6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Size 18.8MB
Sample260813-dc448azfrd
SHA256 6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb
MD5 f15ebd0e87302c320e5cb18e2a87e639
SHA1 3121cd871db395ed909662915136a4164ce792cf
SHA512 7c45e9f666deb0bea6fe58ba8c45756d334330a587ed8617839d91cf8190d833ab5e0408ae64be76c6b7bcace77d2d761da7b252aae31d33cf06f20e4c585bc8
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+Et:O++++++++b
TLSH
T105172A09F94340B2D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
1804	svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
3272	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACBCCABACACBBACABACCBABCBBCABACBAABABBBBABCCACBBCBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe"	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCCCAABBBABCAAAACBBCCAABAAAACAAABCBACBBAACACABABBBAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe"	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	sc.exe
4500	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2336	cmd.exe
3268	cmd.exe
3656	cmd.exe
4964	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3240	schtasks.exe
4804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
1804	svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
1804	svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
3272	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
3272	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
Token: SeDebugPrivilege	1804	svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
Token: SeDebugPrivilege	3272	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2336	5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	100
PID 2336 wrote to memory of 3240	2336	cmd.exe	102
PID 4064 wrote to memory of 2668	4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe	107
PID 2668 wrote to memory of 472	2668	notepad.exe	108
PID 5040 wrote to memory of 3268	5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	112
PID 3268 wrote to memory of 2264	3268	cmd.exe	114
PID 5040 wrote to memory of 3656	5040	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	115
PID 3656 wrote to memory of 4500	3656	cmd.exe	117
PID 4064 wrote to memory of 4964	4064	svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe	120
PID 4964 wrote to memory of 4804	4964	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBCABACCAAACACCACACCBBCCABABBCBAACBCBCBCABACCAACAAAAABBAABAAABACBBCBBACCBBACAABBAACAABBBCAAACBBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBCABACCAAACACCACACCBBCCABABBCBAACBCBCBCABACCAACAAAAABBAABAAABACBBCBBACCBBACAABBAACAABBBCAAACBBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe" start= auto displayName= "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe" start= auto displayName= "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACABBBBBBABABCAACAAAABCACACBCBCAAACABBCAACCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACABCCCACCBCBCACACBACACCCACCBCCBACCCAACACCAAACAABCABBCBBBACACBBACBBCBBAACCCCBACCACBCCBACBBBBABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACACABCCCACCBCBCACACBACACCCACCBCCBACCCAACACCAAACAABCABBCBBBACACBBACBBCBBAACCCCBACCACBCCBACBBBBABACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCACACCCCBCABABACAACCBACABAACBACBCCBCACACCCBCABACCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e823c7a646904196ac491f5e3b81c1d8c9679a8bb02f989d9a38b777bfacf18d
MD5 68da0e1191f8023c75fa17b61d79dbbf
SHA1 de31b6a70a64f5a1819a34c8b8ddb778cd9f513c
SHA512 dc264e58ca1cce181b97237ec5a2a873eb11a8660140019a2fa1cfdef9b5389bca3c3871902843738464000e7d5131f4ccbe2bec0cdb1585c2cf96f5f3f09721
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 19.2MB
SHA256 07ae036c558de12526599dd45cbff542ddb467fa596024df89bf883271bd19e1
MD5 094e7e934c8f316ea89befeb30984faa
SHA1 1abaac607ee7755453da28fb1868a0e139a12325
SHA512 6509e2401428d920d020af46077ddb8a6620a7e5e3979a12249ddfac04d2d797415b89e2415e5d33164d013969a6f11aa0580bb508e1f70e2b47cf59860b445e
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ev:O++++++++Qpi7
TLSH
T1DF172A09F94340B1D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 8bacf1317bf322c2c8532b6ea8fe3975174651301260b341f076e25c98e25cbd
MD5 45ef1e525451a288511cfcdab6a4987d
SHA1 cfb64264af5aef4b7d01489fd9d8d04c748b6050
SHA512 01557bc360923a7c57f4baf8a971d7dd4c4dba436fade999c9d69345d0d6af16227e9b85a75b6b57012d169140519ad659a49202a25ddbaaf7e2c6add19e0712
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\qap`g`v~dtlq
Size 10B
SHA256 d3f4d6a17a0cdcb189972e66a4c5bf01109b62fd154691768a9812584b99e469
MD5 2eabde116aa9bffbffeca85a9c232f5a
SHA1 0929bb07e47b129f58272c9a7b998fa4749dcbab
SHA512 c89a211860bb5b6b7655b5997733c3db44861658df7de779d7401ce879582808f46f43b67878ddac13e9416cdbdd283f7296c786de7d3462b387ce94d562e128
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 598d4cdc929ee73c7f1c93b4eb7178c4c877429d5bd1f5947f7c4b37961b8018
