302795ac9fc302cb3d313cc4d8e7341a25977577b97f5991e5f94fedc092b7ca

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
Size 13.6MB
Sample260908-3dryqaaa49
SHA256 302795ac9fc302cb3d313cc4d8e7341a25977577b97f5991e5f94fedc092b7ca
MD5 6f54244f0c5d91ef2ad9ea3032ec0743
SHA1 37a8da93c4a8138ddfe803c5d29085db09dabf18
SHA512 7ae1d2ed76673618f465fa2effde326971ad70b246cb1b06b188df167a2082a5926f8e8a62dd6f2d25ebb651725cac6cf0c14654a6b9f82596cab8a6bcfc481e
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E7:n55555555l
TLSH
T1C0E63B05FA86C4A2D96601704C9B83FA6670BD118F029BEBB7C8B37F5E337D06635658
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
468	svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
3428	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCABABCAAACABBBBCBCBBBACBCBCABCCBBBCCBABBBBCCBBCAABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe"	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACCCCAAABBBCBAAABBCBBCABABBAACCACCABBBABBBBCCBAAACBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe"	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2268	sc.exe
1064	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3912	cmd.exe
3304	cmd.exe
4976	cmd.exe
3252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2900	schtasks.exe
372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
468	svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
468	svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
3428	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
3428	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
Token: SeDebugPrivilege	468	svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
Token: SeDebugPrivilege	3428	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3912	2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe	95
PID 3912 wrote to memory of 2900	3912	cmd.exe	97
PID 2464 wrote to memory of 1228	2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe	100
PID 1228 wrote to memory of 1784	1228	notepad.exe	101
PID 2228 wrote to memory of 3304	2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe	105
PID 3304 wrote to memory of 2268	3304	cmd.exe	107
PID 2228 wrote to memory of 4976	2228	2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe	108
PID 4976 wrote to memory of 1064	4976	cmd.exe	110
PID 2464 wrote to memory of 3252	2464	svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe	113
PID 3252 wrote to memory of 372	3252	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6f54244f0c5d91ef2ad9ea3032ec0743_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACCBBBBABCBCBCABBBACBACBAAAABBCACCBCCBAACBCCAACBAAABCBCACCABBACCBBABBABCBCACACBBBBBCBCBBBABCABCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACCBBBBABCBCBCABBBACBACBAAAABBCACCBCCBAACBCCAACBAAABCBCACCABBACCBBABBABCBCACACBBBBBCBCBBBABCABCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe" start= auto displayName= "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe" start= auto displayName= "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACBCAACBAABCACACACACBCBAAABAABABBBBACCCAAACBABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCABBBBCAABBABCCAABABBBBBBACCCCAAABCABCCBCACCAACACABBABCABABABCBBBAACBACACCBCCCACCACBCCACCCBCABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAABCABBBBCAABBABCCAABABBBBBBACCCCAAABCABCCBCACCAACACABBABCABABABCBBBAACBACACCBCCCACCACBCCACCCBCABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCABABAAABCAACBBBBBABCCBCCCBCBAACBACCAACACCAACABAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a69d9d438b290b6eefa703e807cfc78e5ccc1e808f1c6dda5dffca63431f1af4
MD5 76504147d4b2ea2a69fb0ba4950d00d3
SHA1 1ef5fcfab2ccbe0a67472c3068670ab887bd94b8
