ca5739fe42c28ae56f43629ea0334d55ee6918ac65b67c66413d335896bd509a

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
Size 6.7MB
Sample260815-ezznpayfjc
SHA256 ca5739fe42c28ae56f43629ea0334d55ee6918ac65b67c66413d335896bd509a
MD5 0f802c8d39b64f895819ec67b1f9adad
SHA1 480a94372d852d3e5b447db22d398754ae3abb4f
SHA512 6cde7651d6e30370e3542022dd4da3165011f500f8f70980d249c4059687ee29cd17d5b843e3512915fd8fc0e3649837d5b80d20e705d891437a2adf69e901d4
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9oqatglz+ES+E9oqatglJ+E9B+ES+E9B+ES+E9Bu:osWbTsWb2p7R
TLSH
T143663B45FACA44B1E47702704DABC2BB5A30BD254B12D5EFF248936E5D33BD0AA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
3116	svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe
864	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBACCABCBBACCCCBBAAABAAAACCCBACCCBACAABBCCCBAACBBBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe"	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBCCBCAACBBCBABACCACBAACBCABCAABCCBBCCBACABCAAACABCACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe"	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3840	sc.exe
376	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1756	cmd.exe
2516	cmd.exe
5012	cmd.exe
4928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2160	schtasks.exe
1416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
864	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
864	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
3116	svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe
3116	svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
Token: SeDebugPrivilege	864	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
Token: SeDebugPrivilege	3116	svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2516	5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe	103
PID 2516 wrote to memory of 1416	2516	cmd.exe	105
PID 4952 wrote to memory of 3588	4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe	107
PID 3588 wrote to memory of 2544	3588	notepad.exe	108
PID 5092 wrote to memory of 5012	5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe	112
PID 5012 wrote to memory of 376	5012	cmd.exe	114
PID 5092 wrote to memory of 4928	5092	2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe	115
PID 4928 wrote to memory of 3840	4928	cmd.exe	117
PID 4952 wrote to memory of 1756	4952	svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe	120
PID 1756 wrote to memory of 2160	1756	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0f802c8d39b64f895819ec67b1f9adad_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCACAABCBBBAABCAACBACCABACBAAAABBBABCAABBBABCCAABAAABABBBBABABCACAABCBCACBCAABAAAACABAACCBACBABACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABCACAABCBBBAABCAACBACCABACBAAAABBBABCAABBBABCCAABAAABABBBBABABCACAABCBCACBCAABAAAACABAACCBACBABACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe" start= auto displayName= "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe" start= auto displayName= "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCCABBBACCABCBAACACABCACABBBABBAABCBCAAABBABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBAABCCCBBCBACCBCABCBBBAACBABAAABCABCBBACBCACAACCAABCBCCCCCABBCBBBABBCCCCBCBBCACAACACCACBCCBABBABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBAABCCCBBCBACCBCABCBBBAACBABAAABCABCBBACBCACAACCAABCBCCCCCABBCBBBABBCCCCBCBBCACAACACCACBCCBABBABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACACBBCBCCACACCBBCBAACCCBCBACAAAABCBBCACCBBABBABBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e369ce9d386c6754767cb061097edc79cf6581cb9e6b5a7a886c8b537abaf147
