47ba739f0264f7f8f5549073467fef72f14207445d8bf236cc6b374ac9b11f4b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
Size 6.1MB
Sample260814-dym3tstepc
SHA256 47ba739f0264f7f8f5549073467fef72f14207445d8bf236cc6b374ac9b11f4b
MD5 b6b2dcfefcc18a45a6fd324d8e4361fe
SHA1 ca7929dfc38d494d46e12ee8fc27d8406a8d29b4
SHA512 40a3a6c1d415eaca351e533b13485c1695dffab653ebf92aa12d3ec3ccc02e0afdd7f57de5f869b99187795a7e2d0cb83b888c65b58d554d89adfbfe40c48f26
SSDEEP 49152:U+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EpqatglxhOQ:iUIsUtUIsUmp72
TLSH
T1DB566D05FA8640B2E4670171489B83BB4A71BD214F229ADFE388D37EAE33BD0B535755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
2448	svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
4240	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACCCABBABAAABBBBBABBABAAABCACBCACCAACABCCBBBCCABACAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe"	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCCABAAACAACCCBCCACACCCCCBBBCABBACCABCABACBABBACCBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe"	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4904	sc.exe
3008	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1324	cmd.exe
3108	cmd.exe
976	cmd.exe
660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5072	schtasks.exe
5540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
2448	svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
2448	svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
4240	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
4240	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
Token: SeDebugPrivilege	2448	svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
Token: SeDebugPrivilege	4240	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
228	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1324	4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe	101
PID 1324 wrote to memory of 5072	1324	cmd.exe	103
PID 5124 wrote to memory of 3688	5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe	105
PID 3688 wrote to memory of 3752	3688	notepad.exe	106
PID 4356 wrote to memory of 3108	4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe	110
PID 3108 wrote to memory of 3008	3108	cmd.exe	112
PID 4356 wrote to memory of 976	4356	2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe	113
PID 976 wrote to memory of 4904	976	cmd.exe	115
PID 5124 wrote to memory of 660	5124	svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe	118
PID 660 wrote to memory of 5540	660	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b6b2dcfefcc18a45a6fd324d8e4361fe_amadey_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCCCBACACCBCBBAACBABABBBBBBCABCCCAACCAAAACCCBACCACBACBCBABCBACBACBCBCACAACABACCBCBBABBACABCABABCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCCCBACACCBCBBAACBABABBBBBBCABCCCAACCAAAACCCBACCACBACBCBABCBACBACBCBCACAACABACCBCBBABBACABCABABCCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe" start= auto displayName= "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe" start= auto displayName= "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABCACAAACACCACBAABAAABABBBBACCBACCABAAACABCCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBBCBBBCBCBABCBBAAACACCABCABACBABBACBCCBCCACABCBABBCBCBCCBBAAACABBAAAACCBAABABBBABCCABCBCCCCCABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCCBBCBBBCBCBABCBBAAACACCABCABACBABBACBCCBCCACABCBABBCBCBCCBBAAACABBAAAACCBAABABBBABCCABCBCCCCCABACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBCBAAAAAABBABCABCCCBBAACCCACBBBBBACABCCBCAACCBBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 db5612e5c1256f952cf389c873fe3bbb8b8210f19f5cfacdeeae126bce2672b6
