b40b177c4b13c03a9fde5562b11efe47411ef410b1d5fe26d4f41d2b8017e2d7

Analysis

max time kernel
149s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
Size 848KB
Sample260913-yps8psdj4t
SHA256 b40b177c4b13c03a9fde5562b11efe47411ef410b1d5fe26d4f41d2b8017e2d7
MD5 eb9fad8b1784d07247db201e5053ce7e
SHA1 b33e241438a0ebdb2b6903e0a32f2e5135ba2110
SHA512 6715cb59ca833f853bc9cd9451e1a75df5bb6e1d6c5544782b5ab6d8463b80c4c2d41b5bff363b595e895ead73530d697559ee051c99662ab1a5988987954e91
SSDEEP 24576:m9+EM0w9+EM0iExqatgl8bz9+EM0q9+EM0AhYp:U+Eg+ETqatglu+ES+E3j
TLSH
T1C8050846FA4280B2D4160171498B93BF4770B915CA138E9BA3889FDEFFF37D06A25674
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
5004	svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
4100	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACBBCCACBAAAAACCCCCCBABAAACCBBBCAACCABBAABAABACBCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe"	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBAAABBBBCACBBBCCBCBBCCBBAACCCCBBAAACBCCABCACBBACCCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe"	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1848	sc.exe
3388	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5800	cmd.exe
4544	cmd.exe
5912	cmd.exe
3212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5868	schtasks.exe
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
5004	svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
5004	svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
4100	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
4100	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
Token: SeDebugPrivilege	5004	svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
Token: SeDebugPrivilege	4100	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 5800	5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe	89
PID 5800 wrote to memory of 5868	5800	cmd.exe	91
PID 2312 wrote to memory of 4232	2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe	92
PID 5324 wrote to memory of 4544	5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe	95
PID 4544 wrote to memory of 1848	4544	cmd.exe	97
PID 5324 wrote to memory of 5912	5324	2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe	98
PID 5912 wrote to memory of 3388	5912	cmd.exe	100
PID 2312 wrote to memory of 3212	2312	svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe	103
PID 3212 wrote to memory of 1532	3212	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_eb9fad8b1784d07247db201e5053ce7e_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAACBACCAACCBBAACBACBCCCCBAAABCABCABCCAABBBABCCACBCCBAACBCBCCAABCBCAACCCBBBCBACABCACABBAACACBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABAACBACCAACCBBAACBACBCCCCBAAABCABCABCCAABBBABCCACBCCBAACBCBCCAABCBCAACCCBBBCBACABCACABBAACACBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe" start= auto displayName= "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe" start= auto displayName= "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBBABBAABABABCABAAACCBBCACCCBACBAAABACABCCCBACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBBBAACAABAACABACCCAAAAACACBCCCBCAABBCBCAABAACABABCAABACBCAACACABBACBCBABABAACCABAABBACACAAABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBBBAACAABAACABACCCAAAAACACBCCCBCAABBCBCAABAACABABCAABACBCAACACABBACBCBABABAACCABAABBACACAAABAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBBAAAACACACBCCBCAABCCBBACABCBCBCACACACACACBBACBCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a547842a950eb0604a843951642ae91970ac6c9987fe751621e13504ba900d13
MD5 d3516ba02acd19ec0f6d178510e91746
SHA1 ee7ba41fe0ea415e6e3a8fa9988161dfe40ac48b
SHA512 51b7654b32e85381db3e1ea9cf9e86d53f9d92a1afa3ebd11603671b1cc47cd2edf24bd18b4db0777cafce64dc7971572b2c2aae407b3e7bd4620c65478b8a82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\de-DE\qap`g`v~dtlq
