72ac9481552a972a85deefb05e2e7424bfd4bf4a0e8617bd03e27cd3ba3e5601

Analysis

max time kernel
149s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
Size 4.2MB
Sample260912-lr4e8shb77
SHA256 72ac9481552a972a85deefb05e2e7424bfd4bf4a0e8617bd03e27cd3ba3e5601
MD5 5f0fb0b31e14014a3ec714f43896a616
SHA1 b4b5ea4e1dd23b180faa38cd6b8b3dda96508099
SHA512 f18be0031b5473ed3ca203f67030ea082fd409919fe6c1233cefe7192fdd2278fbb691f31bd080cd6c067f02516f89287645e6aa03f1981e6071c4bc3d7a0096
SSDEEP 49152:U+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+Ed:RCCCCCCC0
TLSH
T12D265D45FA8684B3D42B0171489B93FB0F70B9154F169A9BF39C936FAE337C06232695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
640	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
2504	svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACCBBCAABBBACBCCACBBBABBCACBAACCBBACCBBBCBCABBAABBCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe"	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCAAACBCAABACACCAAAABABABCBCAACABBABCCCAAAACABACCBABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe"	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3364	sc.exe
2076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1612	cmd.exe
4472	cmd.exe
3932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3188	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
640	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
640	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
2504	svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe
2504	svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
Token: SeDebugPrivilege	640	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
Token: SeDebugPrivilege	2504	svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1612	4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe	89
PID 1612 wrote to memory of 3188	1612	cmd.exe	91
PID 4516 wrote to memory of 1052	4516	svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe	92
PID 1052 wrote to memory of 3264	1052	notepad.exe	93
PID 4928 wrote to memory of 4472	4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe	95
PID 4472 wrote to memory of 3364	4472	cmd.exe	97
PID 4928 wrote to memory of 3932	4928	2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe	98
PID 3932 wrote to memory of 2076	3932	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_5f0fb0b31e14014a3ec714f43896a616_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAACCBCACCBBBCABCACCCABACCCACAABAAACCBBCBBCCBACACBCCBBACAACBCCCCCBACABABCCCACBCCBBACAAABABABABBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCCAACCBCACCBBBCABCACCCABACCCACAABAAACCBBCBBCCBACACBCCBBACAACBCCCCCBACABABCCCACBCCBBACAAABABABABBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe" start= auto displayName= "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe" start= auto displayName= "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBAABACBCBBBABABAACCABBCACBCCACAABCBABABCAACBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCAABCCAAABABAACBCABCCCBCAACCCBBBACCCACCCAAABCAABBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e1f125da59bf4b57027dd5aca8186716ecb39f8f2469a7292b171974d03a6f32
MD5 0c6feb2e780ae6b3e583cedb55681d7e
SHA1 25190a1bc84e73eb8a2bb5973b7f780284b3ec87
SHA512 c4896480818e898b731367d738ce97e3339bc20f1c935ff5d872b66fa69ac5cf1029d0f2c66bc932424c0c707a276ff8a4db69e7ab6007ff41373a0dbd29f87e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 4.7MB
SHA256 505ca7d41e625160497dc16966ac8a5d19dd7d02ef2a2c87cb294f9f5ea3abbd
MD5 236dc80c6da2a9c33bcbf068dc5ce936
SHA1 697924cceac59ef003966dfadb7794d8d7000772
SHA512 9b7075f99874984b92ffafdaa7fa855f8e1979840ced70eb29da59521dbd75b0daedd976422325692cd9095f269af8eec121062405e28e6230419c6cce29cc43
SSDEEP 49152:U+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+EW:RCCCCCCC3piy
TLSH
T1EA365D45FA868472D46B02714C9793FB0B70BD214F26969BB38C536F6E337C0A6327A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\Integration\qap`g`v~dtlq
Size 10B
SHA256 b3798f25431c55af04246f40563238e036bab7018e23938ccdf131b937651c3f
MD5 0862953fdb5e803d2a0dcd9802be9ef3
SHA1 99234a4589fca6cb92b0611193943e465761ac35
SHA512 d66891fe8a59c1105450752e05f1bced629353b2122abb5c7a2a4bbe06001f4978f763d0c0a7bad55c81c31a25294d8bf1b6981dde7cd7c2b4e09c2665cf1fbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 61ad9a8147f2b3625d41894e8c24dbcd1606bdbe80a6ea4d6e682430a4680317
MD5 e4e012da0c2bdb2b172fee8cba6ddc96
SHA1 e9a5b484c53f8b3d0f6646c9ac88fdf1397c0fcc
SHA512 72937096d2d32df1a720707e51690babbf3cc37c56cc4cc6ab4d78e06f8c6dcbcecc406c8bfed218f43c681a646b3134de465474540ca8d45d2781e9d2b14578
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\qap`g`v~dtlq
Size 10B
SHA256 0199529d7f0fb7df4e61172ec5d16c90fc01fd8126d9e6f360962abf65675d1c
MD5 9d8fb56ce54005c294f9e3df800bfd3f
SHA1 1d4b42e4a3e7ca5f644fc53af07c1a1277c251e4
SHA512 e99321457483756192a201fb62f2fde37d2eed1a7ef39eb9b88835221b0d9416f48fd708038ff2383e0050a989bee04e57fa65071b3cfb0d0fc516540f46854d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 e179d8a43727296bd5c4bdaaa3ec22be2cb2ed76da878e6ca8262e32ed538ccc
MD5 0eaa863bb4a5dc4b37a3237b6897c46b
SHA1 0e18948b05bd11d801ba51eb51b46ac47bd186f0
SHA512 0223ae58f704229103991236e75d07dd7a6f22fcdf51b43a6ec3d230d442d626cf0167be0e43385a3fa7cadda95ba8cedddee0931769e15e34cec20b6faf8f3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 0d9c10501e44871417fe92abe66421ce4ebe28754c829c232856ab69b96c2a27
MD5 0ace48453dd553a385740aa6b489e1ad
SHA1 3801aff65c04f28b35dccfe7c4210a7c9c6b3793
SHA512 3b2500f38be952efad7023a4dcb69458854414c177e40521cf4ddb9bcb00637faf5ca005394f484839cc24cbf993c949c03a493b47ef89fac1652a9b04630e35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f9b214a71fc3bcd46969e9fb87a8d7d1b9b303e87c188c35e3df1f9e4a52556
MD5 6febb4c0bf3eeb11adca09882bb4c3b7
SHA1 95e369a9d6d9f79cc46e83f510b1cc0885ae88b0
SHA512 013139722621034e0a45e4d893dd1e0d6d2f0e16f4b8aad15257234a64f8e7d839e5189a34f346fc993d8b4c24d297a7c846f288757e56f4a3b0b9efbd5fb3c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ac1e44ec2d76ffce3183c97cebf50fab812a964b9098018ce2af859f4c7c949
MD5 e79094e488aa555425eeefaa3e9f6d31
SHA1 639b9ccc8b1c7910efa550335221dc066b5cd3ed
SHA512 39cf6ec1367e0ff7bad5a7c754603e1408022841e265df46204fcd911a535031f7334ccc371dd68c67884cb67bcb8c0a75a8e2ed51e6979be4ac1b527a2c43c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9eff91e99138d8abf95dd5b5d7e24d70c7604c35bb4c6852f5c4874efb20c762
MD5 37956a00c573ef3882f385b0aac4a50b
SHA1 737929c00048d1d1cd852553b9fad19a280a0e55
SHA512 5466f8e0f40bd60280acb67ea1111e8541764a98870c18dfbc2e219c61eea08cdb44e2c7c84cb2a6669f35d8053fec9b46c30fc95f4809fcc2fc4d29f6c0eac9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f18cf91e5268843ccb29f998811c28a094c8d5f23c6fbf441ab4e4c480a6fbd
MD5 373012a29e9605158611525d6c56c74f
SHA1 e65e630e8ff3c3872517332f84aed8c5c391b2e9
SHA512 6c2cb943c8947e48fc3d354074caf6e2ac5a559875fda705f4bf0b89d9b3842c011c0bf3091b2a249460e33170f62273d2ac1d4142cdfbcbdd84ee710a2dcbff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cf28d2c3669e8af6b439388716eaf3183bfc6c2e4b7fd7216b1b5b6dbbba56c5
MD5 e20e1334db009c86178deb6fe544a569
SHA1 cf944f7e95ee9b976853b790e27102d40ae7d5e3
SHA512 527cc6fc3401eebef357c1d8389912b2401758b21de4d2d4c0d05eb9c9bfc39bdf119b1f2fc25ef0904cb53308358c756cbc74789a510d306cea32da506659fb
MD5 SHA1 SHA512

