60e47f566bd4729e05506ede99090b90dafeac8ef07c5d3c329251878e345244

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
Size 7.4MB
Sample260814-j2w3ssfp21
SHA256 60e47f566bd4729e05506ede99090b90dafeac8ef07c5d3c329251878e345244
MD5 3b95eb595026765e19d52c5e16c24eb8
SHA1 bc1abd4d5539949ce741e10a5f0a8c504f3b18f6
SHA512 8347e42a22776e1648d63e8274e52543350572bd5f358939623982cfbea3650e86cc21261a3f9ad1c3339cd64210e01ba3bb9f53c906398fd2b85c0505244678
SSDEEP 49152:U+ES+ES+ES+Et+EWqatglj+ES+ES+E7+ES+ES+ES+E7+ES+ES+ES+E+y7+ES+ESN:Osvsip7L
TLSH
T1FE763A05F98740B1E82B01B04DDBD2BF8A70BA258B128EEBF74D875F6933BD06935255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
456	svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe
2752	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCABBCCBBCBBCCBBCBBBABCBBBABCBABBBBBBAACABCACACCCCACBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe"	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBACCABCCBACCCACCCBBBACCBCBCBABAACBAAABABBBBACCBCACAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe"	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3580	sc.exe
3344	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
116	cmd.exe
1312	cmd.exe
3884	cmd.exe
3044	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3620	schtasks.exe
3948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
2752	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
2752	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
456	svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe
456	svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
Token: SeDebugPrivilege	2752	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
Token: SeDebugPrivilege	456	svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2668	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 3884	3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe	107
PID 3884 wrote to memory of 3620	3884	cmd.exe	109
PID 3792 wrote to memory of 4284	3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe	110
PID 4284 wrote to memory of 2616	4284	notepad.exe	112
PID 3744 wrote to memory of 3044	3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe	116
PID 3044 wrote to memory of 3580	3044	cmd.exe	118
PID 3744 wrote to memory of 116	3744	2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe	119
PID 116 wrote to memory of 3344	116	cmd.exe	121
PID 3792 wrote to memory of 1312	3792	svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe	124
PID 1312 wrote to memory of 3948	1312	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_3b95eb595026765e19d52c5e16c24eb8_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCBBCBCCCABBACBCCBBACACCCCCBCBCABAABACABCACBCABACCBBCACACCCBCBCCACABCCBBCCBBAABCBCACACAACACABBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCBBCBCCCABBACBCCBBACACCCCCBCBCABAABACABCACBCABACCBBCACACCCBCBCCACABCCBBCCBBAABCBCACACAACACABBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe" start= auto displayName= "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe" start= auto displayName= "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBAACCCCBCCCACAACACBCBCABACCACBCBAABBBCCBCABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCBBBAACBBAABBBAABCBCBABCCAABABABAACACACBBAABBCCBBBCCBBBACBCAACCCBBCBAAAABBAACBCACCACBAAAACCBCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCCBBBAACBBAABBBAABCBCBABCCAABABABAACACACBBAABBCCBBBCCBBBACBCAACCCBBCBAAAABBAACBCACCACBAAAACCBCABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABAABCBCBCCBAAACACCCACBCBBACCBABBCBCBBBBBCAACBACBACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 12e4164865f835fdaea4a2d923dd58bd0e204a80fe1e3d9de95c3417dbc2f52c
