fd409e5d9062ef8c335175c9546736884a344c39fe843a5169c8fac7ab266331

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Size 6.0MB
Sample260930-bh2j6sbd82
SHA256 fd409e5d9062ef8c335175c9546736884a344c39fe843a5169c8fac7ab266331
MD5 51e374788ed79609c45bc740832a906d
SHA1 6db82ada35c319a10d43178668da8cf3161a5c15
SHA512 d6988d468d40f3d07cae126aa26d52af284d2808a894077b2b8f0f633ac27d3dc3200d058ecd8c24df2c015027b94d9e7054cb6717fc6c308f93251c288e5676
SSDEEP 49152:U+ES+ES+EC+EB+ES+ES+ETqatgluu+EB+ES+ES+EC+EB+ES+ES+ETqatgluu+EB5:xrXrXrXrXrY
TLSH
T116565B09F98244F1D92B41704CCBD2BF8670BE218F128EEBF649D71F6A33B916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
4660	svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
4376	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBCACCBCABCCCBCBBBCCCABACACACABBABBACCCCAACBBAACCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe"	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBAACCAABBCBCABCABCCBBCCBBABAAAAAABABCCBCCBABCBCABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe"	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1744	sc.exe
2452	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1820	cmd.exe
924	cmd.exe
2812	cmd.exe
4872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5908	schtasks.exe
1548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
4660	svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
4660	svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
4376	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
4376	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
Token: SeDebugPrivilege	4660	svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
Token: SeDebugPrivilege	4376	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1820	3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe	91
PID 1820 wrote to memory of 5908	1820	cmd.exe	93
PID 1632 wrote to memory of 1588	1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe	94
PID 3916 wrote to memory of 924	3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe	97
PID 924 wrote to memory of 1744	924	cmd.exe	99
PID 3916 wrote to memory of 2812	3916	2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe	100
PID 2812 wrote to memory of 2452	2812	cmd.exe	102
PID 1632 wrote to memory of 4872	1632	svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe	105
PID 4872 wrote to memory of 1548	4872	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_51e374788ed79609c45bc740832a906d_elex_glassworm_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBBABBBBACCAAABCCBCCCCACAAACCACBCBCAABCCBCAABBCCCABCCAACBBCBCBAACCBBCAAACCCACABCBACAABBBABCACCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBBBABBBBACCAAABCCBCCCCACAAACCACBCBCAABCCBCAABBCCCABCCAACBBCBCBAACCBBCAAACCCACABCBACAABBBABCACCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe" start= auto displayName= "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe" start= auto displayName= "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCABBACCCCBABACAACCABBBBACBBBBCBCBCACBCBCCACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABAABBCCCCACBCACCCACBCABACACACAAAACCBBBCACACBBCCBBBCCCBCBCCACCBBBBBCBCCCCCCBACBAABCBCAAACACACAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABAABBCCCCACBCACCCACBCABACACACAAAACCBBBCACACBBCCBBBCCCBCBCCACCBBBBBCBCCCCCCBACBAABCBCAAACACACAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCBBAAAAACAACCBCCCCCCBAABAABBABBCBBACAACBCBBAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e6dcda148ced14835c20e345367194f9cb76312e51171b9099a522c00c01eea7
MD5 9fac7183c061fd4519705cc61ca1986e
SHA1 76e4ce0a51c92b7d98ce61138d1df7ab3cf083a4
SHA512 f601da5b1d9e7bfada91ef836e010aef013d58c81bf24c7fa49a5f1437125f62376f796579c6f478fcdde6e5f6e3a9ca20711af08a74e41f5e3adeb051a149c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Adobe\Setup\qap`g`v~dtlq
