35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Size 6.1MB
Sample260814-e328zsfb99
SHA256 35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9
MD5 50bac616ec1d97d20e59009930e8e338
SHA1 65861a02aff9996f421b88a221b07d6b09141413
SHA512 c3081b0557ebf5d3b318bb43f7c058cf8591d98568971bde8ebf17c5cb534bec4b6145012e3768bc443b4c2a4cdc1a54b99ec19885b7bd896b2be1f1cbf90cbb
SSDEEP 49152:U+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatglV:YMMMMMMMMW
TLSH
T1FA564A45FA4380B2D82B017148CBD3BB4B70BA158B129AEBF74D876FAE337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
5892	svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe
4592	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACAAABCABCBABCAACABBCBABBBCBBBACABBBABACCCBBBBBCBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe"	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABBAACABABBACCBCAACBAAABCABBBBCCACAABABABBCAABCCBACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe"	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4576	sc.exe
3760	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe
5720	cmd.exe
3544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
4592	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
4592	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
5892	svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe
5892	svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
Token: SeDebugPrivilege	4592	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
Token: SeDebugPrivilege	5892	svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 5600	3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	91
PID 5600 wrote to memory of 4288	5600	cmd.exe	93
PID 1908 wrote to memory of 5988	1908	svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe	94
PID 3392 wrote to memory of 5720	3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	97
PID 5720 wrote to memory of 3760	5720	cmd.exe	99
PID 3392 wrote to memory of 3544	3392	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	100
PID 3544 wrote to memory of 4576	3544	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCABACBCABBCCCCBCCCBACABCBACCACBBBCBBACBBBBACCCBAAAACBAABBBAACCCAAACBAABCBBCBCCABCCAABCABABAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCABACBCABBCCCCBCCCBACABCBACCACBBBCBBACBBBBACCCBAAAACBAABBBAACCCAAACBAABCBBCBCCABCCAABCABABAAACAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe" start= auto displayName= "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe" start= auto displayName= "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBCABBCCACAABCCAACABCCACCCABACBCBAABCAAAAAAABCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBABBBACCBCABABCABCBACCBCAAACBAABCBCABBBACCACBCCBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 79441508d5a0f5b5dbb97eea1a615f60d979e7d6c15fba7b65ce5f674766b787
MD5 f6ee71999f91da1a93e574f468fb66eb
SHA1 2f4ccb9c2122f472d59f37fb901e260ab593cafc
SHA512 7786d494b7d20afaaa8582894d3a1b1f0be6ace719a53633e9e1848885a09b7fbbb198411d82cd3bafd61cc85717357b25a3863110250ad235a3d47fbdd2f7f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 08645dc350772d1cc7f77fe987e4dcc1b56ba23263d1ec27386129630e1831f3