MD5 de496e6cc151eb1aeb1a5fda9a3d23e7
SHA1 98be3660dec0c8ad8692eac5c5fb00c1a3d93e21
SHA512 2d1269d75689ef1f72647f8f74cbb00cab8b4f97968de56827e310474c7d614ed9c51a2e54728733012b6031f26e118017d53e90c6f51590bdc14bad68ebdad1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 7.1MB
SHA256 6fe62e87a069c81639137771896527c0197dca61a3dece2a1acd0eb9d256a32b
MD5 ef6a0073a2a2d288c757b709b79148ad
SHA1 d9f9213fe2b6a8bdaf9b4027adeac11b92c7d190
SHA512 7ff8686e7b0b3e57e5a3e74451471a1b7000b06b798dd80513c3b020475ae2c623d1b26c336af2e9251810949a826341f5b8ee7f9de1e789c5e437645777fdf3
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9oqatglz+ES+E9oqatglJ+E9B+ES+E9B+ES+E9Be:osWbTsWb2p7OpiP
TLSH
T194762B45FAC940B1F47702704DAB82BA5A31BD254F12D6EFF248936E5D33BD0AA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\Setup\qap`g`v~dtlq
Size 10B
SHA256 ae628274af9c77f17dabea13f52e1656f8dea267fe338cac74b78844b00ec5c3
MD5 9e141d87945d8740eb9a439b166dda4c
SHA1 aa69ee8944d8787e31a9f36a7391f4a8df42f76d
SHA512 6d75cbbcc121bc8995846877fe00a60815908d6c5b46b1da5327ae12b4c5ddfdea5e36304af7063fdd2315d247bb34310711f88bede4ccc23b5458f841c822a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\be\qap`g`v~dtlq
Size 10B
SHA256 b351bfde064d5d13c779d1531d1df9bd040679058d4895e78e9db248aad1314a
MD5 e394bacee7c05608b23a5d92f7d60c15
SHA1 5ee46698cde358cf15bb2cafe9a9791e54437ea4
SHA512 720e085f5ddca64d4075628a2e7c0a92996426d842aee37896d9fadba3973ab057c408a4ccf61a9cd9b833b92b666458c1adedfc0a2a61c5da31a57833acf1de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d41b8c4b-a6e1-4d22-93ab-35ae7f3984b9}\qap`g`v~dtlq
Size 10B
SHA256 fac469e9443f53d5291e87ae11ebaf89b624c3d649c751425fa3fce17b771163
MD5 beef3c00b86d9d3f2afed5fce626a832
SHA1 bb6f9abb67bbb70e13d08b944cc4f4bd3ae7f427
SHA512 047f164ce5ae986f71e6fa5726e93d2aa90f428b37f3bbb51724e7d7ee0780fbdc1fac7efcbd3e07226a1a9e442fa73521839b74eb2783cd871410fea28859b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 aeccf6a9f20cd2a89f7e333d5b31e91b2e39f561e1e27077f5f9d0a86994ab95
MD5 2094d028427ceb45c4e8dc618e142f45
SHA1 c7a83b0392c8e14cb2706ca6c1726d95ad70cced
SHA512 b73303989d1c3b2a8596a2e84f717ac84c93673470d96c680687d3142045c961749736fbbe76415bfb62ba49d89cc25985940f35cdf890a515e919971b2743c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e383807bdd2fbc692c3b7f44a6b378eaf2e2a2bbfd768c6a4c676033e0acce2e
MD5 1b39cfb7707d925080bafb14b35c7a23
SHA1 e897d282dee2eade4ea20d911e32f1a153283464
SHA512 22aa74c8ec11a9c0e30093088e7556c134f63899caf45b7a4f31fe3ba4ad8557103b7ee2e8596a7bc0bb61708014636a602201a22c33b3115c4669e3229bd056
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ebdec27b42c2f598d99aea7226fd65ef2b33d516a59c8ea2c8fea88eb4a66b8
MD5 8de081981e704e04c8059b9e051ec647
SHA1 60c96ef0472b816f3ff46f8731417daeeebc55d3
SHA512 5e2508dcfc25c0f292975c276925ceeaebe4f750de420ec545422e15542963b49196a60bd69cb9c61f9c85a538a71067a994be23ef4f1e889e2a8d4c56f85a5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fbbe8bc711db639a7f1388bca12941419420549cc644f4a64dc0198607b3c40c
MD5 7852144dcd8722e2b4a6b5d4abe95f71
SHA1 092e1171de076fe0c7f4208a6a88c8a3afa5f474
SHA512 c93562aa5dbbd65de4c7bd006e85c1297b2920d578044a9770176642e6982a0994c5e7fa176431e8014ecd6b8edd9b6d5632cd36ece3da3fc5fa7ba9e4ee066e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 805afd39cee2feda9c62a6f0b252313b9c05ec9eb6c41b5b9f42f5f83420b94d
MD5 c6a737ffb2c2678b169a642936f94bca
SHA1 5c72748f3d676c0b01bc6cb5f959e4be8a3b8c01
