1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Size 22.4MB
Sample260910-wc2m7stbmc
SHA256 1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76
MD5 3eeea411af6af403f87187a02c6a0ddc
SHA1 9f6bd1a1983b5938422a38043e86a68ba7b1e864
SHA512 d24e9e3df48eb78f7d2c48eb932a0b41f44852f0dc280a0e5ec94ff3b5eb86a6944ad0ee9d4c900970a6e8e0502fafcc71fd2b681dfa825cb3f374fd2f67b1ee
SSDEEP 196608:kxsmxs81tIDewjqkjiqM7xsmxs81tIDewjqkjiqMd:W8KwekyZ8Kwekyd
TLSH
T1A2377D29EBA480E1F9BB9438997BC276EA727A100933575FCAD4C61F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
2084	svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
440	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBBAACBCBCAACBBABCBCBABAAACCCAABCAABBCCCABCABBBACCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe"	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBABAACCABBBABBBBABACCCAACABBBBBCCCCABACBBABBABACACBABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe"	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4468	sc.exe
4192	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3272	cmd.exe
4276	cmd.exe
1752	cmd.exe
2136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1344	schtasks.exe
3012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
2084	svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
2084	svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
440	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
440	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
Token: SeDebugPrivilege	2084	svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
Token: SeDebugPrivilege	440	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3272	3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	104
PID 3272 wrote to memory of 1344	3272	cmd.exe	106
PID 1768 wrote to memory of 4752	1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe	108
PID 4752 wrote to memory of 4992	4752	notepad.exe	109
PID 3368 wrote to memory of 4276	3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	114
PID 4276 wrote to memory of 4468	4276	cmd.exe	116
PID 3368 wrote to memory of 1752	3368	2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe	117
PID 1752 wrote to memory of 4192	1752	cmd.exe	119
PID 1768 wrote to memory of 2136	1768	svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe	122
PID 2136 wrote to memory of 3012	2136	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_3eeea411af6af403f87187a02c6a0ddc_amadey_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAABBBCBBBCACAAACCAACCCCCCBACBAACCBBCABABBACCBBBABAAABCBBACAABBCCCCACCBBAACCAAABAABCAAAABCAACBACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAABBBCBBBCACAAACCAACCCCCCBACBAACCBBCABABBACCBBBABAAABCBBACAABBCCCCACCBBAACCAAABAABCAAAABCAACBACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe" start= auto displayName= "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe" start= auto displayName= "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBBACCCACACBACAACAACAAABABABACCBCCBCABACAAAABAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCACCCACAAACBAACCBBBBABCABBCCBACAABBACABAABCBBBBCAAACCACACCCBBCAACACBCAACBCCABBACCCBCBCBCBABCBAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCACCCACAAACBAACCBBBBABCABBCCBACAABBACABAABCBBBBCAAACCACACCCBBCAACACBCAACBCCABBACCCBCBCBCBABCBAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCABBABAACBBCAACCBBBBBAACCBACBBCCCABABBBABACCBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 66121e37dbba0b1b16e7ab30270a9effe5d49ec66ad95c6d8c12e751d967f2ea
MD5 1be869f3fd0420af82fb3e2b131afa76
SHA1 767ac3e9109f16fd4efddc04d34892c464aad9e3
SHA512 b5fb330426bca4143804b6a61698ed2d1b924a8de72e4d900a6370d884fb6074040b338a4df9092809b7a3905e575cbf3ee443c06e667b4359f659337a30c0d0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 22.9MB
SHA256 a191053f66c931e8a95e140c436fd2714a2fafb5eda1668c84329da92d28ab54
