd93345ec686534e
SHA512 6b48db823fc44311f322183836c20f6248ca5df89d3391c939fa1f348634eaa041d98cebba8918842755895a1e3fe70d72e502d658d7003fe863ef9a045172f5
TLSH
T153110AB2E0A5D8A3F03229536A169B9B0CE1379FBC58BB242348531DEF45C35DD168E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e072ca5f8f0e283f4f81cbf5bbe9f8173e6e12c76a53a4f0b9cd15e587970d8e
MD5 1a604a0b04ddabc7c6295995bf285435
SHA1 d460b5a14e0793e21e5c02930ed679bb372dc462
SHA512 2ded692a27bcb5616a9d9abe648cea8b2089f492d7d4b2815b5f22a7672b698fc4729fe75eeae7be56730d07f60a5a84a5b7803b2564312cde4e801de2aa15ed
TLSH
T1C6215EB2E065C8A3F03229536A169BDB0CE5379BFC58AB242348431DFF85C35DD168E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2360-33-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/2540-6-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4592-1994-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5312-1993-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/5312-69-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download