1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Size 10.7MB
Sample260816-lnjawsvbqf
SHA256 1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea
MD5 dec965cb2ba295de5ec78d58fb46f55b
SHA1 2ed5a7225861810bb2dba8d9720b859496bbe72d
SHA512 e2ebc43a0ab519730fe4905df8c448d24c2e335ffa14683f37c4fddb90effe757a8cfe1a3c3de074e87d3de2e4ee95a6ada94dda2d20e9a0d7d037a9cbdd9a9c
SSDEEP 49152:U+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+E0:iUtUtUtUtUtUtUtUtUQKRuy5a0
TLSH
T1FCB65C06B7D544B1E5730231496B42A68A76BC211F31D7CF63D4A27EAE33BC0BA31B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
4456	svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe
4864	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAABABACCCCAAAACCBCCCCAAAACCAACCABCBCACACAACABAAACCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe"	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAAACCCCBBCACACBAAAACBACBACCCBACCBBBAACAAABBBCCBBCAABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe"	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
612	sc.exe
4424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
900	cmd.exe
4196	cmd.exe
1100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
4864	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
4864	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
4456	svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe
4456	svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
Token: SeDebugPrivilege	4864	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
Token: SeDebugPrivilege	4456	svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4044	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 900	4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	103
PID 900 wrote to memory of 216	900	cmd.exe	105
PID 2272 wrote to memory of 2996	2272	svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe	108
PID 2996 wrote to memory of 2344	2996	notepad.exe	109
PID 4488 wrote to memory of 4196	4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	113
PID 4196 wrote to memory of 612	4196	cmd.exe	115
PID 4488 wrote to memory of 1100	4488	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	116
PID 1100 wrote to memory of 4424	1100	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABAAACCACACAACCCAABBBBCBAACCCCCCCCCAACABCBACBBBACACBBCCACACCABBABABABBCACCCABBBCBCABBBCABACCCABCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABAAACCACACAACCCAABBBBCBAACCCCCCCCCAACABCBACBBBACACBBCCACACCABBABABABBCACCCABBBCBCABBBCABACCCABCCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe" start= auto displayName= "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe" start= auto displayName= "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBBBCBBACAACCCCAAABBBCBBCBBBCAACBBCACCCAABBCCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBAAAABACBAACCBBCCABAAABBACCCAABACCAACBACABBBCABBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f9816dde69100cc26cb78ca7c818175eece2e28929db21f14d12fb9eb4b9caec
MD5 dd12e6a4dad57a44d4c32fdc3e72fe1a
SHA1 dd537fbf9c59825a3edb7c19c1f2ad863ba7eb77
SHA512 241992a043f9e05a0151910abfb5f7a1a734b2f69a9bcdf75331933f6cb9235df192aadc08b81609278b1e46b455e7e175461af5544f0c4d1f73208d1f691963
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.1MB
SHA256 03b0e0b88e0515f05b905f0db75a02c810d3748f771ef4e9fa443db46411bdfa
MD5 4923f0a6ab913d4846d18bf4fd87060a
SHA1 9981f957a566b455ec087c650a11eec2df1cacde
SHA512 898c02a253974764c071cee3b102d540bf51ef5518919e09c11270725ec3e395e44cc61298c2948ddf0a67702a6307c9873981e6695273fdb58263b028b520ea
SSDEEP 49152:U+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+E/:iUtUtUtUtUtUtUtUtUQKRuy5a3pie
TLSH
T16AC65C06B7D544B1E5B30231496B42A68A76BC211F31D7CF63D4A27E9E33BC0BA31B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\Keys\qap`g`v~dtlq
Size 10B
SHA256 6e865a4f9ed08c34bdffb15c573b4a587e82fc3588278623f2b39e4b6de3eb04
MD5 34abea47adbbaa8ebbf67bb7f8c5a0f2
SHA1 cd6ec03808461cac858064817c4a386e651268ac
SHA512 13f2deab8d4ffe838ecb2338677b76e06a5b9f45332443887b213099a96e44eedc0745136f5869c98cad6c20025f3115ae33a221bf6634bf678eceee12f7c7d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\qap`g`v~dtlq
Size 10B
SHA256 8c770280ea8df0d8d4e324a6a99cd72ef9708a1fd031a3d9128c7be330e2673a
MD5 ea857473baa532c5656e53b680ba2325
SHA1 54bff5392bf9847295ede696cb68d7796c7c7b0e
SHA512 2f33f8c4a84200e18ee36dd7a3e480cee4cce9616463a2ee4c8f5c7e1b49a04783ce525364ff441e177d1b38b9f58f98926cfccd7e11ad91e33d5314e537bd39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 099a1e36cd3095bf842532021b65a19129080a5d316ddedfe0a487876204558e
MD5 0224acb8c5ba35d028903e1f6fc5d86e
SHA1 4c92bc4fb653e7adef16bee1fd6a39f0f16de113
SHA512 f76023d491a7d1c816245e294677e3784d6955a852f068757c57549ce75ff4ad34373b945633d38a5e8b9586f329417b6d24ab774b3c222ab332b7b221ecbe07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\tr\qap`g`v~dtlq
