b36fac5d8149cd2e9e5a1dbfa9c44c67663c997789880b27574419a647d40da4

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
Size 2.9MB
Sample260930-flgrdstydz
SHA256 b36fac5d8149cd2e9e5a1dbfa9c44c67663c997789880b27574419a647d40da4
MD5 18fcff2fd86973810c97b94245be6cda
SHA1 93d99088a9900b506c4761227462057a5adf8fb2
SHA512 9c61c25b36684cc0d50d6eb11caee7df31d6668817605e9febfbc73ef23621374068c129418394a88ae9a60b613199d270303472bf7790d90be6a240d9b84c1c
SSDEEP 49152:U+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatgV:88S8SfE
TLSH
T177D55C45FA4384F2D82B0171488BD3BB8B70B9114F129BABF75C836FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
4860	svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
2512	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCAABCAABBBBCBAABACAACCBBAABCBCCBABACCBABBBCACCCCBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe"	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCABBCCBBACCCCBBACAABCACCBAABABACCCAAACACBBBBACCABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe"	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2968	sc.exe
5828	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2844	cmd.exe
2356	cmd.exe
5680	cmd.exe
1464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1960	schtasks.exe
1476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
4860	svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
4860	svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
2512	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
2512	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
Token: SeDebugPrivilege	4860	svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
Token: SeDebugPrivilege	2512	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 5680	4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe	92
PID 5680 wrote to memory of 1476	5680	cmd.exe	94
PID 2724 wrote to memory of 1092	2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe	95
PID 4596 wrote to memory of 1464	4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1464 wrote to memory of 2968	1464	cmd.exe	100
PID 4596 wrote to memory of 2844	4596	2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2844 wrote to memory of 5828	2844	cmd.exe	103
PID 2724 wrote to memory of 2356	2724	svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe	106
PID 2356 wrote to memory of 1960	2356	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_18fcff2fd86973810c97b94245be6cda_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABBAABCABCBBACCBCBBAACBBAAACCCCACBCACACBBCABCABCCABCBCBBBBCACCACCBBAACBACBCCAACCABBBCCACCBBCAAACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCABBAABCABCBBACCBCBBAACBBAAACCCCACBCACACBBCABCABCCABCBCBBBBCACCACCBBAACBACBCCAACCABBBCCACCBBCAAACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe" start= auto displayName= "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe" start= auto displayName= "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBAAABABABCACBABBACABBCBABCCBCABCABBAAACCBBAAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCBBCCBCAACCABACAACAAACACBABCCCAACABACCACBAAABBBABCABCCABAACCBABABBCCCCBABBBCAAAABABCBCBABACCABACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCBBCCBCAACCABACAACAAACACBABCCCAACABACCACBAAABBBABCABCCABAACCBABABBCCCCBABBBCAAAABABCBCBABACCABACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCBABBCCCCCBBACAACCACAAACABBCCBCCBAAACCCBAABBCCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3edcc6842a6cf4949ed2d34c44395bbff4ecd45147803dd946730028cd2e0a1d
MD5 055756a9d4f0e90e2f957be95e4e43ff
SHA1 5d12d7559bf88d192227ba86a256f189734835ed
SHA512 f199b78cfcce0a51fc544217c4ed08c2a9af23665d760131cf3305ce7f7e9d8a12c569b50268014475214a578ae2f5f5cbaa0f31af4922dfa4d39b7e18074f6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Settings\qap`g`v~dtlq