SHA512 95f46b0fc380114149c5f146bae028ea2e00c5df3847a424381eaec2b3a6782c6f3b15b20d438245d0429d0065857cf56c4ee69eff1067b7e59672fd5fcd6a5f
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 14.1MB
SHA256 8f5d75593ce2c94525fa21a23729959fa7e607d49b0d4fdf212f5601abdc90cd
MD5 deb7b5201efd67379426e007273b5344
SHA1 98718f0fd9f300e181659ebe5f667315bbe8fd8a
SHA512 49cf69136695f74c63433ea9e23b0260a4ed8b12aea8ebd6b108157e5cba7192c49752bc988a152cac48e265729240dde84225441d990d4f403674c8841b4f7a
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+Et:n55555555ipiX
TLSH
T1A0E64B05FA86C4A2D97601704C9783FA6630BC118F129BEBB784B37F5E337D0A635A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 90e0b2babd4cf7bab93ceedc6d5b3a7b08ca9ca7e5ec9af1b37748db87cb9476
MD5 4cf90baefdec664c8d1323c0cb399d40
SHA1 a1fab9174ffddc6ac459d3d745639ec7b20a28fe
SHA512 4f354f03b8e01b3b62e14f08934618423a98fc579714da75fe84f483495d02eb9d5ab64c7719a2752307b667043eafe021da125493d97dbb65691d73a3899345
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 4361b9f4b3b7b1b7b83208b941415d32c11f8c458683a6b0399380187b3ed8f3
MD5 6b6187f3b4190088e0966b56cbc2361f
SHA1 5970e8161a3ae72ffeb73a7900ded32fa312cebe
SHA512 e260bf1a47e3e8aa46eb36c19c5625a431246989a57249007cafb17592d70b89b9e7d1f0a659532afb90a19b25e2a165e530b9878bdf6b8a4a76b83a58542b3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 da9642e50d2b2bf217f7d6b197d17427c798cff3c16d72bf73afc6fb6ed59384
MD5 9ee988832584395a9fa78621714e18c1
SHA1 f8546a18e58872f6645b6406046b9b07e8d74ee1
SHA512 6e76805c520f3e15526340db1b76f80d6f0fb80f78a0cfc925f79d759411a2d206f0c45247f004e1feac615317675f04eb2ef1ce85d405a428421545a3a5e7bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-BD\qap`g`v~dtlq
Size 10B
SHA256 0b3cfefab6231d4a96b9b1a6fcd116fd5ba151b0b19d5dda103e28bd93ef4d40
MD5 614f9574b3f25c8d1e79af541ff6e6dc
SHA1 c23dbc75dce62828351c641649db0183c931f63f
SHA512 9e1c1969dac05ea094314837ff6bbc8d40eb86fa519f81ec77be281bc3beeb7cc0eac49a800dfd3c08b0a3040d1e0d3a46a63075c1229205b69296c2c5aae0b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iorza73p.default-release\startupCache\qap`g`v~dtlq
Size 10B
SHA256 21de3533f7a589d21e9d56f9fed131b83f885d79abac8219d4c87b9e665f7844
MD5 6c48bfd9d2b592493d9a6466dd57921a
SHA1 3241efa61560dfec12cb94ca60c0f9b3e2d5a14c
SHA512 ebf5cb239611f136293d72c030ec2eaf9064cb88fd4cd99da8b584a27ec526edc9fe0262d8fc44694a9634bec709629589ce6e7ebf3b5de28d0469af8c30716c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 cf7fceb50dd04738a86fbcb0ade7bda7d29de87f4efbb2de76b3d10355b267f2
MD5 faf4090db70d1df15c03e10c1704e296
SHA1 a605e8910c699dac5ceb9399f11a1669e49013fb
SHA512 df8a40f96322e8f152d523e873830d31e94a235b0725d9398be79df1b8ed173bae171aa9806f9591e1361c6182735c604969a0077823a1b050715e3407f29ca4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3798ee1a1446f9b8221e39d9025e2c445eeab1e9a012ef3d288dc2d62d4ab34
MD5 7f6f16493031a78de8b48cdc26ecd260
SHA1 f7db038953d434d0ee29ee7ff451835c970ceaea
SHA512 1330a9f281179633a4b9a6053f999ebf12b80a9936385838443cb9f6100589fb22ddaeb2dab2e42c2a03df856380bb7f09087825c31ff4bc34ae34099a25040e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68cee00d2063fd0288c89216f1328109ea61a4b8d80c021fb1e8fb1f76388abf
MD5 ab75786ba9bb6975f70bcea83c1f5d0c
SHA1 35431c86d70cb90b8bded463f12e16209bcc3a27
SHA512 440660fe7d6face35cd26a0d851092712ebe11a9a2252e346666ee6e833839d31f561b18b08e6386bc29a4028d79d391721ba97bb4fb4420bb655e722011f690
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff380ef3cb72a56695b07b022f06e0d3d9114bb8c1a7bd5470ca7249ba312dcb
MD5 42efe5c96b422fea0f88995df4d5b5b1
SHA1 52d456640103c4e97888af46b258acb3f758db4b
