3b0342c599d7f8535989322032846241f5d384f4f0a7ff41bd39854e1385772d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
Size 1.2MB
Sample260908-fdvy2szzew
SHA256 3b0342c599d7f8535989322032846241f5d384f4f0a7ff41bd39854e1385772d
MD5 d62a8052ec25bd1fcbc3802083e8b6f6
SHA1 93b6781e3ac5f76da4bb977b6809d9c75f95a1c2
SHA512 3f991284686b86ffa859aeda328ea1df3110cdbd60f7146c69d5c2e2520d70b727a686bde1b6cbb0a57b815942eaed11c21a73f56d65ddffb9f164d23c78775b
SSDEEP 24576:m9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bRIh7CH:U+ES+EruDd79WCSqatgljhOH
TLSH
T1B3456C05B79580B5F4731631897B83769A76B8311F25C6CFA3C8927E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
1188	svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe
2096	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCABBAACCAABCAABBCBACCCAAABACAABCBCBBABAABAABACCBAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe"	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACACCAAAABABBCBBCCABBCCCAACAAABBCBCAACBCABBACCBCABABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe"	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3964	sc.exe
4272	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2184	cmd.exe
3984	cmd.exe
2760	cmd.exe
4304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5000	schtasks.exe
176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
2096	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
2096	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
1188	svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe
1188	svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
Token: SeDebugPrivilege	2096	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
Token: SeDebugPrivilege	1188	svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1084	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 2184	4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe	95
PID 2184 wrote to memory of 5000	2184	cmd.exe	97
PID 3520 wrote to memory of 4420	3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe	98
PID 4420 wrote to memory of 3720	4420	notepad.exe	99
PID 4556 wrote to memory of 3984	4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe	103
PID 3984 wrote to memory of 3964	3984	cmd.exe	105
PID 4556 wrote to memory of 2760	4556	2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe	106
PID 2760 wrote to memory of 4272	2760	cmd.exe	108
PID 3520 wrote to memory of 4304	3520	svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe	111
PID 4304 wrote to memory of 176	4304	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d62a8052ec25bd1fcbc3802083e8b6f6_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCBAACBCCAAABAACBABCCBCACAACBABBBCABACABBCCBABCCABBABBCAAABCABBBBABBAABCCABBBBACBCACABAABCBACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCBAACBCCAAABAACBABCCBCACAACBABBBCABACABBCCBABCCABBABBCAAABCABBBBABBAABCCABBBBACBCACABAABCBACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe" start= auto displayName= "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe" start= auto displayName= "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCCCBCCABACBABBBCBBABABAABCAACCACCBCCAAACCACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAACCBBAAAAAACBAABCCCBCABAAACBCCCAACCCBCCBCBABACCABCCBABCBBBCCBBAACACCBBCBAAABBABAAABCCABAAACBBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAACCBBAAAAAACBAABCCCBCABAAACBCCCAACCCBCCBCBABACCABCCBABCBBBCCBBAACACCBBCBAAABBABAAABCCABAAACBBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:176

