9b1d489252e130994d34fd79c542e452e5280b42c1f49d786da984e50138d31d

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
Size 5.4MB
Sample260828-2dfp1stfld
SHA256 9b1d489252e130994d34fd79c542e452e5280b42c1f49d786da984e50138d31d
MD5 0bd8473b3485efde317a69ee83047add
SHA1 9c4a4801ae80301a4d9c20011478c6d8f85c2776
SHA512 e404a780a9d29bf84abbbaca644f66313426debf1a4ce43ae99bb473e34ffd3d9db619856b1cf0022a0420fa60820a8a658fb0d7f8e776590017c4d496c2458f
SSDEEP 49152:U+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+EV:TGGGGGGGGM
TLSH
T145464A49FA4380B2D82B017148CBD3FB4B70B9254B129AABF789C73EAE337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
3972	svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe
1052	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAAAACCBBBCBBBAABBBABBAAACBBABBCCAAACCACACACAABACCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe"	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBBBBBBABCCAAAAACBABAAAAAABACCCBAAACABCBAABBACCBBAACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe"	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4812	sc.exe
1300	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1556	cmd.exe
4860	cmd.exe
4764	cmd.exe
5776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5672	schtasks.exe
436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
1052	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
1052	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
3972	svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe
3972	svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
Token: SeDebugPrivilege	1052	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
Token: SeDebugPrivilege	3972	svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 5776	1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe	91
PID 5776 wrote to memory of 5672	5776	cmd.exe	93
PID 296 wrote to memory of 2644	296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe	94
PID 1896 wrote to memory of 1556	1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe	97
PID 1556 wrote to memory of 4812	1556	cmd.exe	99
PID 1896 wrote to memory of 4860	1896	2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe	100
PID 4860 wrote to memory of 1300	4860	cmd.exe	102
PID 296 wrote to memory of 4764	296	svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe	105
PID 4764 wrote to memory of 436	4764	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bd8473b3485efde317a69ee83047add_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAABCBBCBAABABCACBBCCCBCACACBABACACBABCCCCBAACBBACABBBBCCBCCCACCCBAAACBACBBCCBCBAABCBCBBCBCCAABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAABCBBCBAABABCACBBCCCBCACACBABACACBABCCCCBAACBBACABBBBCCBCCCACCCBAAACBACBBCCBCBAABCBCBBCBCCAABCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe" start= auto displayName= "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe" start= auto displayName= "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBCACCBBCACCBCACABACABBBACAACACAAAACACABACABACCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACBAACBBABAAACBABAABAAACCCCCCCAACABCBABBBBABAACBBBBCBBCACCCCCACAABCBBCAABCBCAABBBCBCAAAAACABABACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACBAACBBABAAACBABAABAAACCCCCCCAACABCBABBBBABAACBBBBCBBCACCCCCACAABCBBCAABCBCAABBBCBCAAAAACABABACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCAABBBBACCBCAACBBBCCACCCBABBBBCCBACCAACBABCBCBABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ebcdbd40bc1a4013cdff89d8a99648a705f9f5777443f28487edcdf6a9c072af
