5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Size 1.1MB
Sample260815-epekrsdg57
SHA256 5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6
MD5 42a86c9cfe4ca30d3b72d3cec9f5a422
SHA1 f75451ac167c30c442720d81940579aa94f5b630
SHA512 3225ec18aae50676d9f02c18fc733a4fbf43ab78ffe04bcf479431acbf74721cdd003cafe4a22cf1844be11de188032d3029f873a88d87b06bae23afa5c6ab4a
SSDEEP 24576:m9+EM0HdExqatgly9+EM0HdExqatglyafDd70iTWCD:U+E9oqatglg+E9oqatglVDd79WCD
TLSH
T1EA454A41BB858172F473023249BF92B65674BC214F16C6DFB388636D5E32BD0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
2240	svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe
2680	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCACCABAACCACBBBACCACBACCBCCABBCCCABCBCCACCCCBBCBABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe"	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAACBCBBCAACCCAACCABCBABCAAABBCABACCACCCCCABAACCBBCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe"	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4404	sc.exe
724	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1336	cmd.exe
412	cmd.exe
4924	cmd.exe
1632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe
3232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
2680	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
2680	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
2240	svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe
2240	svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
Token: SeDebugPrivilege	2680	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
Token: SeDebugPrivilege	2240	svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 1336	4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	101
PID 1336 wrote to memory of 2972	1336	cmd.exe	103
PID 632 wrote to memory of 5056	632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe	104
PID 5056 wrote to memory of 4020	5056	notepad.exe	105
PID 4688 wrote to memory of 412	4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	109
PID 412 wrote to memory of 4404	412	cmd.exe	111
PID 4688 wrote to memory of 4924	4688	2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe	112
PID 4924 wrote to memory of 724	4924	cmd.exe	114
PID 632 wrote to memory of 1632	632	svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe	118
PID 1632 wrote to memory of 3232	1632	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_42a86c9cfe4ca30d3b72d3cec9f5a422_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBABBBABAABBAAACCAABABCCBABCACCCACBBCACAACBBCCAACCABABBACBBACBBBAABBBCBCABCCCACBABCCBBBABCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACCBABBBABAABBAAACCAABABCCBABCACCCACBBCACAACBBCCAACCABABBACBBACBBBAABBBCBCABCCCACBABCCBBBABCCBCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe" start= auto displayName= "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe" start= auto displayName= "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCBABABCCCBAACBCCCCACBCBBBACACCCAABBBAAACBAABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAAABABAABBBBBCACACACBBBBCCAAAACCACCAABBBBACBCCBCCACBABABBCABBCAACCCABBCCAABBCACCCABAAACACCACAABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAAAAABABAABBBBBCACACACBBBBCCAAAACCACCAABBBBACBCCBCCACBABABBCABBCAACCCABBCCAABBCACCCABAAACACCACAABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3232

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBCCBCBAAAAABABCCABACABAACAAAAACACAACBACCACBAACCCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 42a1a94d1994a01f4a374061c2d16052c06be02b0eb2ac498e0a8eb90a2a033f