SHA512 c8bd92c4403e53445f21461eadbfa6f82fe306e4ca9866d601d2cac7463872e0c4c91f22f5822aca8289c5544818645796aaefd552777354aea79ed4673b9e34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 820a80aecaeb5f495a0ea49278b3d76b83f09e70a93c74ab867312aa9e8e8dd6
MD5 e08d23aa288eb8f4da5c6bf57e529fcb
SHA1 6ddfb1cb51a7c99625c64bb573d37686abae6a3f
SHA512 7c8d6b67c44807300dd8272803175efe12eb78d4e8dbf08f9d0fa5b96d5f291ced9c16d194aabe92addc8e7834dbe2aca45f7d631be679ce9116b22d2ba2d055
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f55eb175015b118e97ad5952f6ec04423a724f1a1ff4d75d09d6aafb4582527d
MD5 fb0452abe1f142f35ba25f0ef77bc9fc
SHA1 0bf2de5a6a9f916d14276fa397d2670768f292ad
SHA512 744bb0e47de3dbbd53d9524ca67ee576a790c0b508a14c3fcaf0896bd1938991ff9f907c0de658476f63705461c4279502a4422f8397afb3f2066943fe5f52dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1748c8781ce92aa113fb0be5f3ccb3ef769e1500d198b96a422e3997989cda78
MD5 bdc498ab5c426f638490afcdaa666984
SHA1 638197bb03d93b30d14ac240fd7599e166326bf4
SHA512 b11b0cb376444c0f31a8749c521795959d54d37f48c3d37dc8a649ee98290589ba9fcba3ec6e4cf70c21133b2727f6007e61483baf9cab18b22240874cf2060b
MD5 SHA1 SHA512

Submit Download

svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAABCABCBACACCCBBABAACAAACABBCACCCACACAABABACACBAACB.exe
Size 6.7MB
SHA256 ca5739fe42c28ae56f43629ea0334d55ee6918ac65b67c66413d335896bd509a
MD5 0f802c8d39b64f895819ec67b1f9adad
SHA1 480a94372d852d3e5b447db22d398754ae3abb4f
SHA512 6cde7651d6e30370e3542022dd4da3165011f500f8f70980d249c4059687ee29cd17d5b843e3512915fd8fc0e3649837d5b80d20e705d891437a2adf69e901d4
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9oqatglz+ES+E9oqatglJ+E9B+ES+E9B+ES+E9Bu:osWbTsWb2p7R
TLSH
T143663B45FACA44B1E47702704DABC2BB5A30BD254B12D5EFF248936E5D33BD0AA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e56c2bbfbb38cd44388cfb42d54854958730747c9d7b18e94b1cbd5fe420d3e8
MD5 9f303b6aa833be951d82bc5f4bc46864
SHA1 65d7a07dfc3e824c99549d95bc15e2c5d9c3d095
SHA512 014c610c8c95050df17def1c14763f58db2900a722cea4c5de5861dd1216f645ca769b00384a9aa2fcb8648fcf2e6686d1e42311dab424ea2571b913be3659c3
TLSH
T18F21C961E8E5E817F93368C79A29DBD20CB43A4FEC5C5E94230D4218BB49D31CE578A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cd8586d20ca711cd3beebb556eb6a1e023d5ce2c9ee9ade9ee82d25b1c7a8ef8
MD5 3e4e045c5abe072655dbefd1109331bd
SHA1 4d5d4174d03ec44f00e2996efc83e982a400c9c8
SHA512 f62b3d4c4ed31cc108f8210a83a7365bb8103d53f531b469f14ac4ac56c842a3c7e99812e97b0852f81d772364fcf2e4e516071922688a0a66d8269a09ab6cf6
TLSH
T15E21A861E8E5E857F93268CB9A29DBD20CB83B8FEC5C5E84230D4218BB49D318D574E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b351fcf3061de73079a5a8399e281356e3629415e5b5f395b94a9bec37ed2463
MD5 4dc7a90db6b33d26529b2a9ce56114a6
SHA1 09ef80779d83d8fb9eaeb71e5eed5d12be145a7c
SHA512 617f2679a9129fd19504d21d65824f22608991aa982d11304287087962915f91dbf16d9a72db71f2805bda65398303b848a6ca7bf9260e3c00fffafcb4c8ea62
TLSH
T13B11EB61D8E5E817F93328C79A299B920CF43A8FAC5C5E84230D4218BB49D31CD574A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-82-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/864-2761-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3116-71-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/3116-2759-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/3588-59-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/4952-35-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5092-6-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download