Size 10B
SHA256 71a2d7f65e93a625c0551e00ec9a3c7c0237fdf28d0f8bcfcc982dd83e2788d8
MD5 4b0a34e28ff694f05f07cb46f4551be6
SHA1 4b232cf86a5cdb853ec8632165c55455cb60c792
SHA512 a7979a0e6f7adf550eee132b2b77060e0917df7d6184ffc87c6a0c8fec633da5a5c5c01cceb145c45beadef4fa40a8d8ca502edef8c6a796b0cfe6865e1a7719
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\qap`g`v~dtlq
Size 10B
SHA256 ec31afe2fdd9376dc47442c00a45eb4067d66dae730f907a70fc936f1ae1fa54
MD5 22a3872249138e600f64a5b0515a401a
SHA1 4de68dad1023b3ff9ce097c35d3b9e996bd9376f
SHA512 42fed4d0fa5acb5d06b784afd92121033b43389f68069d85be4d7cd459a41cc555fe46cf3357064f0431a1d68965762ee65efd37816d5ab66f4f1b1086a02adf
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.4MB
SHA256 6396938578bae6e96e5cae5eb869292c7fa31ade851396ace49c8f33354339fa
MD5 49e237f7988f979518490fe7e1d93d7d
SHA1 37b68f5861caeff9b09f657784b263bb9ae195d4
SHA512 2f5dca3eb7fee2ac2df2045ec4996f8b9bcec743bfaedc4bf2c16f69b04f132f3065cc1fd31d8e19a66fe20516c6ffee9d9095a17cd93afb50b0736e55552cf8
SSDEEP 49152:U+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatgh:88S8SfjgZ2Hb9t+2x+
TLSH
T196F57D45F94280F2D92B01714C8BD3BB9B70BA154F119AABF388C72F6E337D0A636655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 07eb07796ee7d1f667d51dd7bbf9dfe3983c0ff72dca05a6b8df58c094fb69c2
MD5 539a8b4422b72c05e7e9769b920b832f
SHA1 9d8037c69fe71d7d96e1c16d9274a4f4d84fb1a9
SHA512 7781165bad884b2cfe9a01a4c4896b1eb9e7c614c622d7cbee970775dae1c574ced4b605e0dcf3bbde704aa870761abbaefdbe43c45f2d80d110154cfa6189b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\SoftwareDistribution\qap`g`v~dtlq
Size 10B
SHA256 2414f28d897b47e41a63fbef4d641253e9ab3167246f82ea8d559dfcbf1e93c7
MD5 bfa5efcf0a7d8102f94a6cd787a1efac
SHA1 4526d6379adb601a166c705aab5b8632c430159d
SHA512 7bacaa68b1c58fe12de7e56d315f06b174ead1b5b3aab17f9d9a058158932ec7cd7e7cf0c58257c9db7944d2db3f31878e7198e759356b30925c980436417c7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 5c79a50d2f7aa4105ca68835dbccf89b887e1a321232b824e5f797c532ce36b6
MD5 d7a06867137ca79323c0ed29171acc3f
SHA1 10b558567a4d3d42cc88b10452e20ec4e5976d7f
SHA512 9eb1b3e1897bc6680e9b13064e50dbc8256442741578673feb5f43c184ce1e4f2fcba24898f09c5392634137032ba2e70156a2d1a51d41976fe816ae1e8f74bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 6a03eee592ae415f0fb4f9f2be838660b5403afaac59b05ef3e20d81dfa02b28
MD5 8cc35d6adbf939647ddb3eae28889f1d
SHA1 cddf20ecedaec113bbe8e73a87c4d65f3767117c
SHA512 bf1cc933d74d757fbc87db8a49bb81a56f0342c92caa12cd4d554dc689584010eb640ec81803bf9123cf200db1a5fba9336b59f9eaa1b6a1e6870dfdc66f67be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7fa989ddd49c196b0f51f66121ed3d16606cace6d2ff235a96e41093e8e10141
MD5 68dd43cac02d3b1a91526db1fc266e4a
SHA1 693927de58db9da70a60408f860739559fa5bb29
SHA512 27afcc9803ef624aadcd1f5a91ba6c6e7ff26b6c1146af94cafd5c7cabb1d07d8ddef36f5bcc17c37a101f84bb6f54b07ec182e593caa63c609d0478d0a8f0b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c169669a28c8d988de9797a35892d40c6505aad9b73dc7ae0182feb40be9f40
MD5 dd4c900dcfc58c4f6d2203d825b58f16
SHA1 0c3cf5496dedf1c98c3a0380a76759877b3cae39
SHA512 fe7ad036d4b864052b36bb2564ec9310e0d57ed1217b5b8aef3cd84c5e8300cd5140d26a4412556b9db0a5057948377138ad8795e29157afe708705508004c25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22a298f8819f9577ce92d597743ade47b17c303fedc655acee39abdb2c1cb618
MD5 be8ef75561389fe66ee536d98e9e0733
SHA1 d1eff71ffe2162c420b809849dac5ea502af2b6d
SHA512 122a089094f4824a208736d259e9ed3d2a5b1a034bb63bcce0ca84517a5e8a3b31c9444bf87812dd1957f3b33b58744812c8aff8cd1dfbd906a5135dbb989743
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8946a73495a554f7e742f07f4551edc4fda7ba72395a3719d6d12493576cc262
MD5 573d63458bfb466f194132704a202935
SHA1 e8da3441cce20a4decbed18e966233a89fd998ed