MD5 1594eb6d97eb3383987fa44a3c3b7630
SHA1 59f2d123135bae68dc4a22a198cd9cc9fc4d4cad
SHA512 5b66299874e72ac642c2ac1de518a902c0fce72a72ebfc22af30540eb7e9b72bb35a242cd98a3d366904a2d91f6a29ca435faf7d851a3383cc798c53325b55d4
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 7.9MB
SHA256 8246032e88ac9b96e4fe52a00a296eb90822f485bb6ebf93ecf30c51a0720dc6
MD5 2580a6ec308d3b16b8a11356b3db1c07
SHA1 fbec18aa192f7cc2b5e930620692fcc16eefe717
SHA512 42c6d44a30ea3f7a11a951521fc68dabafdccfbe74c4148aaaec3ed5fc382eda1441ef644ba80e17255e668c714ad2f41af929d5e6c0e54ae2aa21a509c0bc23
SSDEEP 49152:U+ES+ES+ES+Et+EWqatglj+ES+ES+E7+ES+ES+ES+E7+ES+ES+ES+E+y7+ES+ES0:Osvsip7Apig
TLSH
T1B9863B05F98740B1E87B01B04DDBD2BF8A30BA218B128DEBF74D875E6933BD0A935655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 55bb9c05be8e9d1c63f08a2f10374758e1041f799730131ec33156e393a989f9
MD5 250c416b2086cd7d12498197b38a8739
SHA1 40dcf4ab6cf71b6659559205f86c9c3a499912b4
SHA512 d1ebe032401619538e39f9293198492ec920bcb81b79f0ca3f28112cc05e52699685048f5506538a2d7984a0a8b1ddaf0dbb61c08c6c572bbfafc3a9fa609386
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\IdentityCRL\INT\qap`g`v~dtlq
Size 10B
SHA256 0c649a16cc592a0337c510b5e966fb2b6800bc8b22064aea32744e0bbda665c3
MD5 550171275abf0fd205db6c5e26f25187
SHA1 e6e0bed8881fb31705f81f0516d75882fa256b9b
SHA512 189f17881aa38539c191b2317e3f646ac72ee8842e5b29859a415dcc0590a9bb8ca1dc7d774ff0f84a6f90959987b772585c279486fc061c25331b2ac74bd8b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\qap`g`v~dtlq
Size 10B
SHA256 ac53b5839f59704867a7b4eb679719eff174f0866cab997e892c0e23981de024
MD5 04f657e15a7f5e38bb24eee6cf074926
SHA1 3fe4ffc3dc3f81cd422d7910816a1ef6cc8e8cef
SHA512 22f1f96c931da6a95991be01ba6701346118fe859f533ad190470c89ac2359fd24922b4e6cf2341167a66fce0f2066423d23f63da106b21fcfe652f7b5ba1ff7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PPBCompatUaCache\Low\qap`g`v~dtlq
Size 10B
SHA256 048076baf075280b104d185d2be3b3e82fdf24b699803aedc2d2cf04e524bb1f
MD5 2a43f4c9c1c27a7101b8ec5b3968a4e7
SHA1 b55cb5ffbc206a1bf2799e7894a335fc492b89c8
SHA512 5162c11906d8b5336bf2c2512451d14002ca1e25d7dde996ff1a32ce08464ecb3b90309a258bf78648548588f077dc2979a04e7d3db1cdb0284689c50955e6a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 b0f4d356f5da0044bb952e06c3599e4ef5ba0dca5b73a981fdf854a21a0de2a8
MD5 03eeaa9ccb9107fd070b2297d685fba8
SHA1 8bd7124e755c2bac1e0c15b7f4953639431ff912
SHA512 858b05f8cf5f2a32d59f58c425f5beac8574da46747763c702dd5c691b5f361477371b13d0cc78e52174b44f65eaa4c4db2850541a4a56548cabb3eed8fd300a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 791c954551de451623e0b061d3615de85afe39ecfdc62962c866d07d7d365c2f
MD5 ff700eaea5f36da417c5213bd9e69d6c
SHA1 5c16d71e429a460f28ee18601eb3904a78883a43
SHA512 15f8261a0c17fe36cf591f27463d4f086d7cbcec99e1709848aeee5b1f2935dc3dc6cff9aca04bd404253b28b1e1e6bba7a986f383374ece993f1c2de833b428
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e683b596d7fdf5cede9e76017842971dbbf967e4e21b48e622d78b960663054d
MD5 6f996f6d0aaa53f7ceb3f2f0473e67e6
SHA1 2e5fce44e8bf9f26230342d890388cd3c70004fa
SHA512 7286376f4000d1ef1eaedb20f1904411a29fd2d3286f98b6641614c1e159478cea5a0e224186ad0c6bddc2dc4964d8507c5d2ac50f75c0698886f277fede0474
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f60fc2dc65fcd03a885733454f76c797dc3053265af23293a49e5b094f082406
MD5 0d1ea1e47e81c868b9f90be78ac33864
SHA1 95799618b15ffa00a959c9e6bd6b26aaedddd52d
SHA512 e19188c7aae575151cedb26f8b0fb6ce4d7b9cd58a4fa166e4cc7b6abd67395deee54d1486679598cf3a01d5c0050c6591d119ab94b3bfcebfa08c74bc2daf69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a594c745c3901ba8c940eee8adc3224e1fee7786f44379f7d1a2f38e1ef970ee