MD5 d42abe6884ebdf0e148ca3a7fac1326d
SHA1 7295716c549aca82fb627ac5e4f172fa498cf968
SHA512 f680d9d3bd6cf7374d62128caa9fc3829f3fa46215fc1288a34080f1d2482ffad62e44f917f1c169d42af1874817aa16ee43abdc81208f6fc5e3a7ca7f5d975a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 1b189369fb1410f5481b5d69a08e8375b787212e2df1618f185b62faed4207fa
MD5 3522cacdc3a3f3a5737aa62802ace1e7
SHA1 f74932595a58604568ae70531f6e937019b31180
SHA512 9943cbc8f0c8099f8013d641c32f9c4863d7c30a956d438a03df4a412ece58b6096fba9dc46f080abc5d7e9ea6d02f1cde9b7bd96277e122885842c0a43cec62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates\qap`g`v~dtlq
Size 10B
SHA256 c4b9a39047bae1e2ecd7af0ffc053727def293605f80260132e3300b97ae9b95
MD5 26975c63e16e6bdf3d6fb8f891fb48a1
SHA1 646334e103314bcf6a8cccc444f5da5bbec9b964
SHA512 b7cfe612fa5a779e949f8865c6134abe24516bb189654e839b2cb7493dc16ec8fb5755ab8c58005c5336d9cdd66e93415d9377911e5a1010b4b6c1bb25f14e57
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.7MB
SHA256 f03e4acb13167e023f1981e51b8b4fa0a5613c0f26a615a31338ddcf70f68fd1
MD5 438ae7def8ebcda89cfbf9d3a9991c9a
SHA1 01986e686a08e3abdf5d0ef1e665f2d388f166c8
SHA512 4f337513d34e52e94ff72e90b970c5f061f2ff2ab5bdd2fbb31bd4a88da127f772a5ebc5b708c31bec2d215717f435274f4b6dfd463811a8c1b7ba5c7e8a7a49
SSDEEP 49152:U+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgly:YMMMMMMMMZgZ2Hb9t+2xj
TLSH
T19C665C45F94380B2D82B01714CCBD3BB4B70BA154B129AEBF78D972EAE337D06636255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 d1df469d67118bb22b4459d3ebf3bca3d48a46d82f01775abd1df0204d80d54b
MD5 90886604412d5da1cc6929a6c0c91a9f
SHA1 c9b9ceb5f909da71bebba1c732744620cd4be221
SHA512 151dc2adfdf7704ff27a9b85660576e6f0716ba67cdb55020c80948ed1fe93f984922e3c4d5f72d1f832115f146e699b4c7d022ae8cd9165f82606cc3e439388
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\kk\qap`g`v~dtlq
Size 10B
SHA256 cfa295c2e0f74933dff0487ae0dbb1fe1cda5caefa76a8ba8693d70087418d05
MD5 b6449ff1a22885543f8270cc213e7223
SHA1 a2b0d1b50023130fe8e6cf98555453befacec16c
SHA512 638d1a36f4159ddd32dcf0b0b64b87cfd89e821ae4cfe8c81ce28d104b2b69df0c384445dad5cfd7dc646dfa7788bf8e0587e9b16b1cbfdb43662c35050a6fdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 9ff5e157b96a086950d4e7d7235a85e0ab32e60cee79061d4dc163b482becdfb
MD5 9c404a8379d968269783b4c68b2eb00e
SHA1 721c633f9b1594128e593dab4803d850fa8168b9
SHA512 a2f7c6d83607c1d84258a372cc08c1cac4d1bc478d13905f8c4fa094b5a6bd13e7fece671013cff8fb61e3ce38749bb0b848ff1e3101739896b5415a8c77aae4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d66120798a886f9d0768df45c9356a010577f2056ae8e35f31f063953b8494ff
MD5 dc2f9ff609b4058f9ef64f4b897ae069
SHA1 c6a8fbec19d173d41eb4067d24b7507869a7088a
SHA512 07101460f9f661fcf9af8bb834084a2f36298bd9338581c5df73dc4e7f56fb3da01b8b411ae3eb3fcbef3c904b60358bf0f146949811a9cebf9b89bb7d6ce81d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b6326fcbd614e07d9bf2c4a5f7354e7b85f3249dd590eee91261cc201130d4e
MD5 a72c462cf93b41cbf2db2ae6318f453d
SHA1 00cb851c2563ef8b1b51f21961b9043c882b13a4
SHA512 9f5696cc03aa8e2165f03ab656e29e4ff127fe9485ee665f68ecb1e3caf34fad43413280122f9936f81d8e65cdbee46f59ebf4e8dc49e6fd0a09a82b6eface1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6329d8cfb1ab4689cd3d66847170431176c56e6126b683d31e98e579acf3dac5