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBABCAACACCBACBACCCACACBBCBCBACBBBACCCCBCAAABABCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 c014009faa69f734834d41ff7e1f56e933a9dbfe23f33d1f18a732c2ccb4b327
MD5 6205d1c56562580aa2a3d11484652b23
SHA1 7e66adaa12716ed9cfec487acac7c1085987b71a
SHA512 7c29e76bbd5e1b919924b88ff7a031fd31eb50bed8888715d538c73785faba8bc694cbccfdfe36ea42291c5df4387cc9308e88842e9b8af7185092aec3e4138d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 c0886ec834897bc4598e047612ddfcf7fe360fe6ee8f7421d370d46e6b72b9f7
MD5 33ec559e83d5da703efcab7ebf327e51
SHA1 877b7f1c1ccc6d0b19de8e4e182f54724f79a9c5
SHA512 5f2a2cf8b4021695e578473e548049cf790dc581db5ebbb125aec2fcefd972b4eced6065b52946cea5613b465f51693727d74786c46102091b066e07667b21ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\sr-Cyrl-ME\qap`g`v~dtlq
Size 10B
SHA256 a98ad85f2beba51d215325f726baee480a67e9a082721e03f25d2c519d8c1938
MD5 102f39bd03ef4fdcbf030b6cd1fd39f1
SHA1 759dcd42ebe57b78a7559d2d4b9b96c01bd524d8
SHA512 db482273665b4555904904e091b49b456e8ae334cf083dacaf6d5a91be1dafc3cffeacf5392f553d27e8ff1a27c6db721c137ccc3d09cbfe85391b355c8cf9d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 c919003b2d30d7edb146eaf73cf9bf1bd646719a330709ad1c587015673c7dfb
MD5 4c359cccc3b936ef3d6b223e58cacf09
SHA1 4bf036fa0c7d099e9a022257138f3c71d389c74d
SHA512 cae0e189891bdfba7493147379029c84c17436e275c986f1afee8bab9b53bf2e57c916d666a26aa7e4f75a7edfc24bb1a46650e33dbc6a2e79967ce0c37ca5d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 ce946eefd1c859033bd45e17db56658f10250426d41dcd9667df9b3852123afc
MD5 0e9084e9b7e307e213846b27e37739cf
SHA1 ae3e3d48d6ba32760fa6020c556001b3ca1ab8ff
SHA512 910daa59e0bd22067d9c2b12bcb9ca681c7e9ba0a08968d5f36fcb2396520a89cf937fea21dbc2b1aac3478a6f26752e70a06edd4df27dda3f035f88aab264e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be3929f327363188d7b318ee4a860e6aee2622dfe070bc57936ee7739df5c235
MD5 ac9e4caeaf0f11513ab70f22bf7f9988
SHA1 237810fbbfcb772a7c68f8e3ee34fc2e6ade70a5
SHA512 92c4b9d3e889fca89be84fa7a747e932a0943824be10f3dc663ba4e14b8da726314d81f1185cd7c95d58432e4402f55211c83b07115791079212ca169b48da4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f102e363c75040c3aa9ddcafc02de7020b1792e93f328de4e5712f33746759b
MD5 ff1577f57a0bc004323890503ee73796
SHA1 de1df48d02c537168818592bed76943a32044b64
SHA512 251382d0511ce4d40c1fa063fd490e8d7b4e7c3affa656f8c16497ea89a14a8ea34375696bd92ab01bf12cc3d0e07e4a2bc91b0886fd0795840105e8464b61e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 516495e0b1ce074455e42ae25bf3899ce04705df85f06dea9bd271b09802007f
MD5 2e2da228fb62ea0893bf0d1b98423fbf
SHA1 7f8e2f1eb0b336dd785416d76060a8cec5b913b5
SHA512 f936af147532561ef555748af097dd74bb509cfd2082513f896ff44106b77ffaf6570e129a6d03c2d7811bc33817631d0f3c499d1885881281f2399c57b80fa0
MD5 SHA1 SHA512

