e17e10d7add9f21a3e0c5290a16fe6c9c17bf12cabb8402285645dd75a78b784

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
Size 7.4MB
Sample260815-ejmdesdg36
SHA256 e17e10d7add9f21a3e0c5290a16fe6c9c17bf12cabb8402285645dd75a78b784
MD5 4ee3d01a1fd2579133dfe7781f4b686c
SHA1 e09b830d2d94517eb8a68a59e6a33fdcc5c803ec
SHA512 dc7031c596dc33cf878316f26bacbce4d3831691fdb4ed46466c6b6c86fa20a3378d05540f1a0b6fdad83b7e550355722effb2d377db38f0108d1a8f2cfc8d52
SSDEEP 98304:LRViVRViVsW1PszNRViVRViVsW1Psz/p7n:FxszxsJn
TLSH
T1D0766D42FA8680B2E42701714C9B93FB5A71BD114F2296DFB388A36E5E337C0A736755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
2884	svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe
2220	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAACCAAAAACBCCBAACBAABCCACBCAACACBBBACCBACABAABCACCACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe"	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACBCCABABAAAAACABBCABACBAACABABABACCCBBCACCCBCBBAACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe"	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4080	sc.exe
3092	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4556	cmd.exe
3908	cmd.exe
4728	cmd.exe
2580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1876	schtasks.exe
2356	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
2220	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
2220	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
2884	svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe
2884	svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
Token: SeDebugPrivilege	2220	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
Token: SeDebugPrivilege	2884	svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2712	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4556	4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe	97
PID 4556 wrote to memory of 1876	4556	cmd.exe	99
PID 4160 wrote to memory of 4612	4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe	100
PID 4612 wrote to memory of 1316	4612	notepad.exe	101
PID 4408 wrote to memory of 3908	4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe	105
PID 3908 wrote to memory of 4080	3908	cmd.exe	107
PID 4408 wrote to memory of 4728	4408	2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe	108
PID 4728 wrote to memory of 3092	4728	cmd.exe	110
PID 4160 wrote to memory of 2580	4160	svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe	113
PID 2580 wrote to memory of 2356	2580	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ee3d01a1fd2579133dfe7781f4b686c_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCACBACBCABACBBCBABCACCACCACCBACCCCBABCCAABABBABCABBCABCBABACAACBAACCAAABCBCAABACABCCBCBBCACCCBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCACBACBCABACBBCBABCACCACCACCBACCCCBABCCAABABBABCABBCABCBABACAACBAACCAAABCBCAABACABCCBCBBCACCCBACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe" start= auto displayName= "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe" start= auto displayName= "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABABCCABCCBCAABCBBBCCAACAACCAACBBCCBBBCCBAAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCACCCBABBACAACCCAACACCABBAABBACBBCCCBAAABACCBACCAABBABACAABBACBBBBCCAABBAACABACACACCCAAACABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCACCCBABBACAACCCAACACCABBAABBACBBCCCBAAABACCBACCAABBABACAABBACBBBBCCAABBAACABACACACCCAAACABBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2356