Size 10B
SHA256 b79bbfadf41c37d651013a34c4fde45edd6e2ed2ceb1fb1a3182aa735edbda30
MD5 9ef1399c763a26860dae9cea859f0c75
SHA1 dc27e21b682155fb18189f43cb45590dfd585b85
SHA512 1e1fc9a993b49747500c784c32de33c821f4c712176c8a65fa444cfe73f1e938e64f594c5348ddfe4deca9d1d338250bc3988d667fda1ca1dcfcd653a8ecbf4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq
Size 10B
SHA256 1683d1244d2fb6696114ead647fb8fd1f42bae32a78a973d465b57fd82e28d0a
MD5 9620b551463ffa18ff3a3ce760fae65d
SHA1 a58fa2d650bb422f03f7b7b9cc7b13545ade9e35
SHA512 3d7ff375d18aaf775a3b1c1ad584053ba06f24401c5713b4b8e48a116e25f6bffc1fbb60f10a9d4fd8f890f94e2576193264c0d1ecce0b680a53feec2bf0f307
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 940202c3c9aff7ed7aa34a5145b661795a941ed4511a5b8fc95bd25b3a26e2d4
MD5 1d6e289362a8cb90b007e1741499c2be
SHA1 1762c706002496372bd5a4cc46c896ccb9340d84
SHA512 76c410ad4d8eeb08a30b5b352c7d4a6e111888faa2f772cc29da07b4bd711ecc4441b64b70c639fb7b9cdd8eef6f2f2c2137f1492a4545d692958d4580fa369a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 37ae7d2c25ca91fefb5ecb89f3f2615c9a777114be8bdada61eda12246efd7ca
MD5 1800ff7578199095ae4956172186cbf5
SHA1 832d5cdc5780f946fef77d2c21872a7eeb396d1d
SHA512 abcd483537f507aef491e371012b944588adb5bc5f4b3d04bbf870dc7e213b10a7e26c7c41f85b01d08ad613c54551303ee4a0c5597ca69b55248abb6fe05d2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a2f8d2a3773376e6d62b052df5c3997cbf08a31c18e7776b3129e4247ced1373
MD5 5a644753e9dadb4a0ba77875f2114346
SHA1 b59d7e052c0e22bca7644486d82019c79f3a1f30
SHA512 51441201e869cde4f206ea51fd25ae6329a8bd321f87cccb61d7a1817826d5ff91b94ffb17efa913da22094e15b18edfe8e2251053622bbdb097c0684d81f9ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 9648d6488ba6caf309659228d3fbfa650724fdde2079ce9b882ebc48488e837d
MD5 f4e7062bcc789b2a077310bf6a1b4f46
SHA1 4a30d997c30885f339d7d11067ca8002b8c5bbca
SHA512 59fe5c0d3e487b3e3aeea6f6264abb3ee3de1a78ae6f919ae3190ece3535ae9bf9882561f8f07e8f40a4477bd901d9e3ab55716aa40283e86bc07fae20e13757
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\qap`g`v~dtlq
Size 10B
SHA256 6ab90ad7ec4f391f4a5f1ec60b3a64a914fe96405833c870727a05526fdec1fb
MD5 d8e1386b1034c2cab391dbc34abbacc8
SHA1 b5436576ff6a4fcc64c294796ee86290b0d53741
SHA512 a6b5e84edccbf7232d4ca61771fda2b9b1c4a97a4e5dd2406371af53399f12d7a3d3fd087270e0b77097218bb7ab3ef131d1dbbe9e1e3142b80b64b2492d22a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7950eb4f1bd8ce18aa48e3dbb7c36ef7648031cdd4516f4de68f66dc2847567c
MD5 b67ddc42075a0e7967ac06d481b16412
SHA1 f287a21c73ee0dbc164c8314d16d9f29d2914aa5
SHA512 c3c0b73ee24bdabc3ecfbc42f7331e1fc4e3cdc955057fc4013a23a78e84c0a5fee1bcffe071339736b85663926052c0e22b8bdcab42160a312b46862200c75d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 224d82cb3b5eaa9de59cefba3578939551abe3d05a249e95a8314c91ae7c816e
MD5 f4854ee23c6966ab31e61b19a1052ec8
SHA1 83dd1bd40ce0baf5df3ec9fe7c16d04089eaa947
SHA512 ea7ad617800324b5a4fc4f471818c973c01c5f90f01baaf28c61fe32674294b0b5dfd60782046acba022a5b605c9a7f3120d2de0c338ec3a1c1000f029236556
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b50b81f683f6a8de613d645f639874ba53fde7caca0960b5b60a9953b466abd1
MD5 2a2b700a237ecc783e2d26d710790c81
SHA1 9b9ca2cff10622e546de4d4c2f5b9cca68bfb720
SHA512 b8affa070b53e43802de8bfd03584710742cf9977ab1d6f473cda6c8e8d819d341e2c360aec496ce319fa5c33c392ba2ab1324b36202a6d98e9e8a4b44d67fdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e178f263abdd6763efea0f1f99f5abf84bd37bedba4abdbbf25f4e992bc86ca
MD5 00d0a77ea4db77d231636ab776c45780
SHA1 c30875738e9e3e9e876055959f3527e404618af8
SHA512 eeeae5aaeadbbd3ad6a05c2c1fb95d0a38f3e319d08fafa9631af4bce42c91ab35d4ec4ea9859fe7200c6ba97ba88c9f1fa6dddcaf6e0d7eab2714ce9d788b9a
MD5 SHA1 SHA512