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 14.2MB
SHA256 3dc23421b78ed811e6685af4d77a193143f898486649419f8ed2f5bbab2fe621
MD5 e4c4e231b67078f020c47e5944132f02
SHA1 3e88a5f654af55bf01c428022cc3f1e5296b5b76
SHA512 48bd8056b68bd6b2812cdbeab9f596b6a8d0222df9c821700251e71599749bc0c8b318fc787753f5bc762349c72cdb534f1e9f86bdbb599a337f4f18434c3d7c
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iXnydaI2p2:6llllllllllPyda12
TLSH
T1C8E67D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 16.7MB
SHA256 acc8f5eaf8a20b550065dd152d837dcf5d53b1a729753d2b69eecb65472bb470
MD5 c9f274feef2ce866639d8b5983b4eda5
SHA1 44afc1e6d0b719bccfdcf0a72ff86f1fd10812b6
SHA512 d003cce36f1a34d4e34218a5432f4b7645042996ddc46650dbe226ca18d64a1661b2923b1e69a05926f4760a14fe38f2ab9bf583e603f31666b96eccc07ea757
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp7F:6llllllllllllPyda1H
TLSH
T19A077D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 7.0MB
SHA256 95efae1175a6a1327cf9c9ea47a167b4c4d318eeb7de5844cbf92354ab6890ec
MD5 4d10b91984786e0c187e6622bebcaae0
SHA1 cb63912073a8882de416818c1d42fda5aa353032
SHA512 2d55b20000e12bd3db83710da4a0a970f0689ce162c59271b2aaebfa8416f7ea431f2759ea7581aaa4b3d936a625c51b18348c18aac4e290061496fbde8d572d
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iXnydaI2pm+:6llllPyda1T
TLSH
T1C1768D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 8.2MB
SHA256 b194c9550d40f7636eabff4a8342b92b2abed5b818c084f5ce570a9d352779ae
MD5 4c2137a233c9478afb2626a789310b76
SHA1 b42b3a71debbcf74a2bd9ef0c9b11052752b4dfa
SHA512 94ea0a89be7f340a75849d3cc61bed8c7d775d23080ba45f47d9b3b380f6ccd06729b8c1205bd38eb95cb9afd9e1141ec5c6971bcde922850d0c41f4b20b76cb
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iXnydaI2pm9:6lllllPyda1y
TLSH
T123868D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 9.4MB
SHA256 52f1ab2ebaa28eec797cde534e237b1c08adf1ba8f24e244d1c4d40f2c1822c6
MD5 3087b22c2aeefc792ba89c0904f726d8
SHA1 ed4667193227ee06a7522ff5565e7ddd096335d6
SHA512 320d3ee7c8d7855cc292aea71355dec2761f951570b738bb34094e6f2f9da5dd4ac4d55fa6cd589fecb192b38726ee23fe0ca6ba6a0d352a26f7884411ad7aa4
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iXnydaI2pmp:6llllllPyda1k
TLSH
T1F5A68D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 10.6MB
SHA256 838d1acf3d231369e22824d5f00fbdedf96cf1d5927e05330724d5ebe96c6469
MD5 592c6662ca4c062cfc5dc47a7dd29ff0
SHA1 bb1ea1cbfec2f2460fdbc2dfd8f8525a741ef169
SHA512 f07d864cc32117bb3ac6a589d2b953be26e7f536464ff9d48ec98f8ff6cf3a5b9da0dfb5c5da20e69cf34759d8c24d67b286151dc8826c1f550a2e20b2b43f66
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iXnydaI2pmg:6lllllllPyda1/
TLSH
T1D8B67D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 11.8MB
SHA256 d25a2d6a86289482893955286e34971f9dc2bf6feae7ddc124e3a94a57daa4b1
MD5 dd7a35292a83c911bb44f18f5e873280
SHA1 4dcea61bbdfbcd38a2ad18a705a8ba4a125d6d6f
SHA512 4883e26bfc8235680613aae0f76fecfb276c8b7401fff5d9d88ddb88e28a72420211d29a80e37b1ebf706afadc9ee55a1ad3e9e8cb8a362c617f5d2f7fad7885
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iXnydaI2pmJ:6llllllllPyda16
TLSH
T149C67D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 13.0MB
SHA256 8cdcbb858fb23b5342eaab18829111a0e6f391a8768a0f2873fa5637e63501d9
MD5 4ee2a47ee4b7aab3871e5842919be63c
SHA1 6a2b7ed6fc692969468d897ab387b58dbc3a339c
SHA512 329ab7f564bb6986731dcd1200f54691cae570335da51c382341e426c554f0e549c9fa4a801d4c5a09b702df0a27d5f56922a30a5c083a5a25e1b9d89dc113e4
SSDEEP 98304:0p72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iPp72iXnydaI2pmX:6lllllllllPyda1Q
TLSH
T108D67D05B79580B5F4731631897B83769A76B8311F25D6CFA3C8923E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1abcb43d021afd34200fe31ad24edc595fc9cc21612cee452f189c3da8435bc4
MD5 7c8d1b1beda1933c190ba8dee07ca76e
SHA1 552763aec6efddda1137388281616c8610fda6bb
SHA512 4e1a578392b59fb0210a7cfc54b868891e900c3da01502cf6c08368e43e8e9e10ba4884a553e12eaec45011d73c704336b8c1752952df5588b313b7fdd5f11d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e97d2ff7170f79c0487befdcdfdb154b99ef794fea44026b1ac189d838c9ee1
MD5 b9e6ab7937b321f889a74f496051f9d4
SHA1 6a3699aa6d4169f888c12fccd3bb17b140d72f05
SHA512 39f46492956a30a385974217f88fd0b29f8b7bbe5c4bf1e55d50a30f8cc01c231296ec15f5225dc556531d50a76e9f61d4df6fcbd7a78aa6e03587f2a2d047e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8441eee6d2433e2e348fce191be6df5ddea323bd0befc2e590953ef8b84f4b89
MD5 94c0c69c4b3b862f831031ccb5f40cd5
SHA1 11311067d3b473ed142e614bf3144ee9c925b953
SHA512 9e8373b13161e2ecabb92010b88a8200c9a845e93ebbb72a000fdf0c2077b84572965734253f76cd96a166c099c0bb398dc06e21dfb38362a3e8d7bc86ffd948
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e70b8632b79e04fd5d89f846a4c57ecb738afc07acf2017c4b601ad64a87233
MD5 5c1c2828793efec9d0655ce1f0025705
SHA1 4761bf97ef6b0a47bf2f92b7c1682e1448435851
SHA512 cbed13f478ff0beacb32dae149cf7cf1346c1f407fc28a5e32a6b35cdbd8c26a10ea1030d9c5e6214f3f5d18ac5d5a3d1f3c76894afad4bc5911e8baeb82315d
MD5 SHA1 SHA512

