1ae8b5befa1af3577fbcb1019db247e0ed3e29c10b655325a4ff338a0ebe6d34

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
Size 10.4MB
Sample260905-vcmcvaydph
SHA256 1ae8b5befa1af3577fbcb1019db247e0ed3e29c10b655325a4ff338a0ebe6d34
MD5 1eec6d5957b4d940eb4f30bdc3a63c2d
SHA1 390f72e1fa4cc7437209afa3b7962cbf6fa437bd
SHA512 a5e2a61f41547cf3b668db903d06ba0fedd7de94e8fe4ad0697f0c76bffb9f12542d925b6a35d956e1cec80cc1361c45a6dbdf488031ba177cdc594b55649bcf
SSDEEP 49152:U+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+EKqatglS+Es+ES+EzD+Es+ED:mMMMMMR
TLSH
T1DBB62A09F98740B1E82B01B04CDBD3BF8A70BA258B128EFBF74D875FA933B915524655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
2920	svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
2968	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABAACCABBCCBCCBABCCBAABAAAAACBCABCCABBBBAAAABAABBBBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe"	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABBBCCBBCCACBBBBACAABCBBBCBCBABBCBACAACCBCCCBBBABBBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe"	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2136	sc.exe
2400	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
456	cmd.exe
1204	cmd.exe
4536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
2920	svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
2920	svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
2968	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
2968	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
Token: SeDebugPrivilege	2920	svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
Token: SeDebugPrivilege	2968	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 456	312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe	97
PID 456 wrote to memory of 4136	456	cmd.exe	99
PID 4624 wrote to memory of 4160	4624	svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe	107
PID 4160 wrote to memory of 4332	4160	notepad.exe	108
PID 312 wrote to memory of 1204	312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe	113
PID 1204 wrote to memory of 2136	1204	cmd.exe	115
PID 312 wrote to memory of 4536	312	2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe	116
PID 4536 wrote to memory of 2400	4536	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1eec6d5957b4d940eb4f30bdc3a63c2d_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCCBAABBACCBBACAAACBACAAACABABBCCBAABCBBCBCACCACCBABBBBAAAABCCABABBBBBCCCCABCCCCCACCBACBBCAABCABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCCBAABBACCBBACAAACBACAAACABABBCCBAABCBBCBCACCACCBABBBBAAAABCCABABBBBBCCCCABCCCCCACCBACBBCAABCABCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe" start= auto displayName= "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe" start= auto displayName= "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBABABBCBBABAACCCCBABAABBAAAABABCBBAABCBCCAABACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCAABCBBAABABACCBAACBBCCCBBABCCABACABBCACACACBABAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d47504fc1a68c56fe9beee3e75e3df64cfc0289f6ad5db02111ba1827e8f400e
MD5 db6d4b00049cf37ffa665adf8aca4251
SHA1 17f355364006260da5aed620d33bfadd4685d381
SHA512 2f67ad63ad1b4d11e4bd940d56e5085b54be3151f26e01b0cd10c8c43af045ad6b577e9e6c9107c3f4edaa0eccd6aee7041b7c3fad3d8ef9006e9c750a90d1c0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.9MB
