226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Size 1.2MB
Sample260813-jmkffshe62
SHA256 226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a
MD5 f21a9ffe1bcf99083344f40338ba1519
SHA1 6f6991fd07d5d80602ad412020a82196005e5fca
SHA512 afc3608d0b39e099f5d5a79de6118097e495d6a361ff144e92adf50d6d5c9d16c81227f34a63c72bacd3e3a94eb2fe1d1c4e5384c3e9031be010ff6ec4ecb4db
SSDEEP 24576:m9+EM0q9+EM0bExqatglY9+EM0q9+EM0bExqatglkafDd70iTWCk:U+ES+Ekqatgl6+ES+EkqatglrDd79WCk
TLSH
T114458C41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
4756	svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
2448	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCBCBBBACABBBCACACAABACCABABBABABABBCAABBBABCBCAABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe"	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABBCABCBAACBBACBABCCBABCBACBBACAAACCCBBCBCACCAACBBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe"	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
692	sc.exe
3352	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe
3952	cmd.exe
2360	cmd.exe
2888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
628	schtasks.exe
3724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
4756	svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
4756	svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
2448	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
2448	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
Token: SeDebugPrivilege	4756	svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
Token: SeDebugPrivilege	2448	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4856	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3952	1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	100
PID 3952 wrote to memory of 628	3952	cmd.exe	102
PID 432 wrote to memory of 2620	432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe	104
PID 2620 wrote to memory of 2164	2620	notepad.exe	105
PID 1404 wrote to memory of 2360	1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	109
PID 2360 wrote to memory of 692	2360	cmd.exe	111
PID 1404 wrote to memory of 2888	1404	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	112
PID 2888 wrote to memory of 3352	2888	cmd.exe	114
PID 432 wrote to memory of 2256	432	svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe	117
PID 2256 wrote to memory of 3724	2256	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBBBACABCBACCCABABABAABAABBAABCCBCBBCAABAAABCBCAACBAAAACBCAACABBCBBACCBBBBCCACCCBAACBABCBAABACBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBBBACABCBACCCABABABAABAABBAABCCBCBBCAABAAABCBCAACBAAAACBCAACABBCBBACCBBBBCCACCCBAACBABCBAABACBBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe" start= auto displayName= "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe" start= auto displayName= "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBBCCBBBAABAABACCBCBCBBAACABBACABCBBBACCBBCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBBCBCABACBACCBACBBACCBBAACBBBBBACCBBBACBACACBBBBBAACACCCCBABBAACCABCCACAAABCAAAABACACAACBCAABAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBBCBCABACBACCBACBBACCBBAACBBBBBACCBBBACBACACBBBBBAACACCCCBABBAACCABCCACAAABCAAAABACACAACBCAABAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBAABBCCCBBACABCCACCCCACCACBCBABBCABBABCABBBBBABBACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 56b70203c1852d1d92a151b62086e8baf27b1ac9fcd4c3a4dce990abb49ab1c7
MD5 fa2f758c2ba10e93b5d11fdde6178d4a
SHA1 ab07862c12a852031f06ee3a5e85ef7945ce77f4
SHA512 6bf70b3b95e23a238c9e79044bdebe4997d0d029c678f69dec5efe5e8114d92ba852d418ba38dacae4ad7ad97859c4fafc48a1919dee77c6d0203b7beb9d5011
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 d60029b96957648d35d003c8f2c26a3b1bc8370d76e4ecb7036c9a27fa8706b1
MD5 8b3a11201d10115ce3497590e974d572
SHA1 d562821beb7d2e4ccd4ddae028b4ec508e0c5cc1
SHA512 d0a04dffe86e46b716958942c74611925a610587af2d5cbff20fcdbc72f2c48ecf38cd8e7335dd5e6b146bac3437c6beebd1b300d1d39101be559429f76012f3
SSDEEP 49152:U+ES+Ekqatgl6+ES+EkqatglrDd79WC3XpiM5:Qh+p7tpi2
TLSH
T11F856B01B6D59032F5B306718EBF92BA4675BC218F3586CFB388672D0971AD0E635B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\9EE7EE4B-6C26-4D1A-A813-FC70537C203D\x-none.16\qap`g`v~dtlq
Size 10B
SHA256 62eeab1d7d7bdbf3d022fc65808d24ed941b5759e2efc09bb816bfa079b96abf
MD5 d386878c215334e9ff1040464a1c821e
SHA1 4fe6bf33ff2fa90680d8af24066112eaff97a2da
SHA512 1057014bbb5e5be08281e0851c1c4b412f7f3ec196bc5b3e724631432c6ccb937883f7f9b48f709b7b3c2e3430a3b0e9d979f156f16b879d8ea833296bc125c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\es-UY\qap`g`v~dtlq
Size 10B
SHA256 735a8c424d2aa68d7d50b01ac3b87383c489b27d336eb47955b7d1cebf5a107f
MD5 b02b200217f9f5ebfaa4c9ca7b896426
SHA1 6a03bb7e03b92edfa61b234129dfbe4e57d7c913
SHA512 86252b85e065d7c43305ee44ce621aa68e8801332c0719ba9f7e9c610f156d877329f972fbfc1649151819e52a1553d58d080da037f80cbb3665c5d596ed096e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 8e7dae26c5dbef48128223fe3feca7b113303e83335177d8b5f2234797eb3dbb
MD5 f999c288d286b0d3e90d760e3020bf13
SHA1 994efd0ceb8e0d030ac383148120b1db3a1699ab
SHA512 79dcd61a8abcab674b4da74da8b803ee47c9dfc654e04757091c448d57e8279947c2ba3588310cb4dc65b5329255ee1c3257822c9fd1f0134c7526bff16dd912
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\qap`g`v~dtlq
Size 10B
SHA256 8464ae5dd1e274541ebaf63bb433e3773742adac1c55f28cf470ac8ec929a627
MD5 5238cd6a02fd4292c3950e01e2c31331
SHA1 9ab364087d069651cfedb2ec5e66ac14d96335ab
SHA512 f1ae50a6cf497a309fae6e1ffcad7396aa40b46916e2215d6dd568eacb23ea946f31afb1a0f4367fe7a0c5537cd3a8625901fce3cff9b1cff55a0a01f0d72f16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7c9c68881ed07de1abccdd0af2ffa6a29b2fa47e1238185c98926e0ff210d8db
MD5 91cd5830152601a449c13fcef63a5a4d
SHA1 9280be98caa74eef8f1e5e8b3cae6c2641947eb3
SHA512 f1345f37eb41ef6189afa2acdcc5be3cbb8f27a5a9a1bd5d641618d7f37611475bfaaa26b0d087a598d5de15265e7b3a43a969f9918b289781f4f8e310a3d64e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ec0f9369f260b0099e28bb4c2e0268c4ed4cbbd479c899571d50aa081275593
MD5 e9c9cbfee5304663bdc1f20235f7d4eb
SHA1 796a591486804d5c93c4cc32289db6a2b3eb28fe
SHA512 ce64ba2112088d962cca39a5199967445f3598c555f7001245020220759b75a2db8977ed0b41e1eb296892f9d37e9dd43facb74ab40a400b2166255ada6f6d13
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5e186a795b56505c782e62a386c292e50dd309d2dd230e50fd30c2042ba22448
MD5 ba989d6e94cf7c5e3d048d7566b32d0e
SHA1 93a4d87363074284e35130bbdcf85ac81dfdba33
SHA512 4eddf3a2430ce4e2afdd5e8fb3198c6e92dbe8c9c13dd75c9fc98c085e438a8f9931202997297de870eba2d1904f48dabff539e6f8876ed651039a4776785ade
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a58a5f3815352b2adf77f334f5845724f93e3e33742a943be2efb65f0c2d2be
MD5 092b69e66496f9fe617d186f88b434a6
SHA1 903578a70c0d8d3169233b9f2e3e0c6aa8971b71
SHA512 f974ce744c32dbcc781d2c38c60db8c29feee20a9155cebc972fef68c371132f4e5d0484bc5a7ca0178f05a9a154072ac7d0afb17f4bd58d6871a79e7c945397
MD5 SHA1 SHA512