MD5 709b9630840984909b1283c166e06ee5
SHA1 eb71b81d1223beb1a43572cf507dc060851e250d
SHA512 dd53105ba90640233dbbdf63b016343d39f694c6681542c1d07d5e091ea6cae3216d54884d75db2da3c60c96873eab654c014063a5633e735df7ce9535d3730e
SSDEEP 196608:kxsmxs81tIDewjqkjiqM7xsmxs81tIDewjqkjiqMO:W8KwekyZ8KwekyO
TLSH
T174377D29EBE480E1F9BB9438997BC276EA727A100933575F8AD4C61F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\qap`g`v~dtlq
Size 10B
SHA256 25039a112729ff848310c70fc3484168b180e1bd58186a52c9f8be020c61b2f4
MD5 0e9cd1d342ea626c139e61a17e9e1b76
SHA1 49d63bf9dd98400ffb22cb28f7fed035dda87e0d
SHA512 d236c0e19fe33a574bfe7133dfc991cbd4527174bf0c286a0c7e74af4b05ff9835f5b73a579efd60f04e35b76fd89887b89e8201443bfc93382728d8f490cab4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\qap`g`v~dtlq
Size 10B
SHA256 5e1577bce63ee6d5adfbaf6fd2357bc55f2f248902a68329e7472d3c64723db7
MD5 d631d1bdf9084afb771d458f9c47d399
SHA1 3f60c87b6921a1f930b56fdbf0a24cdfadb73193
SHA512 313822da38f42464906b5d1b09cb0750f12217272f12638d4529a4c013f85e789e791b152187c2a825d604213b3e7eeabeaa7aa30d9c5c88619e2ff3f21632fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Vault\qap`g`v~dtlq
Size 10B
SHA256 541187e5cd6be7f21bf8a99c71c7ab0091cdad2ce1481ae02701c2ac595a27aa
MD5 65efc01cacd0c9a4ef6237e06f9872bf
SHA1 08de413e27f47895309a08729be0e448b4237b6c
SHA512 fbf72fef172621e6c6ba3807d142481c9fb9311d6fb369ca3b62013f28cefb94e575bd5ae05ab21d3acfe2199697478b91f02366ecc0847f93d6f74da675760e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 617db51a89ab08903b9bc51461d28d9e79b7cc77b3fe6e3e665e4a2f935dc280
MD5 3a1a324d7fe62ec4ecd241421eb75a94
SHA1 b84afc63b1c56acf3fa86092f99e0921e0f286d4
SHA512 f7a5b5a006cd44bd658ecae828d3fd7805a3b5cf3e3fd051f4f1bd74418b84428101d2ebee83f3746570b822233d83f973c0ecd4de81f8d32d063802571eb544
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 fae1a4292bf40f784b14376eff6e990178dd836cf1c3cf335c60b2d0eae8c3a1
MD5 aebed04146975a35b43714cdf41f102c
SHA1 ad5fcf64da05aaefcea7abf924e12eafa5454c5d
SHA512 180ab0c9c3b7038977e892131c11be61e2a2798516958be264f080dc695778230ea2805eba00346dd8c91e566efb84249048d5a0a1927acb51d2e3b3487b7e54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 018ddcd322b74eca127488715ac52550ada2f5d537e9b5b0f639b8d4a2b88b63
MD5 36e63711a61293b493d814bcda1ab9c8
SHA1 01436a3b8f9bf137b87fbad802ac67292b394e42
SHA512 3c0dfcf33ef2d0381f4808e6800b8e79cc5797a7bf45b860662554636af0956b0d832d764e4872e0dc57b698cc4e5340f54cf1aedb0e8258f8bf8f0e6cdaab55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\qap`g`v~dtlq
Size 10B
SHA256 3dd9902fe16d66299c104f3db9e9f4367ceaf02fde0dac6b45b7116196f976c6
MD5 b100bd45321776252e18b58857e6f1db
SHA1 b4a4193e979a9a36481d56cfd52a41f501453b79
SHA512 d6f3435ba44d8015e73f3ec09623e7ce60aae38c9dd2efece3a229e730b1eccb0e92abbd4feb547049145000e45ce09f2c6d1ab3a34c12273a5c13483f25f747
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 1e2cb4aa7af3882d4145354fdbd346a489e2ed7331ae2c3d20b4277cc8f8b789
MD5 5d5cb73ae9fb88310a1b81b47a45be63
SHA1 7aa448f8ee6f4e813360c5389b55887d4ee03a56
SHA512 a5ac4c6947225932a041f0a43447ee86e492ea0e6013360e7cf81eafdda2c99af448a0c6c7caf897d48f335e6fd417c8308498e70c32fcb603e5b79a9caf91e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 993e6ceb33effac2d432844ba2cb4e91018887e9624db1cb5977c0a743030312
MD5 8eb640868dbd9b4a553748378a83779c
SHA1 4d0501fd097c5c5153279158cd306eab964bd1a4
SHA512 9b6a51ab847173b363dc678e79ef7e213ce1a1b4b10f493e5856b245f86f134db7dede77ad0ed4faa4730e186284fa96fa11be32a576d8c770277320a1f65ad9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 deea8032989f7ba590f06ad860b1932bdcf835f08806ca251f8b3152125b441f
MD5 b8a491b20d971aa8b0fcb1935518d58a
SHA1 cbf6148a34f0973321ad0886aec8a92cb03d7251
SHA512 60d7cf1a94db581e960c22b32d2a4787670de3adb8b13324f286085279c529e43d7af9c8541aa50acec46d758ce8692cc6d2e2b51d4e7234f91a21fc5de5cd3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef9de99a064128323cafa382e98de7d99ee37f1bc7a989107e0b05fc241e261a