SHA256 091c9b7c3c593aec6f2f2f2a7b65d6b9d890f6d6fdabd38a71ba8c42001fc0d6
MD5 d3f1396e0a5be9ce19bcbb1b22a1ee1f
SHA1 e59edda70ceb7ce562ff93ba46f8b82ec46a3b75
SHA512 e3c0a17719d8784646ac35180fd4ff781aa64b6b8260a623218bcefe8066df81821307dc0f9bb4ace81d9e9d016e8fa548161221632dd11a223ab1c827c118f6
SSDEEP 49152:U+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+EKqatglS+Es+ES+EzD+Es+Eb:mMMMMMOpi5
TLSH
T19FB62B05F98740B1E82B01B04CDBD3BF8A70BA258B128EEBF74D875FA933B919534655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 4fa19fea32c361812bce47a7cec590b9f01b1bef30c33d45fb433d0b7e989c27
MD5 fdf71502d63bb0ac36ee06c7fe0118d3
SHA1 ac51fc21b2c90cdc4ee3ef1ff27ff3f77f8e7752
SHA512 c4c414ce8dd0a25bbaa80236964af1f06932f7593708d83b0f20bd8646a84b02c902b9fec4256ce0cbe99acfb6c33f546dcab450d1e7a99b536a9a39fb107f85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 73d21c855627a0febac0fc327893c5ec474705ec8fa14baada583efb8e0e3314
MD5 ada3fff165420fca5c50e12f6acfb5ce
SHA1 43c22ace03cb22d70e002f4321055c331a1a2991
SHA512 7338ef9438da73f4ee83f65b7496a08279389cd9437a4ee0470f301855defc33d523d42938f1b0a5b7ffa0afae3ab616e8339a816263085383cf5baf8c077603
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 09a961fc3b58414ba534bbbbd12e81e90f93c163c78aecb41f723adae0b7b0eb
MD5 ab6c4fa4180199970d1c0c8482cfc0eb
SHA1 656811220ddcaaa97878f4f3236f7477fdfdce55
SHA512 ae610eab34814a19b5b6969db97c778d409a140c2d3fb9528f914417205be86fca16e3deba98b7886f8ff1ba640f6f8b42b939aebe42c67cd8afc1c57271fd69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 7e3206a5f9072d711e6556b9a814cb647dd894d839cfa7cf3cd82b70e9cd74cc
MD5 ad3d3ec2396b719c842885903f3af22d
SHA1 e082d6068c6d16661f7464539424baae5d21243d
SHA512 192a991d3eeeb1db91b24707089623fb2e5cae7b0e54d0e0e36e522f2028f049310a05e8394ff649e2d4aec9d94028620770513975544050b90ef79792547b3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCD4E7F.tmp\qap`g`v~dtlq
Size 10B
SHA256 fcb77696461b7b379cb067ab803c7164c01fac58cf39c53d075df3dbdb413011
MD5 827975206d7c8c3188bf813e2e863741
SHA1 2b3ef5d02d5fd41d43280da5da290c1b262766a5
SHA512 e14d9a37eda65f7b83214ce85cd124855bcdd28a2a415cf154b3ba41b7a3cc9aada30c9fcff9d707352637cc030177b8e83f67e347941943b4f27914d7e523d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b4f0d27238d3e1ddd7db25a9f6dfeab399188bddbbd744b4d196e562ef48435
MD5 d9e3b2abcca004b088951019302a611e
SHA1 0f41cd475a9ff4ba292cc9ac8c4c337993e9200e
SHA512 2fbee89cc5dd7f3b8efd6bb0bf624b1feb412bc216745a4c84d4dc9ccdb6fbfdb98ef8fd4c8eb3dc38eedf80ad80a4e76bb31c7fc4a32a7dc8bcffb6c237bae6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e8428f5e2a49c5623c81957fbb2e373cc38af3ba66b89209c1a07b89aee1000
MD5 64e4de79891525240089878b87a3ab0a
SHA1 e7324fd92a2d254ff6bb46fa34c9996d03fe3f7c
SHA512 104a119429eaa203c07d41e3ee21b3cb3d2dba9b79e5b9c2f89eb6cd8d378aca0323eb10e17ee238013771a5a0a72b85db99099170876489314ddc6a8cc16fea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ab02ece2c60c8d9346b725eecc32dfcbc207d446d32a5fc9d9a06099a3e3471e
MD5 d0a4d5dfbd4f939c14d50d8dec2ecc38
SHA1 2404a4fc30455802647fb6055a5a9bc329432ce1
SHA512 dc09c234dc2a1208f18e5a91e864e75148e4a19b203fd9d6e5bf0c3008a6907e690b55dd91a392b72142d8e6dd654db302642bd6aeb589dda9a9c97d05f6a4b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4a74245008232a522da513925b12cbc55842768422ce8a75e09fbae7279e20ac