MD5 a13a210713c959fee947d296b9d1e67b
SHA1 43302ae52927d27dd2874b25dd4c517d50743691
SHA512 2078a866e322def137ce9de6f7a78c952bda2e9507f7fe752ae5bfc6b7e61841e5fd252b2483063f00d37020b7984a4c30fea4740345f14f66cfc7278ab37e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 ed48592062585baa62a40a7e7b64940c4931f819a9bab76af28016312086b72f
MD5 66caaf9e9f0cb8b397d6a805134682d3
SHA1 63d802e43427ac09aceb2bb38c8dfac3446ada57
SHA512 bbc2cd3afdf3d54affec6f0257f676c5b1309d4d7f7b4159227e8581b4ca61f9b4ab7f9ce5994a92491374b56ca976b81b76017be6ac38a7beb61a2b28e38a88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\Support\qap`g`v~dtlq
Size 10B
SHA256 9eb0d87450af669c264754e85cf6b1d09ada6b1965aaffe6a3fc09f88348b901
MD5 e1dcfb0415537ffd9f27d5383003525c
SHA1 0c954c9bce32bf6273aa023193fa150e492be913
SHA512 b02acfc704deb7e9348982ef8fac56be23844a2163b5282f32bad6ffc056059964152eb31e65548e3ebfcfec38d426e7ad7b3d99a317a8bd51075d42f4235396
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\qap`g`v~dtlq
Size 10B
SHA256 917fd3f0baa2efb4db40a551867bfad43fb71fc6723bd4257158105e69fef8f0
MD5 b7767d0bcf907e0b7c79221cfb5120a6
SHA1 f2de091a71188cda3d41369a1153d5fde3b1065a
SHA512 ae04cbc9a3bf9ac63c0b3801044bf39906d43b1a00fd7f8f467f8968e4e7e5da56b709d95eec80924e7a5ba7fd2488d5c4d4ba06cb98208211037c12f8f9ef62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 80e3e6792bfd051b217f4daa57075c31ddc7a260e426f71e5a397c0c35497dc3
MD5 e6cf529916e77992b306815245076e78
SHA1 b2eae987aefbfaefe2612833b51a30f675fc447b
SHA512 967cdacbf24291b274cd7d8e7d8556e193e3be9e111ff6e29ea4e0a0a957447f8912ff13db44419a40060293bf073752ec755077f610b3d26179a172dc4dde15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\qap`g`v~dtlq
Size 10B
SHA256 dc83c5167a619259454344e76b4d995d489c9196931289b87471b4d9506e34cf
MD5 efb17a755524e8410a366009a2d0b010
SHA1 8d912c464fcd113da363620feb610fb024e8f7f0
SHA512 c55b447b1d2f332e4437278c05a8f3290750de506722c182ebad6dc12469bc35a42b02c9dc5d9c8cb675922b938afad385016c74a1d582150a7a1a40572f3435
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 535ac767078f8c6d9018e3840f90399be0ddec917729f6d19d4db4a703f41c92
MD5 b72a01130cd74b3b302909eec0d54c0b
SHA1 6630d7a1e36813221fc8a978c663af068dffc60b
SHA512 9751083a797651de8ec1410e28a9df548156fa58a1d46cc81711dfabed6b8582e0767b644d54607ed9105bef63fafdd41285e00e01cb9375179f49e00ca83f78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 065247fdbb595e9597ec1817931ec83210b91ff5ea1ecb1df09e575f4d009dc8
MD5 fb82bf50d15540d104a9fa13b7d2bb1d
SHA1 a1f0f3c4f81818cd7c0958214b57f5171523fa03
SHA512 30d6ad827668d6ef13b5cd7a3aa8dbd4e1c2e59ac000cb00f898277fcea28587964d8c59a351e89a207b461d9fee445e7ef900724dd5eea6a321f69a200618a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9eba1a45b0374b7752f06d9c5c9320c24ed7ef05b99ef0ccbe962b0b3656798
MD5 b0d8a63be7a948bb41b7ce5a5658c654
SHA1 2a54515675830cdc28bfd4d14f847de0c9dc9317
SHA512 a4a0a6e499a004afe07dd1a3a0aaaeebdb8d8aeea6320ba4d2f89640d36585262d4005b3c8fc32e1119fda99e6a7796bc2a73aa985a042f737de70cf7eec9fd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd7241479363558897296a4827cc312910a0f2b3ae0370be8ab58a58b5942596
MD5 1f5103f9261f56031746c45ee9007b36
SHA1 310bda0715ae90034b292bc21d6f2d3ec7e910b8
SHA512 d3987958bdd88453415ffb11a95726ad776d303cd174e778ed1f5339b4a644815fe1302590b7de8474c6c2193876b7f006ce5e791373d788a565ce594a950dfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5628bb33cc16b1954ba1bd44dfc01df1cb284080ce663a5b63b66e0eec22c479
MD5 d7f6b4db204f5003e72222036c549ba7