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCBABCACABACBBCCAABAACCCBCCABCCABBBBBCABBCACCBBCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b9b7341c5cee0f04aa3a910056811c731b1f6876ce056f9da5b12178fb2f3bbf
MD5 a2ccf75bf3038e3b8cee14c3fb6815e6
SHA1 dc9f8c9c4f5063f1bcadb1f600a351d8de7b0445
SHA512 3469321d5125d788447a6faa9b1f26d2bc453bdb4e15833c49dc9630d989b703623cbfbf1527455635c9f190db1111f62d77b898de952a071745211094de1695
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 7.9MB
SHA256 5b074aa624f69cdc41502551f677b3ea89dc20c23f38363dab95794f604089b2
MD5 1d09df3edd9148bd9af9b2f9f5952b58
SHA1 fbe7f04857ed0c2b3d5212a819dcbcb286eb11f8
SHA512 178351c14c6cfa55b0355f531badc9b728c1461e19f6fe816358cd106cb765266e85d11dc35d6cd70df265e4cfbfa0ff1fbb71e2afa7985b49f444f10a889255
SSDEEP 98304:LRViVRViVsW1PszNRViVRViVsW1Psz/p7spi9:FxszxsJj
TLSH
T1AE866E42FB868072E57701314CAB93FB5A71BD114F22969FB388A36E5E337C0A631756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\qap`g`v~dtlq
Size 10B
SHA256 b275325015779b3144685c679539858644641d74b90abc3f2be138ab7cbe3643
MD5 68756cd38a6586594e59627bc75bfdd5
SHA1 85915a23a70fdea6dcbe1e69805a8d49e951124e
SHA512 e8a41944f7e6491910dcf8f67a8a46f78329af52c3ad70eb686475c657257cbfeae870c25a72357474a50b670c731ed9c5a655cf29c1ebc7e3fa1c19f629a656
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 27e57590bf9cf55f347a878bc7de08638d4e55366f5be09310754635504da53d
MD5 b3e05815780465eb64e36edfe7ba668c
SHA1 9283a6dd7baad369119e035fb9c42e2b1f7080ff
SHA512 a7c0e9532bfb73d7c44b361d4b786a2d4d618ab82a7d5ff6532db623baac187eb22de1319039f85ba61f5f71f056ec64307621c987bb31ea31bf203d32eeee0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable\qap`g`v~dtlq
Size 10B
SHA256 2b8b5fd1ba56905b21233be1f9ed948d9b7950b4b970d4a0b74f7225aa3eaa7a
MD5 0109f84190595fdec751489ee8e60548
SHA1 4d06a2dc61d3cfa2895aacc045adb4235d07c5f9
SHA512 74bcc9707f5c8609721fd59dcaaf8880d0378adf42b3d32e39e054f8b923f4d3c341c29fa38af84f1a1798f47f2467b8c5b00f86c8b84fb7e3e7850ff66ff0a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\qap`g`v~dtlq
Size 10B
SHA256 ef3dcee5bea8be72229e42a28c789cfff5f727b4ae27aa78a2d10805213b9e77
MD5 73e7d29cfe44dc8609a639fbef66ce2c
SHA1 91ffaa15794e39a7d33961f251cea129fe7c8532
SHA512 d77382c562ce2e1e1893d3c4b238b1cc32510494b62726621b00dcab7c9ab7a3415f0a49112c346b334d4ba07f046e630141800414aa28e0f5d1e6ae833ed321
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 9758421fb3841a0ec97b345dbbecfe57c86ecef2274242fbb69ede1d736df9db
MD5 598eb56f566b3c9a7191682b5cfca663
SHA1 81d62c805d67350d5f699a4f5f515ba306aac0be
SHA512 47f240d94db53bd0809facdd9176238e21fba7aafeb1cef4204380d18d3de34973b137ff1b6f0006c3c3a8ea9a086527d4c25433c0b65aacf85ddca06968d67a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c13a25bfeccab90819b24cf82ac77acd00e3df022600303367dbcf7fd6c15747
MD5 4a35ec866ced1b00b5edcec76db03761
SHA1 255644494ee8d2c0eee998e99b5a1154c8dfb137
SHA512 39a657a3496ae55cbdc0c727663fb6e00f4c98df839647a3e81104bc19602d665a42f881845b455d82cefdf816ab57e034047f91486cf24cf52ac0e95b33e7ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70f604415c421cb85cb66d13657532d6fbf61f493480714a7179e34adb3cffa3
MD5 40a715a1a938f1cbbee5a584470d6648
SHA1 ff7387a91b55ed6effee271a64564c8b274e1721
SHA512 4f85f27ca0f543f36665d2f51b4f32a2a390579182cb88c8c0fc42909b66bd8cecdf1086cf18add787f201fdfa7616ee11caa813cc85b36b3bafc14840b2aaa2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ece3fbe7782b2c499d2d1ad660f398c4b51b7013f8269c66f7afcff313d1a32e
MD5 cc1fd6efbb4c3478e7abea6c892a27b6
SHA1 07c778b526774c4f182468b7ff92960a6dd486a7
SHA512 c53bbf47cde5b230b5d247fef8239768258364c6bf33e507b777d87230712a01b2ad6e87bf61e3a2f88eec49da78e4aede650ec8aa184fe7b55d40f0a3b9d081
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e8c53e79c48d15d616a43d8cf53b476b618bd7a1ab2b169ef60bdfc823f09b2
MD5 8c0633fb61f44e39baa8a7ab40b34b05
SHA1 dbe38ce024d9413c01c8700d39a35c6907b94f2b
SHA512 71af70adb5fd10df6bbc8d38c631473a4ff733bd1819be60322d59ab8a17323757d7698fd4ff9655750adfd7251fd0f9eb2c081058b00d5441fbd9a7853144e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8c3a073dff1524fa71d42ec7c28331d2bc304133f752ee22ec302c29a97a71b7
MD5 31cf14eb5bdb770551d9014ce34ddb3f
SHA1 82561711bfa85f69ff06b9f2d083368cdbad7938
SHA512 322e2758fc8247160ae7472cbbca5a694b5cdaa263011cb3be96d79c8615323aa2e99ce90d90c46d9af7a4388d784410fcfab885888d1a168231dbe3dd8c94ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 adaf507d49bb82409fc82b87300e8253372307783f62606d819ff2c4974d37b0
MD5 8357f2729370546bbeb73c3eb93bcfc9
SHA1 9b29072d275b4b9677aee398de2f089492e18b8c
SHA512 e8423f3e4b7df90c39737eb35bcb12fd9848b08f06657d7f5ddd2ed26a490e46ea88a224ac21bacffe0412eb9775f9e271b8da224cd425f6edc90df66cf032f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b8a83c7772a9e5002bc47dbdc5b034615a565f2bb8080ea63da1b7d25439226c
MD5 75cb3c4554484777e205de505eae83bc
SHA1 08f4753b4b98314ec625ae75c85fb14955b095f0
SHA512 936a8719e27af442d5d4a2424fb2e8076ff7f2eb1c44b0a2a5635768db7a84b709bc057d5d53d5db1706aefc070a2f4ec9cc15c1b325220ea005d5504819da2d
MD5 SHA1 SHA512

