e6c5ad496bbfc3dd2cd87885b604db399b34a6c82e37dcb8594f3091e30896cc

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
Size 942KB
Sample260831-kmeewafq21
SHA256 e6c5ad496bbfc3dd2cd87885b604db399b34a6c82e37dcb8594f3091e30896cc
MD5 8788637edd4ec3fac0f0990dc6c4c670
SHA1 56fcaa9277ba482467c4d5b034b28f46b0e146cb
SHA512 23ed47722b34a30d305ed6489d0056553fa4e4258e0a66ca66f870a039c465f1ff8e94853a5d54dd5b04f2e7e8574d9513b4215dd6d6d8edff3d4df2b4306c9c
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM05Exqatgl8bp:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+ECqatglS
TLSH
T15C254B4AF94780B2D92B01B00CCBD3FF8B70BA2589128E6BFB4DC76FA9337906515655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
2092	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
1212	svchost_BACABABACBCACAAAABCAABBCCCBBBCABCCCBCABCCACCBBCBACACACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBCAABBAACACBCCBAACBBBABBABCCBBACACAACBABCAABBCCACAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe"	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBBCCCCACACAABACACCBACBBBCCBBACCABBAAABBCBCACABBCAABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABABACBCACAAAABCAABBCCCBBBCABCCCBCABCCACCBBCBACACACC.exe"	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3012	sc.exe
5036	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3788	cmd.exe
4104	cmd.exe
2220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABABACBCACAAAABCAABBCCCBBBCABCCCBCABCCACCBBCBACACACC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
2092	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
2092	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
Token: SeDebugPrivilege	2092	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3788	4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe	101
PID 3788 wrote to memory of 4944	3788	cmd.exe	103
PID 4692 wrote to memory of 804	4692	svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe	104
PID 804 wrote to memory of 456	804	notepad.exe	105
PID 4168 wrote to memory of 4104	4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe	107
PID 4104 wrote to memory of 3012	4104	cmd.exe	109
PID 4168 wrote to memory of 2220	4168	2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe	110
PID 2220 wrote to memory of 5036	2220	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_8788637edd4ec3fac0f0990dc6c4c670_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBABACBCCCBBABCAACBAACCABBAAAAACAACAACBCBBABABAABBACBABAACACAABBCABBCBCBCBAABBBCCBCBCCBCABCABABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABBABACBCCCBBABCAACBAACCABBAAAAACAACAACBCBBABABAABBACBABAACACAABBCABBCBCBCBAABBBCCBCBCCBCABCABABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe" start= auto displayName= "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe" start= auto displayName= "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAABBBBACBCCACBCABBAAABBCABCCBBBCCCBACCACABCAACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABABACBCACAAAABCAABBCCCBBBCABCCCBCABCCACCBBCBACACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABABACBCACAAAABCAABBCCCBBBCABCCCBCABCCACCBBCBACACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9f6844bfc9a063add80f94d7ed4aef331d13a517f5bf4eec6a674b8e4f85620b
MD5 6185b40860765afd47d5de82d04edb84
SHA1 7cff3b9c62aefc0e15f996972dadd6e909b5076d
SHA512 da49e0f1a37483ad12453abdd8ed24b3f6409e137addaf83c43181c00a5c06fd11d5febcd6e3427aa73aee4f5a92e8ff0447ae5a2c1732c9e88c5bc9835d2171
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.4MB
SHA256 9ecec7933e698f032103b3439d30cb4968422c376dd67cf2d0f04d0bd616be19
MD5 d0fd8f3d621e09e6a707204a27f6f09e
SHA1 dc5656b62e59fcca64bfc5e0c753eae6a35b2cb3
SHA512 fa4bfbecbd8be15af775a9d9c25c34e7d449104cf2fc47e5c179d8005e4677c5dc44488bd8eff532734397ffc48f544f230ac47a9ca74f9ea41468cc980e078c
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM05Exqatgl8bS3npi9:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+ECqatglNi
TLSH
T123656B06FAC68072E57702704DEBD3BB4A71BD218D32CA5FF788871E6D32790A525762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\qap`g`v~dtlq
Size 10B
SHA256 c3fec7e63e1b27a2972cc3bdf22d2cee13d97c85d2b5e2e7043c27f747c23226
MD5 f8e086a925de4f828fe3067d33e9bacd
SHA1 532555a94b291b2c69ebea42b31e814fc66ef16e