Submit Download

svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABBABAAABAABBACABABABBAACAAABBAACBBBACBBCCBCBBCAC.exe
Size 4.2MB
SHA256 72ac9481552a972a85deefb05e2e7424bfd4bf4a0e8617bd03e27cd3ba3e5601
MD5 5f0fb0b31e14014a3ec714f43896a616
SHA1 b4b5ea4e1dd23b180faa38cd6b8b3dda96508099
SHA512 f18be0031b5473ed3ca203f67030ea082fd409919fe6c1233cefe7192fdd2278fbb691f31bd080cd6c067f02516f89287645e6aa03f1981e6071c4bc3d7a0096
SSDEEP 49152:U+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+E++ETqatglE+Ed:RCCCCCCC0
TLSH
T12D265D45FA8684B3D42B0171489B93FB0F70B9154F169A9BF39C936FAE337C06232695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2af19122ce9dfba1e35b6605408015a90a2f61adf17164145b369020545a1a7a
MD5 5d7ee6cca7204b0776dea8046ff3280b
SHA1 8b906441793bd1b6965bd04ed0189386fa14046a
SHA512 ab758dd7c569c251ce75aabcdb2e3e8b6f849159bc5578a08427c3795967246c18e851cf32f57006ed75ddc696bdb04004043c7c5bdc623d7a3d924fcfffec6f
TLSH
T1B121F690E1F5C453F032688AA525CB4B0CD4B79B6C5CAB007305A229FBDAC34CE158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 83b1b57bc8f9554eb6f507d5c3d5109d06189557b34789cfc46ff842b8201773
MD5 f77aa52204982af8b9cfce210ffa8086
SHA1 ba5793ee9f0839e7b7e955e784689e87b93decaf
SHA512 2df4b2d7a46c234b0bac3385ef7946d3de930a76b796799222672feb494bd9de08f539bd9b4f2de830f80cd056d910e46e2fd3b1a5a616d99248dc3e06ff116c
TLSH
T18F11E390E1F5D497F031688AA5258B8B0CD4B79B6C5CAB05B3066228FBDEC34CE158E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-77-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/640-1773-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/1052-59-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/2504-79-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/2504-2541-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4516-35-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4516-25-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4928-6-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download