d6612fc4cf460797b23fcf7001dff611eb8b63eb338485cc526fe8301b5f36dd

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
Size 3.3MB
Sample260815-efnr3sem3v
SHA256 d6612fc4cf460797b23fcf7001dff611eb8b63eb338485cc526fe8301b5f36dd
MD5 5a66809b6882c2a1b5e8494f8d85ae05
SHA1 092566b170de448a35dd3e738dedf2f76ed783c2
SHA512 2eafc6d266b785f7acdf08f7e61533e28ae8d148da3478e14deddb0d8fc3b6aadf1e695a96d40e6cbdf708a323d52cd64d53d7b8096e41b5dbe3ee9c5a87c73a
SSDEEP 49152:U+E9oqatgl8+E9oqatglLW1PszNsQy+E9oqatgl8+E9oqatglLW1PszNsQzDd79P:1YAW1PszHYAW1Psz/p7d
TLSH
T1EFF57C42FBC58072F5731631487B92B61A76B9110F31D69F6388662E5F33BC0AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
1432	svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
3664	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABCBBCBABBBACAABBCBACCBCAABABCBBABCBCBBBCCBCABBCBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe"	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABAACCAAABBABBCABCCABCBABBACBABBCACCACACCCCCBCACCCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe"	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3024	sc.exe
2296	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
4220	cmd.exe
3856	cmd.exe
2376	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3968	schtasks.exe
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
1432	svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
1432	svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
3664	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
3664	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
Token: SeDebugPrivilege	1432	svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
Token: SeDebugPrivilege	3664	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4264	1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe	92
PID 4264 wrote to memory of 3968	4264	cmd.exe	94
PID 5936 wrote to memory of 5792	5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe	95
PID 1504 wrote to memory of 4220	1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe	98
PID 4220 wrote to memory of 3024	4220	cmd.exe	100
PID 1504 wrote to memory of 3856	1504	2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe	101
PID 3856 wrote to memory of 2296	3856	cmd.exe	103
PID 5936 wrote to memory of 2376	5936	svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe	106
PID 2376 wrote to memory of 2628	2376	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_5a66809b6882c2a1b5e8494f8d85ae05_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAABCBCCBBBABABCBABCBACBCABBAAACBACBACCCCBCCBAACCCCABBBBCBBCBBCCCAACCAABBBABAACBACCAAABACBACCCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAABCBCCBBBABABCBABCBACBCABBAAACBACBACCCCBCCBAACCCCABBBBCBBCBBCCCAACCAABBBABAACBACCAAABACBACCCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe" start= auto displayName= "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe" start= auto displayName= "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBABCAACACBACCBAACACCBABCBAACCCCCCCBACBAABACACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCCBAAABBCBBAACBAACABABABCAABBCACCCCACBBBBACBCCBCCCBBBBBBCBAABCCBACABCACAABCCCCBABBAABABABBBACAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACCCBAAABBCBBAACBAACABABABCAABBCACCCCACBBBBACBCCBCCCBBBBBBCBAABCCBACABCACAABCCCCBABBAABABABBBACAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCACBBBACBCBCACCCACAABABAABABBCCBBCBBCAAACACCCBACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9a13409bcd18e7ccbe84d9e48093b29d2a42d1323acc7a668fbb4e69ba988e7c