MD5 b831a500f1882ada582ceaeacaaeeecb
SHA1 86f70b91c5175badab1f08dcb55dc412c6c3c697
SHA512 c19441dec4c467589ceb183d46ea49f1381f45281c0bddb1c582cc7aa8dea7e1c6300bb6e29353558b52b841b5e18b1d84ae5075a004e2fba308aed0024820a0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 6.5MB
SHA256 6569f86ec21b84fc56c2a2b6b846a21bc382659e43ae5757b619d26a32493217
MD5 fe789a6f02d6bca1333b291488807532
SHA1 a87fbf5664330b5f75471b60b0a5d41b66668b84
SHA512 6ef2c1d1a7811f4c4ffd05aece4bae692ae1ef003e80f91a24dd40c51da6e195d6388649203d1f1273e56a59db2298692f62de69dd39dc8eb5d281646a6d96c5
SSDEEP 49152:U+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EpqatglxhOn:iUIsUtUIsUmp7hpiQ
TLSH
T18C665D05F68640B1E477027149AB93BB4A71BC214F229ADFA388D37E9E33BD0B535B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\qap`g`v~dtlq
Size 10B
SHA256 dcedcc1499863e1eabf98a5ee07185541c79c731eaadd657f2e5b07d561406f9
MD5 f55490e1b5baf16c1890f817043638a2
SHA1 53c39f08b158d77eac9431129e3489c64cd71751
SHA512 df29936bdc7a9c6d95e7116fcb748147d8be034a7220072713fb3a495942642432b13347caff003481118c4a517d95096147031a10232f7a1516f19dc4de0da7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\qap`g`v~dtlq
Size 10B
SHA256 825f76b101ef657c1933258ecbbf66720da443fe6097c8018257fb08b379a42d
MD5 1d5f8a70acafc20dac70e6f7fbd8201c
SHA1 268e0e63fb37152bb72c16a11824684a92034a3d
SHA512 2abbe37edbee118204adae32b6669a95153a7ea855264a016f6c010a80bb5d3c888f38a0022a72d7b33b94abd2a0265cf086e2edd31ead4b909c46cabb625b87
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PPBCompatCache\Low\qap`g`v~dtlq
Size 10B
SHA256 3d0c74123e3f77c8a6f916a2cbca1981fa024c4d52f62c95962ee53f162e43eb
MD5 a0503d2034085acef64b072a2e262569
SHA1 111a7800e03ce0b01364c921a8e0af142359ba56
SHA512 9528c50963e11c9e8f0f20828836169496014c3400b8ec356b7cc58af2cd1c296901f4e83e157b3164a7a031695d4c221f4f6048a5c69bfb1523f680495ef471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 5dd8023335f237c3fb9fdcfc27d4cfc5b51d6381916f3656852ea16b640ec74c
MD5 c70a6f1da02c07a60579a91b91b7eb75
SHA1 4d619b55d0f2eaf925e093f9afc19ca76c36883f
SHA512 e7c59e38f72ca96375e0524f2b7cc28bcde8d74cf038b460ef6a8ad30b88492f00e77a2aeda8f281fb1b67a43553af8a41c06614ba6dc232752b853e403eb1b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d8bd9d7a8e8962ed569df1dc13fa1922ecf92adf0c70e8e0e2fa026e766c152
MD5 7acf79383a841b982d5485d6ab803b56
SHA1 a512e21cc5e5821d6bf4f34c9f0dd7c619387e82
SHA512 9a5abcfdb952145935ef67a0d1a8cacd725e7e093442d7a127b0cf178b971e62e865b228a62aa9cb66be787b91da9e625eab44d1b99c69cbbdde82c4b54ce33d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 052e6d226fbb4060340580ad0d58be776d6c6ae2ae2b31690999d0b1c892755c
MD5 5ba26eb8f5064123ee55adf11f76cd06
SHA1 249ae8490f4367cf1bb2deecce157f9f0a04ef34
SHA512 f73d2e9ca0dd47310d81dd6122f229c4e95a033e9fc19d2fd2bcdb678de0b4e0435d218878a118aab17ab59039110456c2e8b5fe5412ca81c3d72a14fd5d1d01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be6612f79f8a83696dfebb717ef1eb5f148f589c65c8a81303759ae57ec93ad0
MD5 e6d4b67bf2e71bd8d4a02a712aa3a622
SHA1 077e169f869f704ef87df8645a08847753ffe44b
SHA512 b2f1b4b7fcf6fe04db7b9b01aad2e6671e9ff00427324ccb1ee9508ea9d67cc7542a2aa1bc3b0ac065130ad3ef1c829e6229d56edbfe2e42084bc2c10e231ff5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19f35b71797766ab36646b65473ee20ec92c862d91fd42ae760a91e5833e3948