MD5 6843c518391dfdd2dca0ae7401e97989
SHA1 0b04b5305989ed8c182b839a0990c0bd02a50734
SHA512 a2e0a753b8b895111f1b8a94ca8ffcf2891c20dce9be4134522e40d0977707d93fcdca586827cf0efc3316a83085806c7abbb08dd6d9ed84eae4799596a3a2ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d7025ef663f73bfbac3ed7c3d930cd60790b6b0211211fe1bd3879986b40b6cd
MD5 0952dc9ca8d87441d5e27fdaec0bac3f
SHA1 e39bc513b45632323e896a58c30ad3bdbebe0146
SHA512 b9eeda045553ee494739b67bde5c27a7351c786fb280c6712a127c2d59709e712ef79bf5626fe02c6ddab037ed5af57a2e4e4392a39660e2242cb3a19dc355f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 80f33eb168fac9f112cc8305e8f0ce45f04662f5f698014ac6cd4489e57628dc
MD5 5b49225fca16024d76a13d3abcc85a5a
SHA1 bbdc4d497540a228c4264af796b0905a063b13c5
SHA512 92974da7c9edac4cda547a2bbf86e634fad9afd83d5df5833eb5bdcee3ccffff9080abfefdcd3c6ebbc01ddd5b607294560dd315ff66d4edf5a883f0dafe906e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ef56708c6865132697d9e1748715a4634bea6cab293cf29097bb110907a2b2a0
MD5 a282703aab6e9e858d08145ac9864766
SHA1 1c7056064a3f87aa7a06364f5f8d67ee91faf58f
SHA512 add1458dd77ebdd9d74eeb90a5cfd135a8fc2c724e7de70aed7b1a1747852ed030c4f08e7458d60fb20f07d17832221e61cd4651107b9d6246359077db9e803e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29d25ad80548b11a8fbd66282951a1f652cba238a540f69da924e0dd9ede9ccf
MD5 ee25911c65ffe7695418de60531bd8f6
SHA1 fc218ddeb679d080e3c0e7a77406964ab0939cff
SHA512 f6a756bea94b6de92e40f3f289c37dd4f7261dfb73123afd1a381d56893cdeaba25f0c2a041713ef792f3c6067a9b5fe3ce44103ea9465a1bc6b02539b35a59c
MD5 SHA1 SHA512

Submit Download

svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBAABABBCBCBAAABAABAACBABABCCCBCACABABABBBCABCABAACC.exe
Size 22.4MB
SHA256 1e76070a0ce358cc36528831c091fb94747c96091bc4d03d0a115f301161bc76
MD5 3eeea411af6af403f87187a02c6a0ddc
SHA1 9f6bd1a1983b5938422a38043e86a68ba7b1e864
SHA512 d24e9e3df48eb78f7d2c48eb932a0b41f44852f0dc280a0e5ec94ff3b5eb86a6944ad0ee9d4c900970a6e8e0502fafcc71fd2b681dfa825cb3f374fd2f67b1ee
SSDEEP 196608:kxsmxs81tIDewjqkjiqM7xsmxs81tIDewjqkjiqMd:W8KwekyZ8Kwekyd
TLSH
T1A2377D29EBA480E1F9BB9438997BC276EA727A100933575FCAD4C61F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 eaaf51601c53524d6bc729a74619d37346ea6fcb13f153355c1b09e61dd01ccb
MD5 ec607e56411a86ad9320fb051a425b34
SHA1 8d07834448de84bd8e059128483f7f8d7d348b96
SHA512 fede326332904af330f700e10672503f302754ee8ff720bb7a215b40eccb2588b9f4cda02b47644a751811a12fd58092cb2b4564786060f4203115fb7e684967
TLSH
T1BC210661F065D863F57068C79625DF8608E8776FAC5CAB10A30A8228F7EDD35CE2D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 69254d1931f266914fe490a6875393178e8cd5e961d4175dddd4fde093ebd9b5
MD5 769d763694c34ffd769000505a9c6b6f
SHA1 32b6751021fc49336d687bd1af43ac717b6b442a
SHA512 32337fdb3d98747437cd8ebf132e6f9d205aa7716e2d1b2b5457cf1fa2fe9cf66621d39141361cfec0c8a9578f04ac7e72289889c790bc90f42701da81f562eb
TLSH
T15411E350F025D857F97028979726DF8A08D8776B6C5CAB14630A8228F7ADD35CE294E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7db32b417d1b7eee587581e9b12fa9450990dc4364339c18dc173ee5a0c29e42
MD5 c29bfb2cbb1b616dd62f276986dc0ce3
SHA1 311701476c3ba0398db4bb4da3062ef2d0b01f4e
SHA512 46670a4d7d15c43f1a07616765ce4c925df5d6de54a22116ddf3986294fd4a40810a46a864d09d2bd2f6b8f6915355aab78403deefd747ac8cbd54b99376d652
TLSH
T1B9210550B025D853F97038879726DF8608E8776BAC5CAB10630B4228F7ADD35CE294E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/440-1303-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1768-36-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2084-88-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/3368-6-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4752-59-0x00000000059A0000-0x00000000059A1000-memory.dmp

Download