MD5 4c16cb0c0092b6e01310381e8900d4e5
SHA1 d8c02f63a28a306b41ca3032deba60617ef6f69e
SHA512 29f52cafa9b90d2ea765e837a42af181223aff08d551955e0323a76a673bfaaaf0ec10c7be363075e0f6d9a51429784731b97e5edd761868072c2151809b98d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c140cead79a81af0318efb0f29fe2b8530ff773f9d7050f0c69f6730c9f0167e
MD5 75f3bf1c10597b40d92f6bfd1e696d70
SHA1 10fbcf8c30c080230f93105cb254c9cde43a2f45
SHA512 6957e700dc47f74cb899ccc99433363ab03580197e13fd0e36121cb63fa6864a56005fb1f50898c588e288cf1efd69e8e48ce0ff9fc73f5086d0f76b208f58e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 54367e875109bc3e8c2dedbe0b23992feecf7d26c75c0f2448a0e3f0b40c3b4b
MD5 a7f355713e63e988849375c3bcb47ffa
SHA1 290df76253f0e9cf83fc37269f7f19b58c15d5a2
SHA512 0b1bd114683c1a849975a509e47cca9c309e9eb18da5b6ade214450af844ed1fbb6b3dac3c268885b87bf7807f8d209b908e4597989fd134337edcc238bd3736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\qap`g`v~dtlq
Size 10B
SHA256 25506890ca8233d08da5e6da76b871f4c2877370694a6441a570cf88a0aeb453
MD5 b2816d3190f8a7991f1e7ad3ff1381d0
SHA1 65598a29fccf3dd77c65119d6565d573c497268a
SHA512 0cda80bdc036c96f4db4121d668159e407284993fd3806bee55a641aca5abaa1c371a258b9308450382c63c3713ecb6847977d843528a6d67dc9e9503fcfdae9
MD5 SHA1 SHA512

Submit Download

svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBCABCABBBCAAAABBBBABCCBBCCCBBCBCCBACBCCCBBCBBACCC.exe
Size 10.4MB
SHA256 1ae8b5befa1af3577fbcb1019db247e0ed3e29c10b655325a4ff338a0ebe6d34
MD5 1eec6d5957b4d940eb4f30bdc3a63c2d
SHA1 390f72e1fa4cc7437209afa3b7962cbf6fa437bd
SHA512 a5e2a61f41547cf3b668db903d06ba0fedd7de94e8fe4ad0697f0c76bffb9f12542d925b6a35d956e1cec80cc1361c45a6dbdf488031ba177cdc594b55649bcf
SSDEEP 49152:U+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+EKqatglS+Es+ES+EzD+Es+ED:mMMMMMR
TLSH
T1DBB62A09F98740B1E82B01B04CDBD3BF8A70BA258B128EFBF74D875FA933B915524655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 28862014702cb6521c10b27c0ec065eb45db713d37772714c5bcd4310a306f35
MD5 f9c0b93d5af77ca666618791d5eac7a4
SHA1 0b76df8b097f63610e0de1ff3ed960984d4d7319
SHA512 a0e06d2004c91538368e8ab2a510755da24bd338ffff7ce5898d4d62c969e3ae4d5cab0545835559f24fe3f8d0f43f15ff552d61df34f93a3dacaa70a1d19fcc
TLSH
T13A110D52B0E5D4D3E03064C79525EF9709D83BBF5C6CAF282309421C6B59C36DD158E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 42391c7bc3472c3e056c849c22a22d743ec5937dff9e3074e0bc73b2c2961f06
MD5 115c36efcf76a8cd0e5d61cf87ded0d7
SHA1 63ab0eaf0426ff6ed1c95cecb8f0a552ffe53186
SHA512 b9f36362fd984a17d9cfef3aa93dad61ac395f96cb9353803459d604a98bff79aef65d9943c0696d18a3128a2caa50fd11fc422ad60776623345c81a4b0bcc2f
TLSH
T11E210B52B0E5D893E03064C79521EB9709D83BBF5C6CAF282309411C6759C37DD158E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/312-0-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/312-7-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/2920-2287-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/2920-77-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/2968-1407-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4160-58-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

memory/4624-36-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4624-26-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download