4151420cbe1604150ee7fd12fc113e8706188426f38054553a430c0fabd8fd6a

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
Size 2.0MB
Sample260904-2g62daar2w
SHA256 4151420cbe1604150ee7fd12fc113e8706188426f38054553a430c0fabd8fd6a
MD5 c149fe946fe06108199c7d7cac3ad9ac
SHA1 d8236bc2bbfa5fd2c58d830598474bc09396d8b7
SHA512 e3cd50547f671c0cc7ecb610ebca673db128b73d84e7497ca131f6326c43ee16809e2f1906d2f091bce95d1f6813aecde50d4f527f812bcbfecad4527fb0aa61
SSDEEP 49152:U+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOsAoc:Y50l350D
TLSH
T156A53A59B7EA5151F5B346708CAAC2F6AE317C204F2187EF6640F32D1E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
5440	svchost_ABCCCAACABCAAAACBCCBCBAACAABCBBABAABBAABCBCBBBCCCCCCABB.exe
4976	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACABABAACABBBBABAABAACBCABCACABBACCABCACCACCBBCBCAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe"	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBACCCCBCBBAAAACBBBCACCABCBBBCBAAAAABBACAACBBAABACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCAACABCAAAACBCCBCBAACAABCBBABAABBAABCBCBBBCCCCCCABB.exe"	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2940	sc.exe
4780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4104	cmd.exe
400	cmd.exe
6100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCAACABCAAAACBCCBCBAACAABCBBABAABBAABCBCBBBCCCCCCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
4976	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
4976	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
Token: SeDebugPrivilege	4976	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 400	2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe	91
PID 400 wrote to memory of 3052	400	cmd.exe	93
PID 4460 wrote to memory of 1592	4460	svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe	94
PID 2728 wrote to memory of 6100	2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe	97
PID 6100 wrote to memory of 2940	6100	cmd.exe	99
PID 2728 wrote to memory of 4104	2728	2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe	100
PID 4104 wrote to memory of 4780	4104	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_c149fe946fe06108199c7d7cac3ad9ac_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBCBABABBBCACBBBCBCBCCBBCCAABCACACBCAABBCBABCCCACACCBBCCABBBACCBBAAABACCBBAABBBACBCBBBAAACAAACCABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBCBABABBBCACBBBCBCBCCBBCCAABCACACBCAABBCBABCCCACACCBBCCABBBACCBBAAABACCBBAABBBACBCBBBAAACAAACCABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe" start= auto displayName= "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe" start= auto displayName= "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCBABBCBBABCBAACAAAABBBABACABAABBCAABCACCCACAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAACABCAAAACBCCBCBAACAABCBBABAABBAABCBCBBBCCCCCCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCAACABCAAAACBCCBCBAACAABCBBABAABBAABCBCBBBCCCCCCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f7df60f9b24026ed6409e062a5e1e56db47a3b02aafa151349595700cbb137da
MD5 fc07c8e9b61fb749ef0bd11a847042ce
SHA1 0ec76d8d693cd838fdc8f8987fd87b1cd785d6db
SHA512 ce91567c16db00124bd889e76b0febed7bb562083d8b35cc4c2162152ad575cf12c72540a82a71bcd17f0b0f964f9a8d9fa5cdc91c7763d4322fe01eeccc7ce7
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.6MB
SHA256 d73e3af10dfc34c6c8eb06f235a7f1da0f590f30d55c9b2ae93eafae4b24d54e
MD5 81a70807ac0873c89939fdf41fa98f30
SHA1 a970bb49c638b8099a1ff915dcaeb8234364dc09
SHA512 d1b0746149674b8343e901bff34eb6d8be97663f9240b2267b4353117d22ab4e1009d4e5757f9838cae44d512812de87210e256f4b555372768c8c9fdf8ef607
SSDEEP 49152:U+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOsAo7gZ2HbbZt+jqpQ0T:Y50l350GgZ2Hb9t+2xd
TLSH
T14ED57D19B7E51161F6B346718CA9C2B66D31BD204F20C7EFA680F72D2E325D0D93AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 870b9fa41320bbd9d3bb98681b3d2ca8704decac2d7f4765912da950eb8df160
MD5 f82bc43a56829330781594e6e9e06ac2
SHA1 34e56cdf359e84f82ff9fd19356acf47df0ee767
SHA512 ae183d794cc0390bb71e0dd58ad7fbfdaeca6eba912754bc920b0dd77fbd96a07fe712a2a840792dc02ef8aad9a1e9883f509c76b6325c7a6685d600140ba771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\0000950C\qap`g`v~dtlq
Size 10B
SHA256 f4d79b2dd4aece33a92d3b80f736db77129debf099d823df55d4206b84eb78db
MD5 83ddba2df4213371ca9f805ab9244f7f
SHA1 b210e57cf61872dca7a9840f6de401adf468492e
SHA512 2ff6039c79560f01ecf772056dbe01334a8f2a694788403d26dcee1a1b0998dcb28633cae34aaa99f39d625ba9062da2e4fb056e796ac2bd5d544bac5057fceb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 632630a008731b666f9b8f2fc884234e8581b6646cf26b15baa32cd9c5845099
MD5 4a9d14dd87d26991c807ee5fc7a527f9
SHA1 1a3fec91cd025eafe5b4980a8ab2e086a807e1e1
SHA512 4ec7d46b03ba5e1d9311f0509b6046ac7187a00d394666ec40cda135c39e87c0a32d70e29465a80f37f13f4c6f689c379c9664a5ee7bcf0c8b2fb180ff7db378
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 36992811688e68248a794195b46db6f26edcacb0dd11fa82cee4c5182e40f57f
MD5 bfdb7c1603f00945c85b855fa290012b
SHA1 b7c9ebb8640477ded496fbd3f152b108143a0b0c
SHA512 df2498612872ffad493018a8409dddf8be13065f3d589ef4f1c568f2ac95b9af54a9324863935cf50a5e401066bcb9fd8140700a122e1239725b1a81b8bc2e05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 763e7d50a57e25733325beed449263fa3d823386372d23dbcaf3244228e59a19
MD5 4603d347fe67cb26ecbfa5ffb6f78541
SHA1 09e1170cd370350b6b485e172e7b1872d379fa1b
SHA512 5240d28fd75d687bdde908e591d4fc2c0e37fe22d97fa9de4723257c1f0339d8ed5376f4140907315ab9bb29c3b940feb128890e56c74d74e355ab23ae0c7542
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d820830dbf8543d0b92ac95d97393d8cdc43be8708ac1fb2685c9837ff13098
MD5 ba0b14ba7fa04b2cfe7d7f7be61242fd
SHA1 978b3e161143403475aaafe61f98d4c50aa84843
SHA512 7a1d51039742ee9dab5ba9379bddf9b7e3a33ff729e78cfae8d6a828558964312e9881822025f0a610933ab791d0fd8e7aa59da136bb83abd1ecda8ebe7f8477
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5f79ff16debbdb19f331c291abee78310d5970d5abf9259e6f39d5c649d3b82
MD5 77b2d066d53feadf5c5a2acc1a0ba009
SHA1 a063a9823c394df8afcbe5d5a638c936c26e8c50
SHA512 9c5b869271d7f7f682ed5f8565ec534ddf608140dd0c8d2734e36c165f98448a84aea878dbdf678566555202cd748c695fd188020475b079e7a2b1f47e20a76a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d2680906b2cec4163c1a014cc97c2c6f12e1c96779058202a80123b4a9403f7
MD5 2d2c9dd20e0090c134136f3ebe860142
SHA1 948bd0d63466409f6532b708c513d5f95a20e00b
SHA512 112fc604c5163bc5187a2724c6bc8f635140a5350240a4fc4389b033ddb44eddeb4574e42f7f678440078d6bf3b01b8aaa6416732f6f599a600b8cc8670b9a8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bd2fce6534974d142c303667bd00a850ebe1eac5055d99a45f916cfbe9396c3
MD5 a58ab124c7476a76611c68593198e119
SHA1 6599633383224feaf54686ef0fff962e47eab402
SHA512 1f276218f00832e9d9eaa74dca943b4003f38e4b8458147aa8204e744b9646b2c8b72d66e2cda998be47829f20a5ff5b0723df2fea8b0029904c966836cebde4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7e968f2d801448b28a6ec7a03154a3178254bb7da6a1d2a5036f4fad8fc80a80
MD5 5fe9796b18cbc3a49c9a15a09d7d716d
SHA1 21a0cb36a0fed45c3aa1fc6bf38315cba9858638
SHA512 1d14c9bd25edffe4f14d4d7d214823f5efb4b0ebf5280ffa2562f8e62bd3b442f1660678a9f3a065a365f197ff56631b4bb539badc4ee5883a596725e6962b8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\qap`g`v~dtlq
Size 10B
SHA256 e2cbccca659aae0ed283369069d0ff87bdafb89c929a513a61fa2b355dfd05f1
MD5 db3def4092cb39b48850cbd820a2b7e6
SHA1 1a789c38bf3ef9b5ffb043b761d4b6a7f27745d7
SHA512 fd745ecd862c9d8a02ed4d5d9c118f2d437f2a5f76d036f47f45852f34a6aa65f79bcbf93afe8d4d6745d8b9a8e18a1425c630de46e8736a5d5fa9afdf518997
MD5 SHA1 SHA512