SHA512 9906630f96e4f63a8bb265cfb7ef1ebdd6e6b2811c3731c2c147e48596e34b9a2a5465cae1ec4955632b0d6d4e0053994bdbec22ce8cacef7ed3a838fe323e57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 692501b0b93de669c12ff838fb7866631b7642ccfd22bdf076f393315eac1842
MD5 2851f338484b18d269158866782e73f8
SHA1 0669738100ec9eaa35ef79a816a8cf3095e300b1
SHA512 7b341450dc55bb90a6683eee50f174ec699e428f0c859bc8cdc8f24aa12344545dfea69805dd00ebaf6cc263b22ad43b548bfab9060e382121726ddbd514346a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 babe4424cf0336b61dae46785a48d56e8f11d2d859e563eef021f4b6bf51c8b0
MD5 dfbd6951f3d7df3639e67fc64ffa6cdf
SHA1 884e415a4483b20b301ec90fb4c77315dc854f45
SHA512 40ca6edb402c8c4a4d89fe487c38bebdf96d0ed00096f5cfdbde1debf4978f1853c393b5d99ac6e92ce5eaf7ac52f9eb230e4e042bbeb1d01fdd238b41a37cee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 506ec831340806925bd85942fa93ec5842bd3bcd9057ef25a4808969a05d0407
MD5 4c12498185903fc26fbb7226bbb8168a
SHA1 44237514c1ae13d78e49a707d2e163c13ebbbce9
SHA512 0314d4f1b5a6ff7082c116aed9f3f6ebb3ffbdabc14043dae35eab7b1f01c7469efea09348224494204377c04083f6561e8a4640ea3fe730ed696d8126447741
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\qap`g`v~dtlq
Size 10B
SHA256 e09be7e9c7c3575a11b878f8c6181ad75ebe14f712fd5db9bc6174a2ff0f7023
MD5 5ef3c46d01e05fdfef178ea2169a84aa
SHA1 eb6a2b993dff30c73b2a2a6bf8ba371755cbd756
SHA512 698ce75a90a920662a00cc841c61c3ddbe624f434a975d6a6e5c30c045bddd6d80d76ad276867819eeeafd6e0a10e481431b88059ba49b3e15c46bc781efd051
MD5 SHA1 SHA512

Submit Download

svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCACCAAAAACBBABBBAAABBAACBBCBABCBCBBCBCACBBCAAABBCC.exe
Size 2.9MB
SHA256 b36fac5d8149cd2e9e5a1dbfa9c44c67663c997789880b27574419a647d40da4
MD5 18fcff2fd86973810c97b94245be6cda
SHA1 93d99088a9900b506c4761227462057a5adf8fb2
SHA512 9c61c25b36684cc0d50d6eb11caee7df31d6668817605e9febfbc73ef23621374068c129418394a88ae9a60b613199d270303472bf7790d90be6a240d9b84c1c
SSDEEP 49152:U+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatglK+ESn+EH+E3p+ES+E7+EBqatgV:88S8SfE
TLSH
T177D55C45FA4384F2D82B0171488BD3BB8B70B9114F129BABF75C836FAE337D0A625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8b06d33345a4cd13083f8a95bda914c9dc9246eae292bd9a2c8b88bb642eda81
MD5 dbe20bb96691cd8c983872555f913846
SHA1 0fc19c0aa2cf1ecdad59c4a340ac3582b9b6a2e7
SHA512 8198d7c27c061b0824d95020da055426f25c413f4df5d662bde3574aee4aeaec7b4b621c9e70b51ce2bcb56f0444575c59446633523bcf49ebd308bcc79ca56d
TLSH
T1CD210AA2B451CCA3F531A9CB91299BEA0CA4379FBC5CAF50138DC118A799C35CD5D8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bc700d1df56e5e4f2d8ebcfb78b79504df63819092efeb50c29afe36edd8b4b3
MD5 886cb266459727ae3a914f9ca90b1554
SHA1 96cd097f9388ce43e59e1f6425e83b6773976e1d
SHA512 9e88863cacb2ec7a84402d42c972a459898ae3e8bdd36904d53c30c42b3f471e2a1f3fb3c4e6848faa1d03881bee3aa3f881f588bb93456b94fa2101d13c1b56
TLSH
T13B112B92B466C8A3F5327CCB52298BAA1CE437DB7C58AF101388C118B749C35CD5D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e263b58292c977c7e7190fed59dc00ca356b932874f8e639357689639056a58b
MD5 e6af209bfb20e5965b81ce492bf19a4b
SHA1 ed41c9efe2a4a42875b506ce502105a88f8cf250
SHA512 b55525aafdefac0ba855ecbbb7cda945ad02538a53ecbbe37c312cbb3e7606bdce746f935b50f41b195962c694b80f910d0ba2d40f99bc244acc5cb11a8be126
TLSH
T17A210E92F455CCA3F4367DCB52198BAE1CE4379B7C58AF5013888118B789C35CD5D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2512-74-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/2512-3950-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/2724-33-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/4596-6-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4860-63-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/4860-1925-0x0000000000750000-0x0000000000771000-memory.dmp

Download