Submit Download

svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCACBACAACBCBCACABBAACCBCBACBAAABACBACBAABBACBCCCBCCA.exe
Size 7.4MB
SHA256 e17e10d7add9f21a3e0c5290a16fe6c9c17bf12cabb8402285645dd75a78b784
MD5 4ee3d01a1fd2579133dfe7781f4b686c
SHA1 e09b830d2d94517eb8a68a59e6a33fdcc5c803ec
SHA512 dc7031c596dc33cf878316f26bacbce4d3831691fdb4ed46466c6b6c86fa20a3378d05540f1a0b6fdad83b7e550355722effb2d377db38f0108d1a8f2cfc8d52
SSDEEP 98304:LRViVRViVsW1PszNRViVRViVsW1Psz/p7n:FxszxsJn
TLSH
T1D0766D42FA8680B2E42701714C9B93FB5A71BD114F2296DFB388A36E5E337C0A736755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 7bc0b91cc146b76d231478af79bdde303bd988595ff683a2c35235e025a66067
MD5 fa9e0dc36d1ba5e194cc74bb98b5e47a
SHA1 d5bd9ea0bbdc9cd9382be45dd6178913339fbcfc
SHA512 a79fd64a534906e0504efec1cd7c713e7733b31f625b877ccade172dce7f71fa56459b5d7ce1be9711a6100b0447cfe5aaeb9e3f5e77a3d8ea72eafc94a769ee
TLSH
T1BC112991E9E48C43FC3264CB5B2E5B9708B07B57AC9C6F2413088108BB84C338E054E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 08926c6b58514290b7e0592faf2b14bb8257f797a84ac0496c71c45726e7b960
MD5 ec267c6ef5984c54097a50e2a8fac2db
SHA1 6ea27e71fa3e73fdf7ed5f69dcf3e0aa474fa257
SHA512 70b27732b8874bbaed5fc6a38d20e4a2cac1005b091351e1fcf7bba3aa79b700f0c42b9cdb5ae4901b709dcceb3976d8b6b88546a1bef6d9ca7e8f7cade7632d
TLSH
T1FC21A561E5E4CC53F83294CB5A2D9BD708B47B5BAC9C6A155309C209ABD5C338D194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d2f31a57117d894d41a4bbe46c0516b0aafc4efc9f31cc278d5ed64001e8c8fb
MD5 39dbe36d3193746b248577ae9cd953ca
SHA1 40e672546a4d79b8d8246e0dc4dc518b47a990fb
SHA512 43d731d912dac331b42c2700e278e5ee3f1d0ce428a99a1ab80847640232432a9654d50795d6094c8deb5ec026cb53fe2bf8b49a202cb40d763dd1d51ac4a9ba
TLSH
T1C2112B91E4E5DC43F83265CB5B2E9B9708F07B976C9C6F2413088109BBC5C338D054E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2220-2262-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2220-3011-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2884-71-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/2884-3009-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4160-35-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4408-6-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4612-59-0x00000000059B0000-0x00000000059B1000-memory.dmp

Download