MD5 937a3b9ea83008ad9e10526032900e14
SHA1 d7d738bd62ac2f7b3f091f6c47f5c91be5544ae5
SHA512 832ad7103c55e88638b4a2b7721f77228ecf1ba1c24d3131cc3e771af7e4a33f678c8ed9606af033fae9754aea0e6a0fb6fa59109e2d076860cf7d4dbbd5ee10
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.6MB
SHA256 cc9119e014721711deb3e5a2e9013dc4a7646054df2a30d4ae9f455c4b1de6da
MD5 7d8232a10ea671f91a988b95db4a133b
SHA1 25a3a456c8abf7f1d16cf7e000b0f1e63e5fe461
SHA512 bda4aa6b32a568a5f657630d28c9656b740f29d83d1f26987afff0edcdcafeabacc40d2342b4e4439f3cc52ed77e31ab72e6f08c3edf2492d66e659e80a97a4b
SSDEEP 49152:U+E9oqatglg+E9oqatglVDd79WCUXpiMl:1mAp7GpiE
TLSH
T193753A42BBD59132F1B306318EBB92A65A75BC214F35C28F6384631D5D72BD0EA31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 539d79f0f56594592a50c2fd7c91cd22aa54be82304607a776e4e5297228dbba
MD5 4518fe27663883c7b286a068a3d06dc5
SHA1 c79ba353592a4ebf483cb57aab9da0f09edcacd0
SHA512 cf3bb366b5d537e6a5af98db2839a40998e3848d968993445709ed9a8ba7824c28ed145d9fbadb7445627984ee5c42892c505ba1f51fe96a16b5d051d89418cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\ar\qap`g`v~dtlq
Size 10B
SHA256 4fd17c26a0fecdc4287c11f020789f6450037ba6b9625832c1c45535b35cf2e3
MD5 e180edd1b955c9d68daa97a64c6e126c
SHA1 5140b83b3dc12a37416ab85f7fae96407cff03ae
SHA512 881bdd27a0758eb897cb0e6e644ae46f810a82bbba8a8eea87cbbb3b87f69d002506e48fc9ca6fd390ca49723685a6d7c522bc9697a53deefc444115a7479a39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick\Controls\Styles\qap`g`v~dtlq
Size 10B
SHA256 67b1a8b7938670e6f54d08c6e3f31170e74009638dd6dc9c0f58043554084e32
MD5 0f6e6deea0e65bb03512938c6e6d1803
SHA1 bbe7aaebf3f1b86146834fd2dcacfb0c85d9c1ed
SHA512 634fff539a06631e1c3234d163caa8b5c8d14067f027293680257f2e02f3dc4258012ac16ecaa6d01b9b5831d5efd15700579bac0e1c3d0511031ca0179b81b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 84defb0e70b4f8422522a19434b826b928d1c50ecb8e715e3c0470c2441bb659
MD5 1f2f05537aa69e8290b6d416cfa27ce3
SHA1 808c3d3dcd0eb88b3b72ca0d49dc3df046bd2e02
SHA512 b47c1c0203cc286bdcb810545a8d96b6eb0832e42784e4c19ccf8e46bd13377bf5e3474daf64233cecfa3514636198216c4fa0eca556f66182395d334b3907c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 ed707c05e7931d62665c7af61504fac06dcf16e6f78c670f8a51ec3b0e5fa328
MD5 f8dec39f71348f423ffedf41024e7caf
SHA1 20cc639a6ef50c9801cd97c25661161006ec8a88
SHA512 a193b3ebf1b10cd30d8e2a856dac39d311d0f8b4c7a4f5f6c7f6332219aa3b1443dac07092d202787b89c53309dd15de7795027ce41d18b3f766b114e3be2b35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ea7dcf9ccd7c68b0f7e5092bf12ae527a9afc5374cdbd60caee6ece32574ee4
MD5 24d0b82346d38d684244679b4a7a42a2
SHA1 623d439c1071ab27d011b2872ebda99820240468
SHA512 313a2f7d99ba265718b95cf5d0e95ec302cf92f1af3bf0e9f4905d4f54493bde7121f38d4997bfeae8ae9c0b37df49b5e02460e36161c04bd8a868bfa3cd252a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ede63422939c0b310c0907890745abf20c5b1bcd17b30edc25431c4f386e87c8
MD5 d6c491688da4de34ffcc962217a1f2fc
SHA1 f277442706a04f6d01f11b105cf054db8b0b882b
SHA512 8dc782d1545ddd269a8d7809ea5b1d3717a1279c081c298146eef075a07fdda9291fb5155f8d9d41c7f39f4dc00ef80172a72090467d5e1b8701fa18d30b9ba2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f94b138daf6d76fed1d22f5fa88de1be4cbb6860529b3aec6420703c097b9f81
MD5 c788fe5e54978cb42563c06a1b57118c
SHA1 146e5e70313f0e29aebadd08a30d8bcda1d5162c
SHA512 97b50b48361d6daea715473ab31a585f3d1eace6620b6087ce0c30868961757b2c4d20ad526b63e3c13effd099e37e2ef19e2e7781c3dd8aa3f0a0cc123d106e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cb20244607ddef0a1559262bde167ab99fc82dc528ee6ada4918509fd1bcbc4