Size 10B
SHA256 5430f648f62903b34f5d0a2fe560133301000b6ea2ddb42a42dec8f27c858a16
MD5 8ede98d4b9d9e2bba36174d032d515da
SHA1 a7975bd2a417122a188aa9ee838d9c40ca40eff1
SHA512 2333fc1ba4783cd44bff6c4494b4cdbf29ea62fb7e246ff8e9aa94155eab47aa77a944fe10fb5c1de4e35136d421ab520c2534c6b7f862fe1c775cfa55832f71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 2ac4f8f6632246a96bfe1aea829174f253086e53b3bcf2a78f96c9bae062d17c
MD5 fd180e9cecbb1f08bdc8401d55a8ecd0
SHA1 4238bdbedc3a99ae3456a0e43d15a95658296c93
SHA512 2ee8788f5234df95a490e248097f5c9dca7d7935fe4b8b5bd9e75eff4309dbcc79aabf93f1c551ba789dde5e6c819cdb76ac31ce7ba8bcdfc999ae985ed88ae5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 5f90398a8c6303ae7b83c3abbdbec39a0adea8bff0fd97a2168df56a8150cb27
MD5 e9ec25b870b334b40d958077fe8a83ee
SHA1 dd7b0d4119beb4de5c179a2f616f455d3f29be7a
SHA512 87f120bd4842b502f8b01adb8c3e7a64520773801732a835507f8abc88316d131cfe45b648b47b9029a3ae28bd0d6cd59a85e31092f10da8dd33f7e65e3f4f35
SSDEEP 24576:m9+EM0w9+EM0iExqatgl8bz9+EM0q9+EM0AhYIm39PZfePv3r7fm6t+jqp+3l+z8:U+Eg+ETqatglu+ES+E3mgZ2HbbZt+jq+
TLSH
T16D655B12F9414072D5660172485AD27E5B34B614CB038EABE3C8AEDEFFF26D16A37271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f9f0d1e9b13ae7add2724092f87600a76941ba6ef4e237f4f7d769ccef0c6df2
MD5 c1c509bf8a496c304eba00a1d39567df
SHA1 f5e40d4c49c829855777456143dbf1aa6a143c73
SHA512 f264bec6955333e17d36f4ec9f9cec21efe8390e62e2372c3615ff683dfdbe306186a06a611a83db032a20bc4c9621939c68acba8cebaeaa032eead65d472138
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 b529605ffb70d097c1873a48664e1d9af6ac49ef6313b6a9992ea4b9040281f5
MD5 0e66d5fc19aa7e9003e79ac7203aca05
SHA1 23d9826da7ee34287c2a63b00b08365c2206ec9b
SHA512 97294ccd96ce19e952cfab4cea46aefbaee434c9d89374c666a7a9656549f607a9edc2f49d9f58882b9879748062a55153849b29cdeb3a98a614faf734d54643
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 df0d092e183494122eeb2fa9dcd4db4fe37e483efba500f96c6eb3896d648806
MD5 d4ee477902b78046eb05bafebf2557db
SHA1 dc1eeacc4467ae7fdc36225a97dd38d9d67e8ad3
SHA512 eb2450c5c53cb2add4d08892a8b4929a361cf672608a72dd623e86c1f900565360cff809ebc7fe26bbe635ae2e8048a6b946fb0f99a420d7adbb172d97ddc23f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\qap`g`v~dtlq
Size 10B
SHA256 f63a89cae3302bea810599a39190ebd08e02212a3b2401ad20f10753cc0a5ab6
MD5 0b4f77d6f2914bcbe1e60aca37c8428c
SHA1 26a3d8461e6851914e8189535c6f7fe814d6273c
SHA512 b92b0c4e176a63e745236f16cfc335718f2456d8672a0c6f716dd2f1a68d8ad0b47d3ba766819a0e7af55194c1ce8ead3355998b8ce751bad86f7a57ff35bdde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3d6bc4ff6edba067e1e6f3a6cf0606d4677b6d25c84e32d9a8f0563ab2c76a8
MD5 2c054b2ea0fb818477c3f23601415d88
SHA1 ab5c8bbf441b85160abdde38c387ac5b8b0fdb0b
SHA512 f90f18149ecf09c64afddd927063724b272610596ea66f6b6087d1b1019aab6f0d43c800e7682b254f33d35ca2f38cbbba6770713e1918108da9cd1dc3d6b775
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7f10f659e014f17d8cfae565dd6acf29d334a777ba2962938fecdd8783e7989
MD5 0ed5c088c95a9d669cfcbe009bbc1ed0
SHA1 78a65b367de578226c09daff24bf86cbd2cd31d1
SHA512 008903ce37cc0c9cf632aa972ea72cbf40612876a39f206a60cc1b45a769904a45f96f91920e4757ee475a8ed9ea149923d6b8a7d0745a517e87cb935124dc01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91f3ed209e22801645edcf6d59eb1431ea06725453550366d304dcad1c5b3d8f
MD5 fadd0caca312e3ae9eb3ad3d2432430f
SHA1 bd1939696cb23c386a8d82aa3bf47b14c7c91aef
SHA512 1b0f8763dbd345b530c72e27d78075fad8d63f2e8cc4cf880959bfad32fb9ef9365cd63c6f4eca6dfec268ccde397f39b76e6261c2d76bfdccda32321ed796a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21dcbc07ab150ad82b6838e5a42c9d2a00ddab00a1c05401fe4208c6ba0bd22c
MD5 e0c47578aa4f3ad1ee7acc4ce08c55fe