Submit Download

svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACCCAAAACBBCCBCABBABBCBCBABABAACBBCAACCABBACBABBBA.exe
Size 1.2MB
SHA256 226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a
MD5 f21a9ffe1bcf99083344f40338ba1519
SHA1 6f6991fd07d5d80602ad412020a82196005e5fca
SHA512 afc3608d0b39e099f5d5a79de6118097e495d6a361ff144e92adf50d6d5c9d16c81227f34a63c72bacd3e3a94eb2fe1d1c4e5384c3e9031be010ff6ec4ecb4db
SSDEEP 24576:m9+EM0q9+EM0bExqatglY9+EM0q9+EM0bExqatglkafDd70iTWCk:U+ES+Ekqatgl6+ES+EkqatglrDd79WCk
TLSH
T114458C41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6a6d70bf300bb0846568cbb2018c9aaf7a9637ac1cb759946843bd862a6faf7a
MD5 4aa341b80ae77639974613b5f84572f9
SHA1 2ecc3b76dd469cb34f1a6cd786f6f6dd2a8e8e2e
SHA512 44a1b60644827341e997df6b6719c2ee0ccf492c1fd11db74c42099865e5866f0574e22e80ded47dbbdaf06d6b8f5dfc2f96e12614e2ed4655f0301384ff4ae2
TLSH
T1A2210750D4E4CC63F93264DFAB3ADAD24CA8369BAD5C6B18630E8109F7D8C728D254D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 6e5996a14a48acf251034c373b270b755f9689761a1ccab0e4859100f0dc0fb2
MD5 d0efd72176f9754cae8e28d7a1ff6579
SHA1 be60684c4e8597b60cdde57dc452584352e967e3
SHA512 e053c99f901f41aaad4a2e93b0e5dfe0d3b8c185d5e88a9af6608a5b42ef93f369b077838ec9e3d2dba3845ff953a1797f60b8b57f7d5c22f14f7e638d3e9ada
TLSH
T1D4012640D8A5D853FD32249FA72A8AC24CE8368B6E5C7B28230A8109E7C8C724E314D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 eea97679c1a0989250debd001c6d44100f29e0ef8a4fd1e2847de08e040e1d12
MD5 6399c5f6a8e9b4d2aa5577d5c89002d6
SHA1 03b649f254ed3277d3dc077d37d3d68f7603c5d6
SHA512 c8737bbc8a457c716705361d6f5f32562173475a9bd8044407ccae128d6d2f5edaa2619f58d4ec0a1b09af987793ae9105cbff7d0484f3b1f78f7ea6cf652e4b
TLSH
T1D721D750C8A5CC53FD32649FA72ADAD28CA8769BAD5C7B18630E8119F7CCC724E25492
MD5 SHA1 SHA512 TLSH

Submit Download

memory/432-35-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/1404-6-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/2448-1694-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/2448-2774-0x0000000000BA0000-0x0000000000BC1000-memory.dmp

Download

memory/2620-59-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/4756-87-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download