MD5 e03bb7c9abea8119badf5c32a336a822
SHA1 90f6916308d154b90607d6a07af48def1e4c18ae
SHA512 396ab98b39b54b058f8fed3ee93cab168672d989436add2f092b1b389e507158c12931083b8231faa0b6e18132f80cf71d85e64e4394d7ec867d198738deb449
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64739e27d0458ad2d91d2a01ecd4b388091bbee247a56cf7bd7947ecb58ff148
MD5 daa850fb2ac0c0d5a9622097a2823386
SHA1 2ed39b9c3e7e8a06f17d930bc747a7f25f1ab549
SHA512 1955c8de1b2c76ffddc8c7a11a1ee12835f4c5833a3dcee15c9d14540054baa21d2b78d6ca20f1702106ea266c484321eee501710e981dbe21dfcdff688d76fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8eb197a4509b5e0fed0b90669b197aade536e647e8a79e5321d519d2676cfa6f
MD5 fb94623052e96bdb44191fa3794fbeb2
SHA1 1356757e52d184f4c2e448b27354bed9f815bc64
SHA512 c426819bf0651ec1af0d8cd373b539c2e3e8c854a72a98fac8a2c93a809a2ecf55e156584b6711118b8abbbfc494f2b63528739e2dd9f02e9871f61cbda96b83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a89357eee9ad395cc03fc8cb268c8cf7e8a84ac31d52eb1522aff88beb27983c
MD5 b4a26e820cc98da8adeda412eecb5f1c
SHA1 9941d0850af0c96322e5348c543d07adc47451cc
SHA512 55852b5d04af3bcc371f545a4de9f361226110a437389195a311b73eddd44f7f70b6a21c7db2572c46ae2d102a26d15b386b5259b037c940dafda6af2aada53d
MD5 SHA1 SHA512

Submit Download

svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACBCAACBBABAABBBAACCBCCAABBBAABAAACBBACACCACCABBBBCA.exe
Size 1.1MB
SHA256 5acaa9573cb0de4b94a089ce450d91f3168e46bd4d5e5c7e1bd4be7774678cb6
MD5 42a86c9cfe4ca30d3b72d3cec9f5a422
SHA1 f75451ac167c30c442720d81940579aa94f5b630
SHA512 3225ec18aae50676d9f02c18fc733a4fbf43ab78ffe04bcf479431acbf74721cdd003cafe4a22cf1844be11de188032d3029f873a88d87b06bae23afa5c6ab4a
SSDEEP 24576:m9+EM0HdExqatgly9+EM0HdExqatglyafDd70iTWCD:U+E9oqatglg+E9oqatglVDd79WCD
TLSH
T1EA454A41BB858172F473023249BF92B65674BC214F16C6DFB388636D5E32BD0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 478dbe7a06ff009c910e678643153ccb9703e5515c2153f58d65c7c2d3591fc6
MD5 ba577db32666c6a1ee16ad0fd7d789ca
SHA1 1b632eeecd7cb4dc092896de5d78885bb3459a57
SHA512 86b3fff6ad2373bac3661c53a669e3b36257513468de0c719143b7957965abaa24c0a467ab4b65a4b30b4778846c9c6651de236194edbba93d661a0b8ab68a35
TLSH
T16121F97199D5CC53FD3328CAAE1D9B831CB4394FA8587F4423084318ABD5D32CE558B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 47e8f4930edc9af4ba6beec5e70b0d2bf082bbfdf1f3b13c737e1f47108707b4
MD5 94027bdf48bd440c27e008dae4c21f4a
SHA1 8e947f04404b13802ca00a6759646ceb71550752
SHA512 1198befd8dec7bcad4d07d929cce7cd6f25f1d0c1679d0bf29e8daf0b5d6ee86d409d97802f2328b391c9d8b5e56c362f8e3b9a4c15a3bb89c17969c8e4e197b
TLSH
T16421D87299D5CCA3F93368CAAE1D9B831CB43A5FAC5C6F4113084318ABD5D32CD598A1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 3f56ac91a8483d5f66f00c65fcbb8af83f0593fcde58ab991673902c4c5c94db
MD5 d500e5e8b01668e0274a722dc10b02ae
SHA1 d80efa6e44bfa330ba342ec97a0769cb0166127e
SHA512 f2271c7fe92aa9fb40a35399f41f6fe65a4f3ba5669401141e39d0e3881622ad0427b90004cdf7d0325d6459bc1d367eb62141c2685ad179bfa59d220e088e98
TLSH
T1C501D67159E5D863FD33289AAA1D5F831CF43A4F68587F4523084318A795D328E558A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-35-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2240-71-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/2240-2759-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/2680-1460-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2680-2761-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4688-6-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/5056-59-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download