SHA1 6b3b0b2e612af4014e0a2640a9c24738cafed9ac
SHA512 8458a667016ac35d0106798b4098c9440be2b2718a821d5da10c2e016b3875b654a2beb9a2a2f234fcf30e8c9c4fc03c5d471844dfb8ba393605d429a3d083c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fe6a5a0c078834b82b6f15549c7e50fdb21779bd93bc75f9d702b51a4b61e0e
MD5 fc7f051d8a5b4240c687bd1c432f15b6
SHA1 e9020a204d0bf30560a08b567540777f4810d7d1
SHA512 548747deae505cb17abbbe390496910a406b1baa6c589a9d51fbdaf0389be01ca03d5b189da797137f9eec66b69b4b09a0e4101f4dd09bfdb866bd119ef467b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de28d90125802546410f0986c5bb0b9a2a8fe11b8852584d51f6623d1ff5095c
MD5 06c09b0aa76acb69d52148bc7096998a
SHA1 01be70edb4c90ad2b8aafab084309b7afa0617af
SHA512 71e8d7fc1b87aa7ebd438e47bb7bcdb294f5aecfa5ac989e817cc2a4ef385f008f1439e79c4e1f86ff09c820651c59bc2e4cdcf4dcf89e977de24611d35feae6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\qap`g`v~dtlq
Size 10B
SHA256 f335bf7f5bd391f1899610c1c4334c382997ca9d8c4a7d6fc2eb72597c693750
MD5 1e91dee442e0e35accf2ef8c053a5b98
SHA1 adfe62f2ec9f77c9a398d4de8fcd8de08ecd537d
SHA512 e575addcf0457ba2c5d20782022537e3bb0c39fa135d63163dae12c4aabbabf5020409cb1aa48e7c716d14f4c9ee6c77c00bc2ebad68cf792607653bd1fa9f02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18ef6dd1f6efc679b79561046aadcaf79497e68c23577e9ed0d1cc7aa4dae767
MD5 5f3492db9f20d758fca83585b1ea663b
SHA1 e79891516f799a2831e348d48f5a40eb0c75aeff
SHA512 811935beabc4bbd4fe710f33dbb3b54afd6eb7b9951b6e5108c9ace4658106f018a86ee25080538f98aa32175aff904723033497645502c173fb318b981c3e9c
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACCABBAACCCBBCBABACCAAAABCBABAAAABACBCAABAABCAABAA.exe
Size 848KB
SHA256 b40b177c4b13c03a9fde5562b11efe47411ef410b1d5fe26d4f41d2b8017e2d7
MD5 eb9fad8b1784d07247db201e5053ce7e
SHA1 b33e241438a0ebdb2b6903e0a32f2e5135ba2110
SHA512 6715cb59ca833f853bc9cd9451e1a75df5bb6e1d6c5544782b5ab6d8463b80c4c2d41b5bff363b595e895ead73530d697559ee051c99662ab1a5988987954e91
SSDEEP 24576:m9+EM0w9+EM0iExqatgl8bz9+EM0q9+EM0AhYp:U+Eg+ETqatglu+ES+E3j
TLSH
T1C8050846FA4280B2D4160171498B93BF4770B915CA138E9BA3889FDEFFF37D06A25674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 071a18082c4d25739764762029e8a88b8f00f645db2da4d02daffb37ae3c3b49
MD5 931196fdc2a8d73bf896174424834d41
SHA1 69cee233f3084d8d3b917718c6b37a1aa4867f6d
SHA512 79e9fe4fc59ab13f5f38b4a4c9a39b8c6533255f5a7f6ef2042f4018ef6bbb21fa676913c566e8e85406fc262859aa5b609ca17a77edccab764c96dc2692012f
TLSH
T13821B436A0E4CC13F52228C3B937EB960DA437DF98ACAA0957145318EBD5836DF290F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4d53aeb21d611896035382353db1980c1c40e670be80186aa175af7a76188da9
MD5 eda66dfbb4a0189389cc683d214cd6eb
SHA1 9a20c5c8df7538d5b8f9d0fa8915cc06daccd418
SHA512 0b94b5003461bc4c0065dbe947d9a6f7394132787ab7e96d1a3f3d4e5be207c22f792dda110438db07da308ccee0b09a60c6be47f5703bbef7c8103003bbbfc1
TLSH
T18B118F65A0E59817F52228C3B937DB961DA037CF98A8AB1923145318EA85836DF290F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c285be170824a49476d24162038bb0a248e70bf8edae732abcd2c1dcf78677bc
MD5 e2c6bc6c9c264c47ed617d1e9a897876
SHA1 178a523ebdfd79d2d1c9ee9ec662f07f524837a7
SHA512 2b16a8bbee75b088f5d8ae24568663b933666a5c18d03fccd5045d99ad0b1cb6bd4104d82f9519632240c2eeb909765ef88806f1784b18db111410ebcd768e70
TLSH
T1E921A476A0E5C813F53228C3B537DB960DA037CF98A8BB1963145319EA95836DF290F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2312-33-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4100-2175-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4100-4091-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/5004-63-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/5004-81-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/5324-6-0x0000000000210000-0x0000000000231000-memory.dmp

Download