194d52a19b52e12997d3849d732add8ad5bdacc498c8953f6f694cd94c4eadbd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
Size 22.9MB
Sample260814-elf97afa86
SHA256 194d52a19b52e12997d3849d732add8ad5bdacc498c8953f6f694cd94c4eadbd
MD5 7d16ba2be4df9c8a2ec9042f2a86ea00
SHA1 76f2dc68afc7431039076d5e8f0b0eef9529b6fc
SHA512 1af36e7242e3b5db1cf7fc4ac66413d218010635ca9b398855da78f2287292081231dfa4c141369e3d087b73c5feeebfb583d013311a2569cbbd2e72d4e7e256
SSDEEP 49152:U+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+Ed:BClClClClClClClCb
TLSH
T12B372A09F94340B2D92B11B14CCBD3BF8A60BA2587128EE7FB4DC75FA933BA16439155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
4388	svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
4816	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCABBABBCACCCAABCCBAACCACCBBCACBCBCBCBAAAAABCCBBBCBBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe"	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBACAAAACAACCAAAAAACCACCBCCAABCCCBACABBBBCCCACCACCABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe"	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4964	sc.exe
3476	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4564	cmd.exe
1452	cmd.exe
5104	cmd.exe
3668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
4388	svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
4388	svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
4816	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
4816	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
Token: SeDebugPrivilege	4388	svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
Token: SeDebugPrivilege	4816	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4564	3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe	95
PID 4564 wrote to memory of 1980	4564	cmd.exe	97
PID 5016 wrote to memory of 3272	5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe	99
PID 3272 wrote to memory of 4288	3272	notepad.exe	100
PID 3840 wrote to memory of 1452	3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe	104
PID 1452 wrote to memory of 4964	1452	cmd.exe	106
PID 3840 wrote to memory of 5104	3840	2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe	107
PID 5104 wrote to memory of 3476	5104	cmd.exe	109
PID 5016 wrote to memory of 3668	5016	svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe	113
PID 3668 wrote to memory of 1800	3668	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_7d16ba2be4df9c8a2ec9042f2a86ea00_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACABBCCABBCCCCBAABAAABCAAACCBACABAABCBCABBCAAABBACBBCAACACCABAACABBABBBBABABBBBACAAACCBBABBAACCCCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACABBCCABBCCCCBAABAAABCAAACCBACABAABCBCABBCAAABBACBBCAACACCABAACABBABBBBABABBBBACAAACCBBABBAACCCCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe" start= auto displayName= "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe" start= auto displayName= "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCAACBCBCAAACAABCBBCAAAABCCCCBBCBCCABCCCACBABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCCACCBAABBCAABCCABAAAAABBBABABACACABBBACCBACACABAABCBBBAABCACAABBCABCAACCABACBCCBCBAACABBCBBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCCACCBAABBCAABCCABAAAAABBBABABACACABBBACCBACACABAABCBBBAABCACAABBCABCAACCABACBCCBCBAACABBCBBBBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACACBAAACBBBACBBCBBBAABABABCCBACABCCABACCAABABAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 919353cdfb23f6d252df8107acd299337687bf6daa72a16e99dc71a881795a4a
MD5 c48d4e56b206144bbe1ddf21c829df48
SHA1 79b315d06627fff2b754be797b443da38469ab08
SHA512 0680cdda8e0999e06176a8c15e0ddc70daef3e67ec0d2cf659eda0b7a9ed6c8dfe5b3e47d9fbbd4086506b4b8e854f7de8f407d6355566a7d78ad3653762c81d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 23.4MB
SHA256 532eb9a025f86574828799758423357c7cc77caf064b19120c5a0178f843a761
MD5 d226ec1def4ee69f99f5c5c403595a1f
SHA1 6181be8c7f5bb7e718348d3250742651457b7c97
SHA512 caf3585fd8c121d64b9abcbd24bae4a85223a3efa0bf09b85dcad39cea152c899d54a8626991c5a4eb51ccf05877e5326987bbbae635f1d11f6c11a19d39359f
SSDEEP 49152:U+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+Et:BClClClClClClClCQpi5
TLSH