MD5 aa37eb6b62b859193921634c81fccd9e
SHA1 e418dfe7db9924070bb8153bbadd9e88a2d31c4a
SHA512 0560aad430941941668385cec3af8477424ffff5621a18a7a270bab1ea0aec0c4074650334bc36716be8a265a58c6066ce1f932654403b977d426484e5828206
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0086d0d9a9e3bdfa26bf01790408cad9a08c2079ba9a5e829acbea5482f5422e
MD5 618e832fad6dac6d815f4f7e8ae1a36b
SHA1 63e156254ba12965d575f77bf6a5910b549b2067
SHA512 ed9be668211234741b8fdba01670600d25fa0e899951ba37d4d812ed72b79a2faba7956be656e718f98b90828cfca7bcb180fae4e9f6685426d9f9f904d9f5dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 012ba27da6a46ca3752f6b3b570786d607cd8469f7235e75ac4b4e03b7bcdda9
MD5 84a6e3ebb4faccd0ce71378cb88dcda4
SHA1 a3e3d653802feb20d1fce7169ef9625cc6a64445
SHA512 0ddba0e402aa94331af0c41269853c4b90da34c8fa4ddbc55405747ae6073bbf4a88682e79b29d54097c4c31a105c636f2cd39a08f44cf49c2fe1169db9e1ee7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4d6aea911f34971327529e6dee5d10d7cb0882c84a32fd365cc833a492f33b09
MD5 c62272ef5617dc2908f677a6b56ef7ae
SHA1 bf4b88fcff8ce2fb691ab57c55a5daae4ecf9979
SHA512 a7543f8deb601fb552e2246b163f9f952b4a7d7c4a256724d16b7786bee775590f358ed4f17862808802921b7b0f3121eb8f750de1bf3981205f2af53cff765e
MD5 SHA1 SHA512

Submit Download

svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABAACAACAAACBCAABABCABCBBBCCACBABBBCBAAAACCABBBCBAB.exe
Size 7.4MB
SHA256 60e47f566bd4729e05506ede99090b90dafeac8ef07c5d3c329251878e345244
MD5 3b95eb595026765e19d52c5e16c24eb8
SHA1 bc1abd4d5539949ce741e10a5f0a8c504f3b18f6
SHA512 8347e42a22776e1648d63e8274e52543350572bd5f358939623982cfbea3650e86cc21261a3f9ad1c3339cd64210e01ba3bb9f53c906398fd2b85c0505244678
SSDEEP 49152:U+ES+ES+ES+Et+EWqatglj+ES+ES+E7+ES+ES+ES+E7+ES+ES+ES+E+y7+ES+ESN:Osvsip7L
TLSH
T1FE763A05F98740B1E82B01B04DDBD2BF8A70BA258B128EEBF74D875F6933BD06935255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a175fa699b9888fe112db7bd89ada05f64bd769e3d3e2aac7ccce4feebdca1b9
MD5 46499bd8a0ceb8116fd76030b5fba992
SHA1 1bafa2488844261798b10d2b3ce2ef6039a7b6e0
SHA512 127d14fff94de50cae083b5cc4052c25f10e34a6fdfb0d96a0aa862b36f33820b1777a31d771822df4225e142a254b4604968add9ad77fc89b20650f8e1a0426
TLSH
T15821F964E5E5C883FD3268CB9229DBD308F9768F586C5A14330E82287F59C324F194EE
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f830af0c217afcc265bfe47b8aeafcf95b45c46ef24ecc0bb2d0cfde70e535fb
MD5 325f109f5d53d39974a5ca13375d051a
SHA1 ed88cc959125938aaf47ba3516be8f2214b6b888
SHA512 4e7e62e65dfb15490d676363283b82a067ae67376983cb248f48760774308962306d4653aecd65b1a3482d31bbf3464024403f06939df9ead2cfcb623862613c
TLSH
T15321AB64E5D5CC93E93268CB9229DBD308F8768F586C5954230E82187B99C324E194EE
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 2f49a50f626e46d919160536c84b02654bd398c9916f1afaa1cfa9264b69ab03
MD5 76c90751c8a3b96bbf1991f1c50175bb
SHA1 bb0019c7b1b39eac6114c8f2c09ea26948895a55
SHA512 276f38f598c6b1b0fe980f3377966119455c48ca6253198ad8421007ad61f173e535c4df17511321ad5b40dfca120bc4cbe9f3a8cfef0a75a5c9af8101550ec2
TLSH
T1FF11EB74E5E5D883F93268CB9229DBD30CF9768F586C5A14330A82287B59C324F194EE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-71-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/456-2911-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2752-1282-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/2752-2913-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/3744-6-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3792-35-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/4284-59-0x0000000002040000-0x0000000002041000-memory.dmp

Download