MD5 4f713ea2163a18c343c7294ee5bdd7ba
SHA1 59c941e0c6da0aa3501b50910f9a97d09cd02061
SHA512 5e9318ba3e58eb027d396c9ec5c437c8bfb2e46677fc404e76a915b0ac4af2bfaddf6012a7b09e45ad4913c186676fcc1dc44794abd9cc4cc14e2fd49ca55e93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6012d027038fdac9b8f44ee2c7994800caaec06e05f2625d21b8d3ae7d90d15d
MD5 50c99fd2e2b0471b2d2aa432f3bcbfcd
SHA1 804a8e75dedeea91300f6c3033f31ff91ce0dde3
SHA512 74773f5b4fad324e315ee07a80642a64b7dcc87d099c1b14750a7c5809c31ad3e9aab600772590addd0c3c0d53549e444bd3a40e50bfe0ccd2644684a825de62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec3ccf55df8e205ea31bc7ad98f64ab4cec2188a68a2c3f8891f56da722ba655
MD5 cfa83fdb229b6dc632eb0132b5cd38aa
SHA1 035682077bd8f97f34f3221ca5ba0eee884885ea
SHA512 5d3abec2b9ccf7bdc55e1332d49295b6b8b41f4d80ad09982476ecf5b289b7bb42ae3465afbd99858fe17297ad9f807a6669a50b321e502767c41a87eef85cd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\qap`g`v~dtlq
Size 10B
SHA256 0829b58b0dd9ab5c4e6068fcc5431b60506cff5be3cc509819104ff42862f843
MD5 4f6e5d1c600d94a8e0c8a2471f19ad79
SHA1 4a9cf2f19e9e7d5f14241f9267dcbc4a63c7f154
SHA512 b6b47c1eebb0d5018a8b988d115675ededb3c5a8cf3499b416ee1169ff62bd2fe213c62b9ed91d07bb6cb8ba33856c632ecc982edc43b2a555aeff837769ebb2
MD5 SHA1 SHA512

Submit Download

svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABBAABCBCBBBABABCBBAABBACCBCAABBBCACAAACBCABBBAAABA.exe
Size 6.1MB
SHA256 35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9
MD5 50bac616ec1d97d20e59009930e8e338
SHA1 65861a02aff9996f421b88a221b07d6b09141413
SHA512 c3081b0557ebf5d3b318bb43f7c058cf8591d98568971bde8ebf17c5cb534bec4b6145012e3768bc443b4c2a4cdc1a54b99ec19885b7bd896b2be1f1cbf90cbb
SSDEEP 49152:U+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatglV:YMMMMMMMMW
TLSH
T1FA564A45FA4380B2D82B017148CBD3BB4B70BA158B129AEBF74D876FAE337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 eee422a9d2783ea8c2bc6efce6f0ba33cc3a1791d1ccb8ec806bedf9e7bf54bc
MD5 a3f3ede8086a05b7a5df6df9b542d872
SHA1 e4a910d8e73799d1d4019746086f7f2517f69c15
SHA512 4e3d6046bf3eb728cf2e1c0118383fc98daeea0af2d2f877f768ca31b8f3297de40b1bc6dfd05ad15499454782f7b147e19f3304344e367fd38884fd919708a2
TLSH
T19621DE40ACE5C477E93268CB671ACFC30CB4B78BA95CAE5423494128FAE9D348D594E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b232aa0885bfcc48e072f8b9b9291c785c94fc5c4e9d30ef046c71cc659949b7
MD5 8a7b0efeb8148aede9b80cbb06c9206a
SHA1 09ae83687dd62db42ef1e449ee8ba39d9d81f7a4
SHA512 9ee8ff5c9f3c94f3594c88685ab0335165b294aee6464b78bcfc3dfa9cda101ae140a1be2737a827b7165c1e9e07833fff15c1d8f7dec66ea5e677a69ebb6285
TLSH
T1FB11E740A8E5D477E93268CB561ACFC30CB4B78BA958AE1423454228EAE9D348D594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1908-33-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/1908-23-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/3392-6-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4592-875-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/5892-69-0x0000000000200000-0x0000000000221000-memory.dmp

Download