Size 10B
SHA256 3827254ee2afa526222b3580eaba047ea219c6d27cf0ef80684d27938eff58d8
MD5 c4daebf1540e248be628001cb4460d3d
SHA1 99d1f1c7b31fcd903408ae5814e199d750aa8b8d
SHA512 a0c29783b98776f11211b73aa37e0f65a53806e0a3c12d37689d43c61d6ee252ca6f90598bb38eeac5ca9ef2a4d9d72129c9d98bfa41272581bc8bdec14b52de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 54fa94057e6eea1540323a7c65ffc81a8286c585d102698199910bcc92cb3a83
MD5 ba157f2f5ea30ba22582b2821f24ed8f
SHA1 978c29e9653df40af912f5538de88911da521253
SHA512 ef3a0b6497d351e8b027c8bcf41347e42384f3eff5dba00d6d7f84117ff758123b3995a34025ca5e73590aa620a17be51ea6403058f5c97c7e5d7da993c3f81b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\ConvertFromStart\qap`g`v~dtlq
Size 10B
SHA256 3339120a180f0eee08b2f4b5a5fd6aa0c69c552167e4fa604f542fea3856ee45
MD5 5649ba538998e4ac489596732ab35c90
SHA1 ab748be5bc7be3a503436c42d391d43f197b05e0
SHA512 13da01d3d58d800dcd6fd35cda8e83ecb9464c1c12a8125a2714034a31bcdc6d25dd1519f58f63307a2132290de76a9d17838dde3a5b12f5fd9144e171bd2b22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bdf589c3d24a74624f4430065191c5dac233d62a6748eca8e580fc3851c1a8d
MD5 800c0c3ea343a3e03ee1ec3e75a5fa50
SHA1 fcb682ecabb332e336f6b4f1e2ab7a62973cc34d
SHA512 9cc78a2e9799a87c8f99d04c8bdfc3ed5e912538941db375b94ad9d90043ae328b8b4ff6783d96dc189830f8e5c189a77905ccb91d26899a80d99a4898275325
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5ed59a867c13b38bccf93bbc1cb4fa717469bf9d09a2b2612439c41f47316f2
MD5 5ebacb69229137c07d2e5d579831340b
SHA1 9f575845338dfae575b2cae01042d0eb0123e18a
SHA512 4bc054bc4c51073d6212e40dde2efa48d9388a5acbbb4f0912e512f79b987395f05bef378e725d38b5c7da7de9498b6f073a024db8f0ec5a577e75f33ccc66d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfae9ed14826ec953e5ec7c5bb205f26ee8b1b116c1871a94ef2ca8c0f852320
MD5 ccfc0484dd3f4faeda6fc018346745a1
SHA1 dcbc81d7499457028a5239c8fea0466ec3dd9ffc
SHA512 1436f9ea379bf5cae13e7a6ce22a67bb743df545ee2a9c3b7258a9f7d7d62f2c52ca978b6fe9e2020184d1e043f909fa9d9c3f791e03390081a61ad52d61db2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0b629a7ab0677ac2b8063135556eacbe77971e56483301f7c65411a42957a8bf
MD5 493246a9eaa3c3e95bec281a374918eb
SHA1 609bdcc71ca482a40a20ff8ebb52a59960baea29
SHA512 0ce1085d3a17c5b1acde40cb1b30ae0ee68ed62efd485c46625643055db0ca3bf9b65bff468b2ec64509d0c75a74c33e6bede20766784416fc444bcf2a1cd2cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a4960faee3559a256d1f0dbea20a7a06d398f242bc2133f1df7985d542f12e36
MD5 771febb8d4f141db21b57a03e7c3f4e0
SHA1 8aacf79931ed0333cbfe1b179c0bccfdab446f2d
SHA512 aee6521ed37d5bf153a85195abbfa0ce7efdce330757850de88e7199ad8011c43c1c5f1e5f1e90ae5911b9e18c591040bffbe8a5101484525c2bf43408bc9809
MD5 SHA1 SHA512

Submit Download

svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACABCBAACCACACBBBBABCBCBCCABCCBCAABBCCBAACCCABACBCBBC.exe
Size 10.7MB
SHA256 1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea
MD5 dec965cb2ba295de5ec78d58fb46f55b
SHA1 2ed5a7225861810bb2dba8d9720b859496bbe72d
SHA512 e2ebc43a0ab519730fe4905df8c448d24c2e335ffa14683f37c4fddb90effe757a8cfe1a3c3de074e87d3de2e4ee95a6ada94dda2d20e9a0d7d037a9cbdd9a9c
SSDEEP 49152:U+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+E0:iUtUtUtUtUtUtUtUtUQKRuy5a0
TLSH
T1FCB65C06B7D544B1E5730231496B42A68A76BC211F31D7CF63D4A27EAE33BC0BA31B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d546ddf6438a2cc4a04cc62c682920ab50f2d94c5c932c29a18438e85c830669
MD5 9254c472b32e87cb94f38a6b8cb3875c
SHA1 1ab5f3e9bb638f1ce24d1e072820d0d6c917b4f1
SHA512 8d1b8029b75f38832ce980caa718fb57ffc5154359242189e9d2851acb57889e5f6647d911320dc0f429e4719edb9dbde755ff09c393555140967db9435121a8
TLSH
T11F21CC61A4E5D813F872688B951EFF820DD937BFA8585E1423088A19ABE98318D1D8F5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b57509218dde202c677aa3a9532fde35f7cc576282d877d8214767bf9b61e008
MD5 f2102dd75493cb6add77f475674fef97
SHA1 00e86a3fcdf04ff1c1de31404b20db17446d8d02
SHA512 47013ade88f5499f90ca97bf316ec52a7e5f69aa9b0f790da8aad787f4ed25cf33ed10e8495c389446b15184ff755d4c6a08f57633d4068dd95f7395b0e222d2
TLSH
T1E311EB61B4E5D813F872698B551EEFC20DD937AF6C585A1423088A18ABEC8318D194F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-35-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/2272-25-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/2996-57-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/4456-77-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/4456-2213-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/4488-6-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/4864-233-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4864-3014-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download