d3acd39d3bb3593f19b4789c8da71b3b2b6cb0bc67d420694d17e7dec8d6d86a

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
Size 9.6MB
Sample260810-csswfszalc
SHA256 d3acd39d3bb3593f19b4789c8da71b3b2b6cb0bc67d420694d17e7dec8d6d86a
MD5 82db7bf6293f4e2998c72f1af7c457c7
SHA1 f661bdb9b057bc9429e60051c93d211884d78677
SHA512 121efea2b68e2e54a1608bd4f70e489f1a6f01630830249579f4f63d58e634966a9e5298d03b8784c80b1061dea7225bcbc119d42533215541d182a0f8a2c3e8
SSDEEP 49152:U+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+EP:lQQQQQQQQJ
TLSH
T1F7A62A09B7ED4861E4B7623149A78266DAB2B8515F32D3CF6384833D4E73BD0AE31B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
3504	svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
4640	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABCCCBBBBCBBCACAAACCAAAABBAACCABBABCBCACBBACAACBCCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe"	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACBAACBAACCCBCABAAAACCBABACACACCCCACCCACBABCBCCACACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe"	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5000	sc.exe
3452	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5084	cmd.exe
3008	cmd.exe
2132	cmd.exe
3592	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
1060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
3504	svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
3504	svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
4640	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
4640	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
Token: SeDebugPrivilege	3504	svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
Token: SeDebugPrivilege	4640	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 5084	1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe	97
PID 5084 wrote to memory of 4880	5084	cmd.exe	99
PID 3552 wrote to memory of 1664	3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe	101
PID 1664 wrote to memory of 1940	1664	notepad.exe	102
PID 1488 wrote to memory of 3008	1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe	106
PID 3008 wrote to memory of 3452	3008	cmd.exe	108
PID 1488 wrote to memory of 2132	1488	2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe	109
PID 2132 wrote to memory of 5000	2132	cmd.exe	111
PID 3552 wrote to memory of 3592	3552	svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe	114
PID 3592 wrote to memory of 1060	3592	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_82db7bf6293f4e2998c72f1af7c457c7_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAAAAABCABBBBCBBBABBBBBBCCCABACACABAACCBBBAACAAABCCCAAAAABCAAACAACACAAAABBABABBBABBCABCCBCCBBACABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCAAAAABCABBBBCBBBABBBBBBCCCABACACABAACCBBBAACAAABCCCAAAAABCAAACAACACAAAABBABABBBABBCABCCBCCBBACABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe" start= auto displayName= "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe" start= auto displayName= "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABACAABCCCBBBACCABABBCBAACCCBBAACCBCAAABCAABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABACACBBAAACCAACBBCAABCCCCCCBCCACBCACCACCCCACCAABBCABBAAACBCABCBCABAAAAABCCBCBBBCABCCCBAABCCCAACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABACACBBAAACCAACBBCAABCCCCCCBCCACBCACCACCCCACCAABBCABBAAACBCABCBCABAAAAABCCBCBBBCABCCCBAABCCCAACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1060