MD5 24d810ac5d8b1d438bbe2e7216d46c09
SHA1 be066415ca483cc620c803db5f4942f3b343474d
SHA512 0a22117318d9eff49018703485e8666ed1021f4e25545c4f5ce4b4f407bb7440da02f84704a804c160d87023b935b18abe7fb29548d2799c0cb3b72d149ce4e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\qap`g`v~dtlq
Size 10B
SHA256 7dc5735c2f75d6ef2b88494fa8c998704572de37e9e7dab0ce130efac6d4de10
MD5 2b9a5eb851dc2e4addb8462b9db4c971
SHA1 a2d7be83b299060c1e0503ddbeb69dc1dc4a37ec
SHA512 84e1b0e008b8be554e3d4c43713427d8ae207f7f1c94dafdc9d7d3f52c2256f9e111ccd539011d4bee1697ca0a1d3b4ee270a49a3230765b812930fb81f6e505
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ec638e87c60d229a9091a402385864a5a3d153918dd305a2894ef8983faad9a1
MD5 0a94b964af4920b855a28f76c97bcbeb
SHA1 f4f65df6a3792f33b8cf9b5a4ea8e7622f87f09a
SHA512 91122ad9ff0b38cb67a2470438493f73c026bd04d7d29493266dfef0b354d190d1083e536cea882a8a13441362a7aa4ddd53d002ded5b5464db6417be09146ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 1fa8fdc7b82d93a0cd3ac1b1cf935642437cc7caaff326eab678d3372bf24069
MD5 0134e3c563acfbb9d2983053ef9474ae
SHA1 e5b23c8ea90b60adf89ab7ab211d1878386243fe
SHA512 763e31ee2479112a44fec7654c44e982987b3d70b80b066c9a2ac3bac192a5d3642ab2aef20b01a80a2ef72a6e6699ea612c914e130b23af791e6ac95bc3d7c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7aca789f0d9aac1afe12dd57e6f590c74de483994f23e7b08a6d3409a5c15357
MD5 663c85dd3cb2a32656f5832863d59a45
SHA1 559e8e46e39fc884a3be14f70d53072174117c0f
SHA512 000e158c8e3c3e902c2cdf820f1c1f6f9234037fdf9bb84379f566f2e6e8196ff83b9335c93ed2f10587c74ea9f7c5ff2a5c6a75b7cc4e1dbe5d58370cc9a1bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e97909fa102cfe0b7eb33b2fbfe37904d46493efd474b1d6c3bb9f532208b27b
MD5 fb09237739f258e0fb770a14e08bb627
SHA1 30ec2f0ab4eb9447aac217b18a6916a1c4e3f1d2
SHA512 aa898cd4948c45b49571b991df38c82c573b1d20258be87f8df20cab2bc375b7089bb43027fdf942f702a954aea8c12519ade8faeedbdd71bc72ee9b2240520a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08804aed1347b8615b84267fbf046cb7ea165eadfaddde2067cb70bba25ee071
MD5 ead034d3c46536a52ca01295e5e9a1de
SHA1 dd8a4120d232be5edd8ce3506a99bac64e2c96dc
SHA512 738a431ba8e13705b733d9c62cf0a48fb5603c09171125c29ace6ba23d2767137bbe76ab980ff09d9de64f8b24fed4f2eb547c73e143e3caec7c6c03c7f86e6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd064b06743b19d123f888e14c5de502a30a193eceb55804425a14dde10d44f9
MD5 ddb8bd8ea6f8804b3507aef331b9199d
SHA1 bc268e4118ba85269501e82fa6bc0c2c3a989ecc
SHA512 7a36877e1613fdf14b862e71aabf7db6ff5bfae96157365c6ea9e81912a9c93d1c1011d93d0006d42c1b32144e17f8b82ea1f6336b5f9acd275f62e62cf2971c
MD5 SHA1 SHA512

Submit Download

svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACCAABCAABBCCCAAACBCBCCBABBACBAABCBCABAABACAABBBBCBC.exe
Size 18.8MB
SHA256 6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb
MD5 f15ebd0e87302c320e5cb18e2a87e639
SHA1 3121cd871db395ed909662915136a4164ce792cf
SHA512 7c45e9f666deb0bea6fe58ba8c45756d334330a587ed8617839d91cf8190d833ab5e0408ae64be76c6b7bcace77d2d761da7b252aae31d33cf06f20e4c585bc8
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+Et:O++++++++b
TLSH
T105172A09F94340B2D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cfbf271d4f99cbb629addafecd0b4234aabdc18f93b2fdd24e9631b2f14572dc
MD5 8b12391b41a595e2a520037b46e726b4
SHA1 227656dbefa617a0741dabdff3647f290bcd0de3
SHA512 f2ecf91c06a2575fd4defe5d73228a38483ce650fbea3ced6dc1b3fd7a70e826a3c931918d69b59b71e4ada856deb45974054a920e4a7868be0a3285c410bee6
TLSH
T1D521B751F4F5CC63EA3268CFAD2A9BA20CA4379FEC9C5A082348D61D7B99C72CD154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 7768e72ab7303005af52a941a41d1ce70a9f1ce373b438fbc0bb4480bc1a0f65
MD5 5ea77fd161c9030db8109a11fb762672
SHA1 7d8b38a6f058adf5809abbe455b94372f659f425
SHA512 eaee93e163156cda63aba09eef028dc84b37cb4fa6d849f1123f03ee5977dc0616bddc8f1cc1bc0b6f279eb59469ad8ef0ab727d75e4c350a3295600ad7554ba
TLSH
T1D011EB41B4F5D863EA3269CB9D2A8F630CD0379FEC586A082348821E7B55C72CE114D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c075b4e703dc23d71869de5c51ac4235b813f2ee9c5307f26085801ec5a734a8
MD5 29922a7b8d31f2bac809c190878f3d52
SHA1 97a22e0086b4fac47af62f1591664d33b78df494
SHA512 76960d0fa2ab84bc06db103e2a5f906a5f6b5ef7df4d8c1fad3b445f873264b716bb32016eb6468ff74266ad2328f009bc711bde71b2ba9025abe0527c0e84ed
TLSH
T118210E51B4F5CC63EE3268CBAD2A8FA30CE0379FE85C5A082348961D7B99C72CE114D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1804-76-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/1804-2939-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/2668-57-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/3272-2621-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3272-2958-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4064-33-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/5040-6-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download