T1F8373A09F94340B2D92B11B14CCBD3BF8A60BA2587128EEBF74DC75F6933BA16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\qap`g`v~dtlq
Size 10B
SHA256 38514fc24162acfd7b100bdba8a52069243950112ee73865c9044003d5305698
MD5 f7277188315181906428e10d7a8e1a3f
SHA1 0fec07bb4f941b19e1505ee5d828caab0a50e3af
SHA512 449d27500ae81ef9a52799609ac6d7e0bedb84e0e13b0c8df37cdaea2ac9c3463a2acadca14842567d45ca547b419fcd6f46634b608acfb2aeb9ad44bf459481
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 754c2c203982c5a83abd6c20814845d9a0646fa3adc355d3585ad7fa446af9b6
MD5 71756e57044005d2ac84cc39ab83a839
SHA1 ecb2cae4a6531488da5a9fea2ec1006305591fa9
SHA512 4fbfbda3da32f73a5c13902e78b3eae3d9d40b5be03f07cbe239294f6e98a6305263daa369e8e20abe7417f62ba1fd7d7b0db3a049e70522b5c7ca5847316987
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 4b9d5d509a6b24cfe71ded9422bb6bb59a3d536f5e92c5270f280337e3904b3a
MD5 5b907fdc314f7f1f8be0cef1786b932e
SHA1 86a9e40e548ddf61d9955e262c0a512cf43a538e
SHA512 9686bb71686bbfb034cd72e6c32b6184bbc1c126d58f0cc6ae44de758e70e9e8ac3b5d4b129bfaa3bf83be2f61de07303e7e0a46682c324a3113153b6a455e9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 a513e7f60d0aeb3d463c86208de7013fc3edf69760719210beeaaefb86b46511
MD5 1ccf379ab7462d4491aad3b9c3b16f8b
SHA1 aec7c0f7a011aa0536dcc31c59bef30271f02f69
SHA512 733e878403e3515f804d6b4dcde7b63cabd17fab2210824f2caeb7696e6aa6e9c0f426e00f4d9c7d05038f681bef737c3e252c0126d82b1d883f7fa65a7a8780
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 b8fc831fa76e66ac2bb34a4668456cbf6ee693748267ce934bbb663b0c3b52e1
MD5 457ba24fc1cd68c660a3f72d5ed93719
SHA1 244b45f2b15f32b267e0c5a981042a0a9730a968
SHA512 73316a2c1b2ef062f91af3f500e71c4f4707c6d01195e91ac703bc89ba944b33bfb00f37275120a431c828ce472b430b860264a67595b600a7e3b364ae3ca378
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\ka-GE\qap`g`v~dtlq
Size 10B
SHA256 c776253435da467e894aa292277f558872540471f8c947634961d1b01c78fb1e
MD5 ed4f558aade50f2eda1c28e9cd92ff21
SHA1 7bd6da2b3a567b62c477995cda1508dae6be52f0
SHA512 67796942cc7e625251f6a5a8846124dadd8e78314018db055c7a3eebc2eb7a4ebe97eee0cdcb5b22b467e2274a75e11c90ba7455281c7403e2ace3476f986dd2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\MEYCDOCX\qap`g`v~dtlq
Size 10B
SHA256 afffaf012babcf0592d26ccba52513a5e1a5648cd35c6c1431cc2f37c11c0846
MD5 0875d7d53bd0a082bf827f4a6dfba9aa
SHA1 e95d71ea4ed3b4d3b090107faf77c6ecd7b10c11
SHA512 53c942e94e0d72b29b3cbd7b52a0ba575a66bd9a6ccd9db20b89bcf79a0f8843893904f1044260af65275f3089bbc64b3f3921287951918151230d31eae78200
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 1438cf7eac998e8e50ebad7a2e2b16f42e533a84455ef399b3d5bd7be246b150
MD5 705cd981c0ca1b8c813e83039586ac0f
SHA1 0fc1854db7dedb6d02eaef89c8040890abf11c55
SHA512 9ce979125aa8eb6fb103fe65035cb78358268fe56dfb4d420d20960ff269d2526140de8a96b22478e9b9c58635c9a339acab40ca7ef5f7482cf1911203ce5e35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0122b4e1a689d8eee40b0a442078bde6d2768a0e0db64129f4bb86cb44bd74bb
MD5 2f87e8ba34e397e70a93e597a258fd06
SHA1 1c88f3630acd290efbaceae12310f2583b083654
SHA512 94ea73dd60bf70b2773e48f250877c27bb89569781563fc0df41eb0fb64b140b55d7f602dd5656120470b1660f8227a2b00ecfbf3ba4d51f8ecd852d09d4e68c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b53b4148e127daf264debe36a7b8930376ab727a2cd8540d15c99e309c0bbed2
MD5 f4979c82bcf1872cab0266671b2e0834
SHA1 5767c3c42a24d2267309a196c2133423a1fafcd6
SHA512 aadde54f6ee2a17dd78b58d18fb56596c0d4b795ce5a8b9f7e903590990f3e454468877353b56258cc86b00e5296f656a566c099e3f782f407703f660eda9d19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d71dfc9299f4821e16edf949b606ff88b962d4123f7dccf9292f52577aa7d76
MD5 2d1cca01e366e7a88a001a4326dd05a8
SHA1 1989c842285848cda68f46e107e298e72022c415
SHA512 9d4dce680870bb4dd87da52cd7791e5e606988cd2e5ff451425bca6d4cf806e0ff37d5fc187f2e343b1392273ca78dbe8e92872eddb1f572af4568df87dbdd1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8d57991ae1af3ee227f8fa066ebfae910102b37c2513b04ec7274e02dcd70e0c
MD5 0ac3de74321631189576e04ef6af43aa
SHA1 60246a04ad9f2683a74d839a98c384fc429e1878
SHA512 87b539a99fd1ab41a507bd334373d6322c072db7d2021106813e77ecf1eee9d4a31bacb8141a7d40f281c2d2b6fe1c0a00f4152c620cdd40f5580e09b8b8192a
MD5 SHA1 SHA512