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAACBACCCACCCBBCBCBBABACBACBAAAABABBBACBBBBBCABBBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4712de5480edda0e3b58cff7ef2c789040e4d2d3bf55586deabf0d54b287b724
MD5 c491bc932ea78a572f7153590aee38b4
SHA1 3d7600eadd1dbacad77cc6d8f49f8ed399d97046
SHA512 af45959d3b0649bdc30ae5b9611ae402e4e9750ebbbb667dc3b34c97af3cf36963c2b6be57b5caf6e475819d8fc8e57a659b3348a6a282e6895ab90c3f156564
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.0MB
SHA256 bdf714954b1fd01c3f1ecd20c9e02200026474a077b8a90e2572d46e311666da
MD5 dfaa9edb98f86a8323811b10b2e2fa01
SHA1 ab05e9162f74fa76dcbf5654d0e581a95eab0aac
SHA512 5384233fe63dbba02569e660c3c1d757b3059c8ec3c2b3b768041c6be5124854ee6212a8cc715af49afc6778f71a91983d8c7c04ce21099534869352f0669d36
SSDEEP 49152:U+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+Eo:lQQQQQQQQGpi+
TLSH
T118B62A05B7ED4861E4B7623149B782669AB2B8515F32D3CF6384833D4E73BD0AE31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\qap`g`v~dtlq
Size 10B
SHA256 fb7ef9fd433ae2fed2883088469398555b619d48bd42d5bc2dddd6f1e71d270c
MD5 bbf9449e7b085dc3321f9d27c2fde9e2
SHA1 b510522c6c60163c89848be472adcaaddc471d10
SHA512 2b15035e8475a368436571065e91ba2a6458a8e7efc0550eb21b5b30da6b50ecfbc96ccae65d11b1474a4e6c750d9c51f5426a96114a443ea872cc30956f5cde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\qap`g`v~dtlq
Size 10B
SHA256 5ae60d318173aa315a3bd4686e8720ce2cc64d9b7f6e38d4185a5b1231e61134
MD5 5f67cae99c796fdac35677b20941ac13
SHA1 4d97cfc890c9aa7d0e0534e616590711555f1f32
SHA512 8ff485ecefc25dd001eb10da5d487ab918df2f7fee4fbb6747df2dcb50ee414eb1c978958a532c47148288613b296c852335219fc64aa6fc5187cd9975dd9db0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 31ac2dcab147cc529d37cdb6ff1109594fdb536428f920ba7d1431692429a4fa
MD5 676afb8cf2adc50ba143ca9b88a2e6af
SHA1 7f3c16fdc34eb6bd67ff30d653fe4e608afcb6df
SHA512 eebbb6b431da9210b6caf1f57ca9273bddac9632a537f39bd7794267d161cae2f101b63e6d60a408894e67ca68733c131b1c22ea13542e3e3d9b2b9347f50288
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 1439cfae90c8d7e9ca9500478de36b55cc82a32c8450d2125190fe05c5f25299
MD5 0568940736678ec59f3ff8c83f9c05b9
SHA1 039535fc1af1bc16a588ee8541e5f82c54fb017e
SHA512 08a60bf337c6fb924b59c8aca2368bb0e53a6565a12520f76f78839b7d345c83cf429332be5c87163101304ec09c4dc40cd84128aa849a06e749ff3821f5c23f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 11e8f9ff77fd365dc6405afaf28e172ccd2dcfe31356580e875e14fe1e1fb2d9
MD5 e7ba585e0e3fa4c856661b6a62e7d5d4
SHA1 f1e105e78b1e693e9b74d065c7a1d9eae176c2de
SHA512 69044dd8c61ed5841ea15d4c7405a6c46615e7a05d9730659191a3a18778f6bc3469777acddd353153f47cd9d53b071c738db39a6846882e86424ba2090afbf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30b7ec9b5d33c063874512c955ba113f35ff6e65093496484d64a866f88bbd3a
MD5 71a87c4ae0ec2f53d71812b01ef3294b
SHA1 12375185a8453e6853d623cb5c5f496d0fa3d334
SHA512 96bb9b5cd4fcb9953f9daf3b06f8640e5a92cf03e7f69912122d5fd322fe4122581c194ccc99f65c06763a374d21fc285103e740f1c2c279963701aeb3d81ef7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3bac8da1ff638d9be2d4df2754bfa619e1cc65c0e363f517eda7c3833927c522
MD5 5e805b696b5262db818a056f30287adc
SHA1 e959c1ded5fee98c20c4f1df5780f98b7cc1421d
SHA512 a0788fc80e93dfaf09bc255098b453671cbf164a83c7cec44230b8da81ba680f84554c9916f7593cbe26bbed5fc5c17935dae5d8c6fdefbc9ceceac28a0e0e99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc67b42bfc6a37c19e107fc7e687830f7f8e7f29e9b08056231b29e49a3b5142
MD5 02509a529322f2c806cc8dbbca396e50
SHA1 c98cfea327de3b8c43b7ba5583017a52f9aeead5
SHA512 3d4811cbdc81d663bcf00e33972576f83aee081bbb4e20c6b4ae52a67e43c1fd50c5c15ceb200b5243eb9a832c8810b115cacabc9ea05c076e576607ca25b435
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0816b4ac6a46cae908f0ad5d66f995eb492be2235b5771ad5f3de88bb6d3e563
MD5 83cdf6bfd4f385fcb1f90b77f483bd57
SHA1 206a461eba6ee7760df0ad48bfa6fd43dde44f53
SHA512 54f19fcfb35a3ec595daf94beb412b76ce3caa9fa9cdbea522d6125ebea0d4eb00bce00afd9ddcab164634bdf78e1c06985223a2e0b8f509c2c5a371f2ea4e96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 427df062ff4361200f00a325506585bdf242bab5b915a6aa449794458c0819d9
MD5 7b4c62e7e936e4aab688b9a405f96635
SHA1 090b812e5889a397273ede7c17eed0bdba50ce79
SHA512 21e546f1bfa0b20d9e057a46ec6ecbff5a430d7d74f1f52da165c362086bdfa64a48772b5028a390e33fc4f028e73cf0b261cc5221c5d152b5190ae867a9cd00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c16f4ab8c05847efc9c86bec24b8eb26dc0cdcdb0196196961a760c63f91c156
MD5 452f45bb5d11525999657c1a00d1fe34
SHA1 e5e7d7c98b5b70c6234c491dca9bf17989560743
SHA512 74ba6f4218eb68beecda4beefb1eb7ec83c110935733868986dd470cdd8fafa7253e65cecfca4ac5e30d086cda4668e282f761bd2666d8fcdf88a96c190648c5
MD5 SHA1 SHA512