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 18.8MB
SHA256 8d2afdb8314373be42629b2e4167544dc0a127adc9276d5c0f7cbcc7c0fef451
MD5 3ab9fd8fe7453753af3b857c3437f7d5
SHA1 e4e45d50b9c00b7d2a3bc3817de6bafcb073b0d1
SHA512 10d23d6430edde2fdbb83fb9fa07000ae2872bf29ddfeb20199fadfa4e459b21ff9b98bd2f23e80fc2b4e80b8697ef61ad5399b12d0f6c20de99938922aa1e81
SSDEEP 98304:xrXrXrXrXrYrXrXrXrXrYrXrXrXrXrYt9J9LnZ76Xi:VbbbbUbbbbUbbbbYjZ7ui
TLSH
T17A176C09F98244F1D92B41B04CCBD2BF8670BE218F128EEBF649D71F6A337916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 36.8MB
SHA256 da07628e472593ea5e34b44043bf89870e1ef6056037fdc78032e4f816ff2b61
MD5 ecdc8d0a9df536d380e6ff30a15bc94e
SHA1 9da44d84e225c0e7c4028ef9d808a43a08c2127f
SHA512 f44b776590a0ad1c19d948879d4fc0f35bca8d6078ca9e8b2446fbf74481ad7b593bce86448e74739d6f577b959d06ec3fb8b7ae7cba12e34e746ded066a2605
SSDEEP 196608:VbbbbUbbbbUbbbbUbbbbUbbbbUbbbbYjZ7uO:ZVn
TLSH
T17C875C09F98244F1D92B41704CCBD2BF8670BE218F128EEBF649D71F6A33B916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 48.9MB
SHA256 78ae9809c43c4819b802466a6a1fdb47f2ddd300070ef07aec9db81ba195480b
MD5 d66ae94e5ac2204bf2766129413eb5a6
SHA1 e4d8462c7502a568bf8ac4ca4e963756e1b45ffb
SHA512 f5ce12ae21789f494a31c9a67264f83f7f1f8ca8aa75b2a67f051b42bb1863c95d8c50ed9a33fbd8318db2087226e4d2c6ca419c232bbf10c0bbbdba2cdc794b
SSDEEP 196608:VbbbbUbbbbUbbbbUbbbbUbbbbUbbbbUbbbbUbbbbYjZ7uu:JVT
TLSH
T1C8B75C09F98244F1D92B41704CCBD2BF8670BE218F128EEBF649D71F6A33B916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 192KB
SHA256 425ed9e8a75ff13b672e1a39abc75e0b5deeefe3cb0da59b981b2cf0c6428aa3
MD5 f9db7ad27d2c847b10e3280a6a67d457
SHA1 893fc855cd936b1856b4dbadb41012f807c1f289
SHA512 b30467a7dad9aa3b5e760cb3dffba44affa420b4ae90afed516cb212f66d8d4d6c9d12caf8a50857b819995aea8c448c164d8de1a583e7f470f6d4197bb775f5
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vd:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAe
TLSH
T136140809F94344B1DD2B50B04CCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromReceive.exe

Path C:\Users\Admin\Downloads\ConvertFromReceive.exe
Size 2.3MB
SHA256 f296c9e8a5349009529971a73113e60f83cc03719ad47eb7189a56aa0d012fc5
MD5 eaf3980e80ee8053bf8590e54659ef2c
SHA1 deeb781354f75c8c5605ad122c76010cbe2890a6
SHA512 835f4ea36ffbc805693f043c3a1487bd292e8097503125d3c21d024131dd9e55ca62de98ab45a2557e81d28a36f78c433fcb85932fec9423a83dd330f791f3ec
SSDEEP 49152:U+ES+ES+EC+EB+ES+ES+ETqatgluu+EB+ES+ES+EC+EB+ES+ES+ETqatgluu+EBS:xrXrX
TLSH
T127B55C09F98244F1D92B41B04CCBD2BF8670BE218B128EEBF649D71F6E337916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c9f0566132e9c4e311b638dc89acde68e6851fd462b5fd36d96a72ce2eee0a1
MD5 499485020632913db5ebc0612f4070c7
SHA1 2e5c11b64c80e1dd20d3917e6f2b24be98bc3757
SHA512 3dcf3f0fb0026241033eedf810a8fd04fea28c84a35e5d8d7348de295867c60d69cc9cf2f53ce40104fa00e12490e64a46c5c073fc1b5a64412f2dcc2f48ff23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 42559b775453a60e8b6190747b92ac49481247c7a5575155fd3d53efd933d24d
MD5 a9d73036fec76c55f98d113548dee5ba
SHA1 68817a232efea774d0b64f5debf7d9a0ea92df70
SHA512 35f3e7504c0d239d5fc9fd7836caea633099eaa19498443a8fe7d353e137f17e4fabfad9ceb682e6c667b16ff7f879090c03a78ad27e11dca17431bfc5499863
MD5 SHA1 SHA512