Submit Download

svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBCCBBBBAAAACCBCBAABBCCAABBACBBCCABBBABBCAAAACCCCAB.exe
Size 22.9MB
SHA256 194d52a19b52e12997d3849d732add8ad5bdacc498c8953f6f694cd94c4eadbd
MD5 7d16ba2be4df9c8a2ec9042f2a86ea00
SHA1 76f2dc68afc7431039076d5e8f0b0eef9529b6fc
SHA512 1af36e7242e3b5db1cf7fc4ac66413d218010635ca9b398855da78f2287292081231dfa4c141369e3d087b73c5feeebfb583d013311a2569cbbd2e72d4e7e256
SSDEEP 49152:U+E2+ES+ES+ES+ES+ES+ES+ETqatglu+ES+ES+ES+ES+ES+E2+ES+ES+ES+ES+Ed:BClClClClClClClCb
TLSH
T12B372A09F94340B2D92B11B14CCBD3BF8A60BA2587128EE7FB4DC75FA933BA16439155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 895a48bc9a1170260b0c903b040e73df562fa481102078725696d163745b60dd
MD5 765a5c901f1fd410e8c452dc3f03c23f
SHA1 7c025c4d08c8a94cf07c1a75397d6c3054ce53a8
SHA512 5e943213bdbe99208cf01cba8c00eeabb40ee37b11d4e26ae31827e22d3f4e27c85bd2d8bf80b914eab35885e80776b2b86a0db67e7ba2d39d829fff9f43904d
TLSH
T16621A57199E4CC63A923A8CB9229ABC30CB47AAF585C5A4013458228EFD9D32CD594A5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 87eb98650bc734ef8a2b32b541162d607825945295088d8e231f7ec968151dcc
MD5 ec9ce8edfd4cbdfad28a63b2b6fd1f37
SHA1 5d2456f01b0ee244234514eecb54d34a516a987b
SHA512 355f036250355c453543df872bdd37c80c2d0042f71f50eeb504a03b2cf126ebf76fef5792c096dc1b55e419ae5956abb48770f4e1d3b7c6c80b8d32140c7e03
TLSH
T103110B3199E5DC63B933A8CBD329BB830CB47A5F685C5B4013458228EFD9D32CD554B6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0a0223697da482c3099ccb1c082e41aedbabc70db288111951f04216aa416034
MD5 c347cbf23a745be050ca02af6a7f09de
SHA1 8c3de308b41235bfa17b24e55513fd8b5b6b3645
SHA512 baa241807b5417efe31e8b0d3f37845f9bcc945345f38cbccad4d4456cffdf50fe68d09835d6a52adbf0711d41192fe5121e02a48c676ce858c3be0adc363f00
TLSH
T1BF21DD7199E5CC53B933A8CBD32DABC30CB47A5F585C5B4013458128EED9D32CD594B6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3272-59-0x0000000005860000-0x0000000005861000-memory.dmp

Download

memory/3840-6-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/4388-86-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/4816-1222-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5016-36-0x0000000000900000-0x0000000000921000-memory.dmp

Download