SHA512 625fce057550f60b5ffd48b5ce7a148510006240099f2be273efb961712c73a4cd1a234436b4c68ca3a6c3da5b00a0fe76d53a63ba2f913ee4d48198d276618f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e6d7ffb8cc176a0ba7cf29290759e510dcc419c75581947468a0b08631decef7
MD5 7d19281b361f5611969d38d6f0233d8b
SHA1 17d6f37fd09c3cba2bcf3960f60409f52dbc3b00
SHA512 ca8242c8de4bff490f6384c2e617899af63b117023c86f8060c7f0a1ffeb53e84491186abb45950b2fe9dc0fb1ce4bb9f5559157dae50c69e83c01c57f52c31d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 544563adfd346a886b8f8e4ba27d1b956814e92b020b72d66cc4a3accd17bde3
MD5 b654ce29330cc9d796aa3c139ed84430
SHA1 50d492cffe5868929898ab00da47fdcd6620a790
SHA512 c6f53a5f401235a8e44906cc2c8c019a2ef15e726ff91abc3263ab818be8f03c88d473bb44ab9bd20ce48a5d38d2260c043a0978594c739e476956159bdb25bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f77bd31124c40d8351b4be6fec05f8d754b50b681b83cda2e8d05a1a3d08257a
MD5 8186a76eb53f8ccf311cb1e2ed0f1e50
SHA1 12a6c4397915142d6aa0ce4dbf36fcbf30509fed
SHA512 77832de216b986316d081a3245ae3f9d2774813793f776afb91a71b6e423600271280da8966bb2ae7d5a5a1a4a40f0590c906b61a3ee9dcc50a943fb5b3edc3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 77cea6a1f652b0d6fd12afa6113073c2953ced7a21d2ec0cf95dd84d7b047e99
MD5 58351e71c43c9fdf2ccd424407f7278a
SHA1 23a28484c1e03acc362ea9af5cb816633d242f15
SHA512 85c852f2383e75652e1e686865f523285b56cbd0fccbec30b25c500597485ac7f40122e2ed48fc668f12839e408ce6c105e39ab1209c7904769077b6f853d8f5
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBCABCBBABCABBABCACCBCBBBBCCCCCCBACCACBCBCACBCBCCCC.exe
Size 13.6MB
SHA256 302795ac9fc302cb3d313cc4d8e7341a25977577b97f5991e5f94fedc092b7ca
MD5 6f54244f0c5d91ef2ad9ea3032ec0743
SHA1 37a8da93c4a8138ddfe803c5d29085db09dabf18
SHA512 7ae1d2ed76673618f465fa2effde326971ad70b246cb1b06b188df167a2082a5926f8e8a62dd6f2d25ebb651725cac6cf0c14654a6b9f82596cab8a6bcfc481e
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E7:n55555555l
TLSH
T1C0E63B05FA86C4A2D96601704C9B83FA6670BD118F029BEBB7C8B37F5E337D06635658
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fa0561f4d3ea9d444b1e7e4fc4573b5dbb190053944241f45a2041f947ee264e
MD5 35a6c02b2c74a4f2089dbbc8fcfc3cb0
SHA1 0b8cbb685a78c8b1ce69833d8c677fe837201aea
SHA512 d4b1400b0a66cde8fd6bf4bd1ca637d0916a569257e78e613d02dcc5b0b5b5aa9e85bf097690b86ffb9eab0719ed06914522f2f18020f6a356f7eef2464ebdf4
TLSH
T1AE219660F075D867A131E4CE6619EADB08B83F8FEC989B8463095118E7A5C76CD1A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0c32bdbd30e36be6cdc02c49ba33bc8a747e5e2d22b2e42ed60238bd51a4934c
MD5 76eda677855e2af6138c88b39bcc3d34
SHA1 3ed5551ab87f049ae16be5e50638c2f270052924
SHA512 0e995125c60f43e0d8bc84a823adb141f68edc96c659d70c66490d8811a7a96febe13a1abf2aeef3c86102c1e6d7c6866015fa1553f7eefc9d4c0c7cec8b1490
TLSH
T14411B960F075E823B132F88E5619EBDB08B43F8FAC549B9463095219D7A5C76CD1A4F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ec8c36881d78e451fc23a1c23f455c512c38540eb88072a980c2041427da7089
MD5 d165091570446309e811ae0d9a2c1a6c
SHA1 e6180307b20c6fb1326af0c92ecb68ef4a4a63bd
SHA512 8524c1c934f752ae0338db7900ed1379258980e64e6721e1183ab49c32b233fc7bd4d4356dc0f2a4e4b4ea62761c59d4236e61dff097c06ceab249d0649ddf45
TLSH
T18621DA60F075E853B131F48F6619EADB08F83F8FAC549B9463096118D765C768E1A4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-91-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/468-75-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1228-59-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Download

memory/2228-6-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/2464-36-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/3428-178-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download