Submit Download

svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCCAABBAABCCBBACAAABCACBBBCABABCABCCBBBABBBBBCBBABBB.exe
Size 1.2MB
SHA256 3b0342c599d7f8535989322032846241f5d384f4f0a7ff41bd39854e1385772d
MD5 d62a8052ec25bd1fcbc3802083e8b6f6
SHA1 93b6781e3ac5f76da4bb977b6809d9c75f95a1c2
SHA512 3f991284686b86ffa859aeda328ea1df3110cdbd60f7146c69d5c2e2520d70b727a686bde1b6cbb0a57b815942eaed11c21a73f56d65ddffb9f164d23c78775b
SSDEEP 24576:m9+EM0q9+EM0p1afDd70iTWC7Exqatgl8bRIh7CH:U+ES+EruDd79WCSqatgljhOH
TLSH
T1B3456C05B79580B5F4731631897B83769A76B8311F25C6CFA3C8927E9E337D0AA31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 cd5a61ea1a1cdde995aea2dba44e34ddebd7dd0a68e3be8a2ddd5add40cb1ed0
MD5 c63ae88a6258bbb1cb962a6397c7457e
SHA1 46228723f8321df33d86d40a83fef174a915a48e
SHA512 2536f8ed0fd6cb6e750518acd5d0e3ce559692f89204d0a964e6c9ef745e5d407ce6fe02ffaee2a74bb33a1193114b7958cb9e76957a2cab15dd49eebc403e37
TLSH
T11D11E751F4A5D853E13278DA5321CFC75CE83B9EA85CAB8853094318A75AC398F65CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d38bc435b6ee169933a40552b77f0ae6dfb2ef1e970b3c1e12f0aee1129a9f4e
MD5 a1dc28fe8a16944589635a83941cef3b
SHA1 51706b907fe9c223610adcb3de64393f3b10e4a7
SHA512 fb6a35194a1d4782c0b8655179c0f7d14ab67d92b77fe219d5282011eaba97f0bdcf75aee1408acda07dfd642d67677c4bd7e6d034b4a6da47495db544b73dcc
TLSH
T1FD21D450F4A5C853E13178DA5321CFC758E83B5EA85CAB88630E4618675AC398E65CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b0f278524290f5415114cbc8ee1df53a974c170b69dddf1a7fb3069d86bcf0c4
MD5 862f50f0ccbd929bf6ecec8674fe96d1
SHA1 c3daff0718b201b8c6f6b60d96cc6b0c62beae5e
SHA512 656ed99e643bb69fb5bdd3da47375a529ffbe092de04a9d9938ed4681ef94fd76a63557a88e14ce6f338805f217ddf6b4b8d8727d1ea640b88ebf9c9245a51bf
TLSH
T19D21B421F4A4C863E13268DB4325DFC75CA83B9FA85CAB88530E46187799C398E65CE1
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 f37df78b060bc70e04026ce00eb078f8eb47f65ad1ab4b73ffa5a80b101b67d9
MD5 8def805a9dba76b620a80d2f7b09643e
SHA1 efdb26e5425789909e0288f369c32a6916ab5a75
SHA512 e6acaede1ba389d54cfcc83dcea7fb27a2f203c53330600cc26c204e2ade0c5f45519f3bedef89d695dca707fffe646e32beca9cf4dd30c2ed583eb928d07dfc
MD5 SHA1 SHA512

Submit Download

memory/1188-2964-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/1188-91-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/2096-918-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2096-2966-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3520-99-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3520-49-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3520-73-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/4420-77-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/4556-23-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4556-101-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4556-74-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4556-10-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4556-50-0x0000000000960000-0x0000000000981000-memory.dmp

Download