MD5 e60a4c4ad15e4a5f5552dfd45562c475
SHA1 28ca8e27d2160bb9251bf01674e71449269b1a79
SHA512 3ecb0ac2598e79748565abcb5e23956bd735056bd4db063313293d56d6530357049f31a9aad3070edfb579ea8867c0078d5f191a3e95cda35de61049dad2608c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\IdentityCRL\INT\qap`g`v~dtlq
Size 10B
SHA256 73600ab0e63424ca979a747d5d81a79d16058ed2cc52840fb35103995342a072
MD5 d65245533f3c4ffdd19da32ff6aec385
SHA1 194956b595517ba98f94cf6dc9e202c5da378862
SHA512 72e6f5bebc3054da3244445d1a427d36f1b3bd9876d3961af68294c3e11dbc0f9232163dff89bdb0a60e3f182355584d0bbaad2bece10096a871697234569d9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 641f431c0eb27e57dcbc7275a36b05b03c11d9a147262f10cad609d54d68a511
MD5 9c324eb56164c1381d5594971f85c29e
SHA1 ee0fd83726ae3ee3394e4a0d317115db67da45c8
SHA512 d353b557d8efe7ac25f0745af903d01eb5b82649065a1301bd8c760ea66cd7e830ef2627748163af80ffc9959d9577b7c6cf7c1dd3bca9fc78b2c87424c2137c
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.9MB
SHA256 438225db23af55719844f86db79f77501bd0d8127f757dde36ab88dbba96050a
MD5 3b748e285b8d96552395c349dbffbee1
SHA1 88a1b9f2cea2acb4c530f5654daa0c44c7fc95c0
SHA512 0cd66903e2687816c1c60ac75606c0f78f1a50b49cf2f6ff0b150be9f8a7c474f3e74faf85f55bda8c2c79e89d93cfe844911b893d8e35a130a87b5bfeed9987
SSDEEP 49152:U+E9oqatgl8+E9oqatglLW1PszNsQy+E9oqatgl8+E9oqatglLW1PszNsQzDd79c:1YAW1PszHYAW1Psz/p7MgZ2Hb9t+2xl
TLSH
T1A9167C42BBC54072F5B31631487B92B61E76B9110F35C69F6388662E5F33BC0AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\qap`g`v~dtlq
Size 10B
SHA256 cda4c6b2658811159da682e1e03c813548dcb8147bce9f82570242168989903a
MD5 5b5ff7b3e114f0d4ab47e36bf966b471
SHA1 ed3e5c47bb9d32a112d5e15b18a3eb46779dc51a
SHA512 5fb1e6773ea7ac70d2b6659e431ffd33f6e16bdfffb1d904537f63758b4ffa87870e885a758b15906aa8c13b9be797711a5b55d486488d72bbb0e72fe6004df6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 d57aab823b1ddbc4b0e8763c55204736a72ca404edc3dd22627d4357e7a23809
MD5 005bb725aca3050e42493e768816f5ef
SHA1 0561cbdc6c84d7a261e3eb5bbdca9e18d7dd5ca2
SHA512 efeeb77c73345af6b9cdfab8da4da40377a67b264b1cfe28d5e0cfe4db4a5198e47b57d2d793b804fb95c8a68ee00d4b79644ad71e071090ff3ac1c3c12cacca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\qap`g`v~dtlq
Size 10B
SHA256 701e40a2a228671c42be5646d5c38e0bf940a9dbd99e697411026aa2e64e9af8
MD5 6fb2d9952a117eb5713e0130740b3d6a
SHA1 a008ae8a08b29b510aa2db3fe060c9628df75534
SHA512 69902baebd5febb9b4c8ab41e24cbaa342943a291f64db850be8959cccd7a00858a402f013692f5d9112abaa3e257c1e5c4a4cf1907e8aef5ea27777d77e9be8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2e6a2e45d32f2bd67d273cc0faa3f04fa8a919df4ed29b6fc8222c75ab06356
MD5 68d951286677327a3c9b3129adf38841
SHA1 cc4904435921401206b4d905b6f2f38f634197de
SHA512 eb862a8cb825c702a75f64df3b4fc4ac8878d5c2dc7bed3272e3e0c7a08c6c795661749b4dcd2ed9f9bfab5714484f1354fc88b81d18906bd01d1f61951b62f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22d3f674ebdf2c2b0057c7f86e359bae4a33fe14ab2f1183255b7c79a94356f2
MD5 64058c701917ac14381ec2cf856c0dcf
SHA1 5da4ab324ce353e4f5e55d6260748be9682bb82e
SHA512 36a74068db7b8ae832b0595120fcb827908ad8494240e6d85b3c6e908b60420fdaafd99651f2de26bc617b024fe0e7792fc52d1dd5e357946f74f7630d0f5752
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22719cc4e86b29928a7ed25467184b9fb2945abc5e20436e273a0a7a258ed434
MD5 8c19a1c5b10dbf042ea1859aed12abbc
SHA1 f36c98ba05f033ff790e381682ebba8f3723605f
SHA512 db3b3f2287a0a59af0b39692327a3bb08e39ed90be6d5a6582ad0d62a2fd0c12f7da9859f2e54c90c7fd54da7ce9f647260e1f7458a80d1787fc07a1400ea87e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e47af60c38ca91a30a838c3b510647247c455721511f790dcec539bbee3a12d7