Submit Download

svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACAAAAAABCACCABCCACCACCAABBBABBCCCBAAAABCAABCBCBBACA.exe
Size 2.0MB
SHA256 4151420cbe1604150ee7fd12fc113e8706188426f38054553a430c0fabd8fd6a
MD5 c149fe946fe06108199c7d7cac3ad9ac
SHA1 d8236bc2bbfa5fd2c58d830598474bc09396d8b7
SHA512 e3cd50547f671c0cc7ecb610ebca673db128b73d84e7497ca131f6326c43ee16809e2f1906d2f091bce95d1f6813aecde50d4f527f812bcbfecad4527fb0aa61
SSDEEP 49152:U+EeC5g+E3qatgl+p+Ex+E3qatgl+p+EeC5g+E3qatglOsAoc:Y50l350D
TLSH
T156A53A59B7EA5151F5B346708CAAC2F6AE317C204F2187EF6640F32D1E326D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 eab2550d116adfcd8a016c70cf79a9fdfe78d283f950124bc85023b06a69e0b6
MD5 cecab7c4bf38617a04f6ce3d52cf7178
SHA1 c783dd46c9e1d0fb6a94b168b0eb1d374918946d
SHA512 5a962e5d1f2416bc8336e3bee3a1bedbb74b4be70f187d685ad5a76c42bd128bef1b74cfaed4de2ce96fb557ccc5d1d5c0a7ccf6994bdfd02201ef9d395f5372
TLSH
T1C511D321E0B5DC73F22328979329CBD70CF57BEBA898EB0823485118BB5587A8D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2728-0-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/2728-7-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/4460-33-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4976-2771-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5440-64-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download