MD5 bb96fb7c3bf70577fc69423c75d16bde
SHA1 41039a6205d4a319d1db06fd492cec85f5a1f50b
SHA512 6919fa6feedd3d7095eb2d2a9dd2dce124c48f02bd74666889a9ac9a8153145ee7567ccbb08739bc79285495c552075629258eadd18c499b8ccb7f3467d1eb79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ad209f48ff7ec26abd5b929ab7b08e0e84f6a60914baa375394780b33aa594ac
MD5 4c049ee0bd8b2abf909eefeea5b219e3
SHA1 e9f454e2c076c2a8cc42e29ad780d8ea127b4fa7
SHA512 90ac82f9d6e9965cead94eee68a09f709dab8223d66c4c2f57298b920e57ce53539ca6db3aef510724b5df03276e7c3db51fab451c3a5b97687ac49d008732f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6f63630a689d63ea15c1847b332c299bc457b4304d1c8601834f39efe61bb254
MD5 220c4399c5fa99a91f6e650ec11c63df
SHA1 7f2698cf33f01e62238cdbdccd63862909f080d4
SHA512 c1919898f7e4423d1c11bc1390156d5c0784694b355c54a84abf36b1cd1c491c28b5ac4bd97bb838a6d22d871ca0a4633b8c21416906e2cffb84fb330c0f674a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fe415195aabd38c239e64490031f8b9c776acecf8721781339d39a9c2e7c263
MD5 632ffd4168061e50ff4100da5f834892
SHA1 c5a7c88876e8677221814447f5d9d9084b0b866f
SHA512 4de52b2f480d45dc8e1f6a795e1df6ee02ff408b279d2220082752596f34942957f7ac4ef3a1a3f34484318ec84a47ac7294c1591269dfcd063d4c503a836a18
MD5 SHA1 SHA512

Submit Download

svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBBCAABCBCBAAACCCCCABBAACBCBCCACCAACBCCACAACAAABAC.exe
Size 6.1MB
SHA256 47ba739f0264f7f8f5549073467fef72f14207445d8bf236cc6b374ac9b11f4b
MD5 b6b2dcfefcc18a45a6fd324d8e4361fe
SHA1 ca7929dfc38d494d46e12ee8fc27d8406a8d29b4
SHA512 40a3a6c1d415eaca351e533b13485c1695dffab653ebf92aa12d3ec3ccc02e0afdd7f57de5f869b99187795a7e2d0cb83b888c65b58d554d89adfbfe40c48f26
SSDEEP 49152:U+EpqatglxhO0+ES+Epqatglk+ES+ES+ES+ES+ES+ES+ES+ES+ES+EpqatglxhOQ:iUIsUtUIsUmp72
TLSH
T1DB566D05FA8640B2E4670171489B83BB4A71BD214F229ADFE388D37EAE33BD0B535755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 91d2e428a1cf4f76fa816192749d7e1cf848e8883e99d76ec8cdd5e59bc8fa50
MD5 4f2ccec7885653efe5fd477f1e31229e
SHA1 ae13817caf53b4234c956bf9a53b3630466fc300
SHA512 418e407172d2e95edc41fcdc087870c5757b5a35e432aa3d48a7e2fd3562075cc37f8137ab66c376b72ddbf606f72e0cc6c454d4a0dc0a6c226b1d4ffcb64ebf
TLSH
T1CC21D831E4D598A3E93368CF972ADBD20CB8779BEC5C5A95230D41287B85C338D594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 04db330872e5c07c4c8918057dc14ec3535f1178f39125e9baf2ee4bd7f8e8ed
MD5 bfc55ad8b40545575c92576a318984e6
SHA1 6b43bfc43075cf8761da26cd1d6a89b0181b40d5
SHA512 09f2bae8b21f83b9fb02624dc6bfcb7078f46188d932831c4a2ab936e5df135f228880e7d4796e3dc5d1cab7197b57afd78e0014b78bb3f6a9ad2d509c39adbf
TLSH
T12F11EB61D4D5A493E83228CF972BCBC20CF47697AC5C6AA5230941297B88C338E594E3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 073138f0f0b21694daac74e27114a677371dc62380f65dbf0ad5fc153ca6a75e
MD5 4b14984c78b6116cb6f196dbf7062f3b
SHA1 634f3d89dd41c5fdeb2acc462c016741ec87afc2
SHA512 4e45cfe2750763d294891a00eb3b3f970af4f5bd6673b0da5e5edeb61b3d12695624ce3bf2df26a781853e71eff01fbd474dc398334ef18da9ea9b7e1c56836a
TLSH
T18621FC61D4D5A493F83328CF971BDBC20CF47697AC5C5AA5230941287F85C338E594A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2448-87-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/3688-59-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/4240-91-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download

memory/4356-6-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/5124-36-0x0000000000F90000-0x0000000000FB1000-memory.dmp

Download