MD5 ae6b804e5dff91af2008bff088fcb76a
SHA1 1a2fbfd033f57a9fbfb36f092eeee9a88dadc4c3
SHA512 ea465e13ee32a1aee5d78800c50b3f9840481c7d87c5c48deef71bcf54730e8078ff8adfe41609b7e9de9f22c7501865165851159ed615ee015ad95009a03bc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c9ffec877de33866bbf6e8c59d0f593ddfea26187b9ac1b05779c18afd3f125
MD5 292ea97477cfe144933e15ea01f7c354
SHA1 24190d67ed6535f528067d0b9629e318b875dae0
SHA512 26c2a0877bd7eead69309fca04239be79c92c9b071fe5a4d295aad5552353083a1af4cad5384469c7e4b5346fcc68cd3c88f36cef57e1425421db1f9dee6820e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fbe528ae14355d7d954833f0a8189283affc8704ad2d1fb9226ab618e61d4eb2
MD5 f95e54601555e2f185e2d409721ca470
SHA1 1c53026208e8f5557952bacf9f458b40c2a6c0f9
SHA512 3715e0e518144ee71c9b3eb2534128a65d2b57adb1287ca0d3c0dbf6b1e74e1acf499240463cfd1cc507f4fcb609be3ec8f3a37a63062e4672e85a31687fd605
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\qap`g`v~dtlq
Size 10B
SHA256 33fd0a4708be7ef00e220bdba7451fd28e430074fc8e9315c6ae77bd69c27657
MD5 85462c1df62d29a7afa3a45da66eb340
SHA1 40038c6b3703094534f5739a09bcdff827454754
SHA512 de7d81df8c686b413bc4f84512b85c36c9fa35d92eb228f3b8ff9d548acfb47423c9797af074bdde16ec07ca061ebd628f2602214a46591e2083dcf7eb7296ae
MD5 SHA1 SHA512

Submit Download

svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBCBCACCCBABCABBCABCBAABABBACAABACBABBBCAACCCACBCACC.exe
Size 3.3MB
SHA256 d6612fc4cf460797b23fcf7001dff611eb8b63eb338485cc526fe8301b5f36dd
MD5 5a66809b6882c2a1b5e8494f8d85ae05
SHA1 092566b170de448a35dd3e738dedf2f76ed783c2
SHA512 2eafc6d266b785f7acdf08f7e61533e28ae8d148da3478e14deddb0d8fc3b6aadf1e695a96d40e6cbdf708a323d52cd64d53d7b8096e41b5dbe3ee9c5a87c73a
SSDEEP 49152:U+E9oqatgl8+E9oqatglLW1PszNsQy+E9oqatgl8+E9oqatglLW1PszNsQzDd79P:1YAW1PszHYAW1Psz/p7d
TLSH
T1EFF57C42FBC58072F5731631487B92B61A76B9110F31D69F6388662E5F33BC0AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4d7049e70158f94df73901f29f3af6b61c1252823c02c8e0e82e299c49e5eabb
MD5 f7db5cb4bdc719fc2e02fbe43ec7fb21
SHA1 abc61947abf218ac78a612047597ee4b2a36588a
SHA512 e31642c7bdb8cef83857e03fb929e7637f93eaddda18c1e998b747b9e4ccca855215e9bcbdaaa63b825349fae2bcf21b70aa86f1f18800d9ca3e6d84ea815461
TLSH
T13421A862E4E5CCA7F83364CB5E1BDAD208B83ADF9C5C6E14234D4618BB95C32CD154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 264f28031a9d1258e4ba14490061c803440e258bbd903b003c05006a162d9847
MD5 20214273500a0467109e4e53fe0b8dbb
SHA1 f0f252d025c44d79e8940a953a0ee5e72fb75f3e
SHA512 7b8938beaab082a7a82bbcf0bac82e5a0b8af62974a73988bb85c0a58702e571ead266d076044cbdccafe9bf587e50d5055aadbeeead5ab397c9f5f0154fa709
TLSH
T11611A762E4E5DCA3F83364CB5E2B9AD20CE4398F5C6C6E2423494219B745C329E150E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7676be98c22616282822b72945c43a8098cac3dfc5df76c7f8a681a7a122d31d
MD5 f018faee300bf57d05913a7254f75896
SHA1 c753a189d8e3e1a0092542dc885585198c8c2275
SHA512 563c48baa3c02d906c45f7736acf4f937391016aa65d1c78c4fc2444bdd858fad95bd2682c6cbe6b8c5f74200a26dfd40e053a6507351a403e192768d57f4573
TLSH
T13821C662E4E5CCA3FC3364CB5F1B9AD20CF4398F6C6C6E2423495618BB45C328E150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1432-80-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/1504-6-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3664-1441-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5936-33-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download