SHA512 373e71536bc23c5730c43506305360ecaa631d93e6608126fc4aa56ea2bd94af7ffaa55fb6c5e02fbb68ab930e1681d15c6029f5c99cb45646dc05350873d264
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 4027c4d94f7f3c40d4795b6fb9768c1f865b39fb8979154eb216ca899bd842bd
MD5 ad41d81d5db6b47959471a3ad13be8ca
SHA1 e826b01b47fde5cd5939b7a9aaa61151dc1adb0c
SHA512 9d9c4313c0dfeac0771295bfecbdfef4ce5d699bf8b04b827dda035d47c3e7c9a5f978a2caee4d13c140f54f4d4765117c1809ce1207c863aa78ef8e478b81e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 32d5332ab6294c3c8c38df98bf54d0d16b1edaae204ac715c75b63b6889a31c5
MD5 5acaa8f26f9563ac4ce83914a2895cb3
SHA1 cc3f6b2fa7d06e78e3113736b894ad966b3239db
SHA512 24e604c6eace69d55b66dbe06d7165e2481efd1847eec410e50d7b174a999269b7a91e87e234b3389ea7643621d0c121a49e996b42fd4ea9da686cf70149ee8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 c0f2a7d9124085fbe7f5ec2241e61c5f94f389c259ddb925c77d01dc5908b41e
MD5 63bb1f6a3607f9cd0b4c12ac8186a37b
SHA1 3e9ac59a646abc6b917f5daa2ed74a9c7e53d958
SHA512 90312ebb3082087592a8c2f58d891acb0e20b534c8365e5b3ba32d561409bc6f47a5b9c948e8c15a6ad8e8c2d5445a59d258aa86b8d6b12bcd8982c2a349ccb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6cae784104187b1023e73f52491861b7d6a65059b7ab39517a834885f1f1cb4c
MD5 95caa5b839b58b707962930a6d6d9f33
SHA1 291a379bf75b1eb8db82983e3ed52cb4db67969b
SHA512 0b67990f772bf9a800a0be838ffffcafede4470ff2f799519eee89e01005bcdb9a1b40ad075652f8547ff58fddc741e087140e271944262f1a05ad3943220f0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b69eda420a4caa40b36f2e6d00737ca16207b3c597a0d461920b799044184e86
MD5 8c49c7da7892a1c890b31c55dffbc12f
SHA1 5adbc16a37a3dd262281eabb6f81ae19f09bfb54
SHA512 23cdcd61f8ce9a2f90cc666698ad17948a01a415e769b7c4b1a9522c61ec0210c180d587fe33d06e3d90a81a54f880e90cd07ecf85c0faad36b0676b29510c8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9d5fe9dde4f9877e13277bc1b1311faffe9fe9df9ebbaf4c96850c78fe815d2
MD5 bb21b1dac43216e3e925f4fde60189e4
SHA1 0c9276cadbea363832c4bc658fc57665c97d1b71
SHA512 71eda072ce4b19ef05d8e1f831de098c3803faa3d52855850b0b894665f0e653409895ee6db51751b9d1b365fc0cd36e1d540fee4d8fad90cf82108a6dd5d6b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 292c34d3f5b50d29f613c90d03e7afe01f6722b96d41d63a9dcc10ebf8ed3df9
MD5 a6bda4c2ad230f240f14a7361beb8288
SHA1 7ef1f168ef537efb796856def0d548a216208411
SHA512 9468364c14d74f84c652465ce1934465a7041f27c3cfd4d7a79594e9df19573687ccead67d13906c391c570bd151e5fb765fcb24217700161cf7c4ca6f2f0606
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 005cf48d94ea48f489b90aee8e9785f5c62ff45a35d89ea4971c2915afc04a05
MD5 cee60b24ea5255b5ea5fa8593001088e
SHA1 76e8c0e4bea8350607c9e964d574d571c7350225
SHA512 71b29633d24e8c5f60a8899946330bc31310ec43cdc681610f71007fab13cff59b3823187e3d0079229cee2a504a58badb511e97f0326da6abe1bf8127164340
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCCCBBAAAACACACCCCCCBBCABCACBAAAACABCACCCCBBCBCBB.exe
Size 942KB
SHA256 e6c5ad496bbfc3dd2cd87885b604db399b34a6c82e37dcb8594f3091e30896cc
MD5 8788637edd4ec3fac0f0990dc6c4c670
SHA1 56fcaa9277ba482467c4d5b034b28f46b0e146cb
SHA512 23ed47722b34a30d305ed6489d0056553fa4e4258e0a66ca66f870a039c465f1ff8e94853a5d54dd5b04f2e7e8574d9513b4215dd6d6d8edff3d4df2b4306c9c
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM05Exqatgl8bp:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+ECqatglS
TLSH
T15C254B4AF94780B2D92B01B00CCBD3FF8B70BA2589128E6BFB4DC76FA9337906515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0b7bc0c59a62b4f729b6064a0b600fd77ba0b6b4b047ec38f27f666c011b4292
MD5 7cda10d1100967ad2e150a986fe247bf
SHA1 f0a7cdc77a9a7c7f2f7f74bbde9ce0b566b9bfb8
SHA512 45f2ea597cf0735fc7498b07b7d6a8e23a530c68a7dc7b0d92c53ecb45e019b6739a96f8bcf6e1860e3c89b2220e3134ee3672fa77f7613f77ded182d049b415
TLSH
T11E11C260E0F5DC57E63368DECA35EF970CE03B9BAC586E24231846196B85863CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-59-0x00000000058E0000-0x00000000058E1000-memory.dmp

Download

memory/1212-79-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/2092-1152-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/2092-74-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/4168-6-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4692-38-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/4692-25-0x0000000000640000-0x0000000000661000-memory.dmp

Download