Submit Download

svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCACBBBABABABCCACBBACABCAAAABCCCBAAABACCBBBBBCCCBAB.exe
Size 6.0MB
SHA256 fd409e5d9062ef8c335175c9546736884a344c39fe843a5169c8fac7ab266331
MD5 51e374788ed79609c45bc740832a906d
SHA1 6db82ada35c319a10d43178668da8cf3161a5c15
SHA512 d6988d468d40f3d07cae126aa26d52af284d2808a894077b2b8f0f633ac27d3dc3200d058ecd8c24df2c015027b94d9e7054cb6717fc6c308f93251c288e5676
SSDEEP 49152:U+ES+ES+EC+EB+ES+ES+ETqatgluu+EB+ES+ES+EC+EB+ES+ES+ETqatgluu+EB5:xrXrXrXrXrY
TLSH
T116565B09F98244F1D92B41704CCBD2BF8670BE218F128EEBF649D71F6A33B916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 824d16b7fa161ddc9c5145175479929076bcfaacfbef8cededa78fea400a3dee
MD5 8b707f78ebd8efd3f3b47e7aa0cca54e
SHA1 2147bdd8c56180b6aedacb24ae05262681bae3d7
SHA512 995b53f3c5da751af3b3602e1962fe67c6da65f764f0b90916672102add043965cda63b3d0e6a475ceb03409cd4e2bd8cf49cf3171a4378fdfcb5e0da5e8f1cd
TLSH
T1B621C960E065C493A27138CB9235CFDE4CE8379F687CAF646319411CA799C39DF194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4a2895fa9bb5de0b49eb5d356aa17976000d8e485ed33929299de559991a4097
MD5 be7985b88c3bd6d216254c2febdbf7b1
SHA1 d5f836359da43e27d6fc77ea58f48723ddfe70a7
SHA512 070217cf0ae4984f9309966a1702e6a43b51e3d357fda4ec1011dcd411abb0c05fb3af55e6bd12e6792db983e206ab4aa144061da386390de330516290c825ef
TLSH
T1F421F920F0A4C493E23238CF9239CFEA4CA8379F78AC9F14531D4218A795C35DE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6be9f9910d83ccd94a761a460462d76ce6b41d31a67a876e484de2455ed8e5b1
MD5 c43fb6945bb396ddafbc320dce3d17a6
SHA1 c5b8ec9873ef4b6ad440b85829833e0c0b8fb49e
SHA512 2c70c6adeb7d4be2fd6595828f3cc52c4e83e4b6b9967041ad5d36d1525cd66664aa3d18cca69f11640f36a3d4ab4c1c812b77b2b0c8932567025338e450f7eb
TLSH
T1E411E760E065D493A23138CF9235CEDE4CE8278F286CAF646329411CA755C39DF290F2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 f0247b01447ee183de064016a08d63df95ddb4875ce335cf701ffdeb3cdb0b13
MD5 13f38d2079e753559ac783d8273461a9
SHA1 263f4bec4fb3485024c7a599992b3a19d3e8e075
SHA512 c794a0de76dc2dde8de2d6d15666c8e800f6dac40abddfe82b3fafec3202f8d09258350187decf9fc1b158c5ef7e9f98e2a985e1ccc56abc4b57efd047fc9e74
MD5 SHA1 SHA512

Submit Download

memory/1632-106-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/1632-47-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/1632-69-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3916-21-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3916-46-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3916-10-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3916-68-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3916-104-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/4376-1465-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/4660-107-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download