SHA1 ecf7b92f5bda686085e3b2fedb873228cd56ede0
SHA512 ec36a8ad652731b0b3ba36aa791dc37c0ff5d9e0ffbde0e080308f2a17c9ff04a35a19c7ddb56fb0c144728eff021c3c8b600367133f19d6e5a4600a3343212f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d739c7d0a344106b4b0678bfa4ed0cd7f098b498898771998a62dce42a271e4f
MD5 1ccff9923de15a8690109e57a1708c13
SHA1 4b6a084d815e0520eb4c64e773b553d8882270ab
SHA512 1ba115e59793940f83bffafc8b37325716456f9ccb510593f8e48d8d3f4bdd62eccb18dccecda43b9b0c78ca5f658dcca793aa247bc88df410aa03a2fbdeb691
MD5 SHA1 SHA512

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 16.7MB
SHA256 424cea4ef0b6fcad0f5ece9d788956ea22002de9bd497c7b4cb09bd77ca35068
MD5 b12a90ad7bcfbc4c87141499b95f7395
SHA1 f1d2d44272dd6b35daca137f82ec89a529d6cbf5
SHA512 d96ec1f3b46e4f9847131cacc76b8b0c01499103123a6ac9b68c7835a420abb8cf2e26e363dd8973e9e08fdfe8529fac0b5104e5ecb1cd35fc08c628a1916628
SSDEEP 49152:U+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+EL:TGGGGGGGG6GGGGGGGG6GGGGGGGGS0Ckk
TLSH
T1DF074A49FA4380B2D82B017148CBD3FB4B70B9254B129AABF789C73EAE337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 3.7MB
SHA256 26bee6ad735ffaa4c4f004f743648fc1e21f28275fb42161bf13448e906b2b3e
MD5 057de6f3bc4c721e5481afe1f55fc152
SHA1 396a1d534569226ce6f4d8de69688291784b38cc
SHA512 05c7558227a96c49a40db52c8567e1a7ff0286f1b555e44550f568d85423681593f0b79becc89f9187ab9017af00bdd192907125d483eeb46003baaf2dd2c849
SSDEEP 49152:U+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+EN:TGGGGGB
TLSH
T1B1064A49FA4380B2D82B017148CBD3FB4B70B9254B129AEBF789C73EAA337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 320KB
SHA256 c0a99b35c27d9baae4bbdd81029b746e24b7f445fcf66e5994cc5af78c3ed68d
MD5 a6ec5037dd022d79959d3dec5a7d8bfe
SHA1 fef77139127a2b9b3224688746b4182c38794cdf
SHA512 427db3838d45d650eae76aebf10232348f2d6dc531a111ea1e5449c8b66c3a5962ba5f47d1a4875025cbe0c2a60f7e60735f270437a50c56ebd6dcec3772c4f7
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdc+dTTUFgEs3XojAdP+dTTUFgEs3XQ:mgUFgEsnojA9gUFgEsnojAGgUFgEsno2
TLSH
T1E4641A09F94350B1DD2B50F04DCBE3BF8A60BB2582128DFBFB4DCB5BA923B616428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 43.7MB
SHA256 1424ef043a69fed21ebff4ffcc73df44cb668726f249f131adadb2a3c717e905
MD5 14a387e250afd7a62d9189279f9fb1e7
SHA1 ee2a27c129e3e1e25c25d55818bd583d4dcf0868
SHA512 307fdcf10b8b1ec1c226b726a6da201af5c1b31e849834a865487f83ff3e1677f0836528041efe387a3ab66175205bda700c2e5c7194be3e1e01a52d3ba78a2f
SSDEEP 98304:TGGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGGi:i
TLSH
T1A8A74A49FA4380B2D82B017148CBD3FB4B70B9254B129AABF789C73EAE337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 2.9MB
SHA256 e3bee95df9bf6863c2dcf5057e5ed15cb2c95f55a8c6c013e16862c4c27a6ecb
MD5 f5ac830ad8f9d27bc02953e90412ac46
SHA1 4fb352fe9a61193eb571a997b762ff1341772843
SHA512 47913ef27bbfc136ae4408980f1196d53937a933500f23d1c43297f929e5d587f1a30408916e45c3d2709a7adc46a700e36a67f92b3353215e3e2f7c32c67eec
SSDEEP 49152:U+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+E/:TGGGGS
TLSH
T1FDD55B49FA4380B2D82B017148CBD3FB4B70B9218B129AEBF789D73EAA337D06535555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisconnectPublish.exe

Path C:\Users\Admin\Downloads\DisconnectPublish.exe
Size 54.4MB
SHA256 9e508ac5bf4606a5a1167d1abb58790517cbe02fb758a5db4f088fb7a06e2f82
MD5 8aa21f02a3a7104279b903a7c2d5164a
SHA1 a97f4c48ec85b31cb2ff523699fc90017a0fe98f
SHA512 f774a59a113b0e16f8d2c58d5f018b41fe736d2dfc2d792d856fff051880bfded000e3b2c79469ab9372ec6ab324cf16b39843ea49ce32181f4081c0d388aca4