Submit Download

svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCAABCBBAACACBAAAACABBBCAACABCCBCCABBCCCCCACCCABBCACA.exe
Size 9.6MB
SHA256 d3acd39d3bb3593f19b4789c8da71b3b2b6cb0bc67d420694d17e7dec8d6d86a
MD5 82db7bf6293f4e2998c72f1af7c457c7
SHA1 f661bdb9b057bc9429e60051c93d211884d78677
SHA512 121efea2b68e2e54a1608bd4f70e489f1a6f01630830249579f4f63d58e634966a9e5298d03b8784c80b1061dea7225bcbc119d42533215541d182a0f8a2c3e8
SSDEEP 49152:U+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+EPiw2j+EPiw2Iqatglg+EP:lQQQQQQQQJ
TLSH
T1F7A62A09B7ED4861E4B7623149A78266DAB2B8515F32D3CF6384833D4E73BD0AE31B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a4e2b347cf8bb3270fbee32212f0d002a43d28e64804d00c0bec155c072442d0
MD5 fbd2a50ed999a62cc388c3006e56db61
SHA1 a0f39485f5801a891825c7ff15e6111ab6e952b3
SHA512 d26d180cb99ddc47c0f696e885d939feab821a3d1334cdc94784285614fb5555148fe84ec33f2b100a1e287cd32311119f7bbee470f541168f6108432883cd3d
TLSH
T1F2219666E4F9D863E932E8CFA619DAF24CE836ABAC5C5D9012084219BB85C31CD594E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 13ca2949c7b9b00512ffd4630e09eeb8dada871e5ccd70362547a94a274133d7
MD5 e34b7c0ec4531fd3f8e96b053e2fcf23
SHA1 2aadcce9c892b1f48e068921969db1f91f95fbcd
SHA512 7cac6bdb0eef251b0078f2dcfb7287609b8ba854a1160ce4e6388a9a360b5b364079a2f5bf03106a34b3eaa8d17b684e1eda9365f4b064e84070f3770caf091f
TLSH
T122112762D4F9E853E832F4CF5719DBE24CDC325B7C5CAE9023088209AB94C31CE594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f8c095b9e6ce7f477af752fd4e352ee5e86221a4dd8132a3001ca69f5dfa8ebe
MD5 2acdfca7584fcef1dd51db5600c38644
SHA1 12bde1aa0c198addef4cc7b9d77584c44cd3e6c2
SHA512 612ecc8908f1ec2bcf536aaeb0c1d5a5a1137d41655bdf729aeadcbf882630f39cb3061acadf7d1a1e19e9b933b687ccd3d4fc9997d6ab47822a45f9feb78db2
TLSH
T11B21D766D4F9A853E872E4CF6719DBE24CE8369B7C5C5E9013084219BB84C31CE594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-6-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/1664-57-0x0000000005000000-0x0000000005001000-memory.dmp

Download

memory/3504-85-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/3552-35-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/3552-25-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/4640-2048-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/4640-3016-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download