SSDEEP 98304:TGGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGG6GGGGGGGGO:O
TLSH
T1D6C74A49FA4380B2D82B017148CBD3FB4B70B9254B129AABF789C73EAE337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 622a7756fedaa9801b57cdd0619ceb96d74f3924b6ea06bfbbd7d14166c773dd
MD5 b1398a1c76a2d2c0d6ee648a18b1a33a
SHA1 5ff7be4d425682f7e9140de160de56c258eb2310
SHA512 c3f7567bd8a559993504c91a85f68b8456ae543a2b55392ab6fbf9f45210b3526b063db5a70e4fe129cdf49506615ba7619b98a669c0dbd71791bbf714dd53a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0f30a0c188f368c83360ca149a0c5212982e20da7d945bee35dafb6b0e71fde1
MD5 d69d6e5fb68b308db88389c546fb4ce0
SHA1 5248f5446bdeeb539fd655988365de6a673967af
SHA512 301bbd869069a30a5a5c1129527736709aaa78d6242c8095e92dec287a8dcb64e6b2db57e8797375ff7ae8f525504382a25cdf3d6211902b4a48c02a20ca8666
MD5 SHA1 SHA512

Submit Download

svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBAACAAAABCABCCCBACAACABAACACCBCBBBCCAAACCCACAABCACB.exe
Size 5.4MB
SHA256 9b1d489252e130994d34fd79c542e452e5280b42c1f49d786da984e50138d31d
MD5 0bd8473b3485efde317a69ee83047add
SHA1 9c4a4801ae80301a4d9c20011478c6d8f85c2776
SHA512 e404a780a9d29bf84abbbaca644f66313426debf1a4ce43ae99bb473e34ffd3d9db619856b1cf0022a0420fa60820a8a658fb0d7f8e776590017c4d496c2458f
SSDEEP 49152:U+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+ES+EyqatglG+ES+EV+EV:TGGGGGGGGM
TLSH
T145464A49FA4380B2D82B017148CBD3FB4B70B9254B129AABF789C73EAE337D06635555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d60683adb424bf77262a4fe6c39bf09cd6835c01fc9f70c016276ee6855c1389
MD5 a00c452280293f6172d7a654be20c785
SHA1 85ba39ad1ac7544227c7041c54b7a8c0d5cce5c5
SHA512 0db9856f16094fc86a6e946bd23ceeb4b1175c1c1649d0fcee12d527f457d10c757071c5302454a6557ade4fd9f47a5a3d2a28846515af1b08dc3ff98f312d1d
TLSH
T17E213B65F0F9C877F533288F4219EA425CE8365E9CACEE492308D218BBD4C319E458E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bbe1f11d640d1848ff19332290184205e57c3c98617438aba07c9d218dc82456
MD5 248531099d572ed2bb2429c3a06f9c54
SHA1 e7c4d065fda0cdba153b6041909c2b4609b85097
SHA512 168e8917f4c5946fa5af20b7bb12b1b220fde62a5ad8251e4d5fd3633e01cb60b536798d5a49c2aa95af235cfac83f7e0d18d272dd753a07a47bac26e1eec1b9
TLSH
T132213525E0F4C8B3F53328CF4219EA825CE8369F9C9CAA491309A218BBD4C319E458E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c47d505761c3775dc7dc86aca1f1a6456621db587a75fedc23010a6bd18cf389
MD5 e49956662a7330b8c6b3e3b0da6add37
SHA1 16746fa56ef2e204fbf39d78cdacf16748a7282e
SHA512 386f99c1bb12e7763a9554be811e2402b4a272b4d3eed475df0086b65324504ba3945592f166f97ea4e1fa760dd36d42b2183466b48b16289f78bd5b7519f4b2
TLSH
T188112B65E0F9C477F533288B4219EA425CE4368E9CACAA492308D318BBD4C319E558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-92-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/296-68-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/296-46-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1052-3204-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1052-3980-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/1896-21-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/1896-47-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/1896-69-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/1896-10-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/1896-93-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/3972-83-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3972-3978-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download