69f6cde143d203d2f396752f8ef637970e79654a557cfd546573023682b5ea0c

Analysis

max time kernel
146s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
Size 1.8MB
Sample260813-bmpfeayfma
SHA256 69f6cde143d203d2f396752f8ef637970e79654a557cfd546573023682b5ea0c
MD5 49b60c6d6de77f6c509618012143ed97
SHA1 45a1f10ea022d6cc7b746dd6945c14c0a791735a
SHA512 1c0dc916a03536235aad7f30bc5cce47ed4c4a0ab67570da15e829ed1d16695f5f1d4b3c814c7d168d387ea3b6ad00728c9124019dcf5191918a2491ab3c32a2
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglH+ES+E2+ES+ES+E9qatgl4Dd79WCm:oyvp70
TLSH
T1BA956C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
4892	svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe
5976	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBCBBABCBCCAABAAAABABBACBAABABAAACBBBBACABCBCAAACABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe"	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCABCCCBCACCBABCAACBBABCACABBAAABBBAAABABBAACABAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe"	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3872	sc.exe
4148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1356	cmd.exe
5336	cmd.exe
4772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
4892	svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe
4892	svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
Token: SeDebugPrivilege	4892	svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1356	3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe	95
PID 1356 wrote to memory of 1680	1356	cmd.exe	97
PID 1460 wrote to memory of 2676	1460	svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe	99
PID 3564 wrote to memory of 5336	3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe	103
PID 5336 wrote to memory of 3872	5336	cmd.exe	105
PID 3564 wrote to memory of 4772	3564	2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe	106
PID 4772 wrote to memory of 4148	4772	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_49b60c6d6de77f6c509618012143ed97_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABBBBABBBCBBCABCACACABBBACBCACCCACCBCBCAACCCAACCBABBCABBBACCBABBACABBCBBCACACBCCBABCACBAABBAACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABBBBABBBCBBCABCACACABBBACBCACCCACCBCBCAACCCAACCBABBCABBBACCBABBACABBCBBCACACBCCBABCACBAABBAACACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe" start= auto displayName= "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe" start= auto displayName= "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAABACCABCBCAACBCBBCCBCCBBCAAABBACACABCBBCCBCBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBAACACABAAAACABCCCBABBAACCCCCAAACCAACCACAACAAACABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
1⤵
- Executes dropped EXE
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 23.1MB
SHA256 6f9079afc3820098e0aa0389ae39862890b5dd7c63cb1a47562750346b7be23f
MD5 fca696cf46ac11d9ff5f43c75506ae55
SHA1 c28ee10bfca43016eefd80d2ac23e40d67bcff9f
SHA512 919ddc68f11b6ac437d8aec89a09179869ed9e972e5eb79b893e059b59570f67750da4022e8fdbd01e7bc5c9397f58aade51469732c553a0ad2ee63a75276a80
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7N54S:beeeeeeeeeeeNgLE7PH
TLSH
T1B5377C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 4.6MB
SHA256 6fca1861080c4c57de8a494320afb166b33b4b64c7f66f5cb5366e7e9d5120ee
MD5 4a54a35e74f4b5cd1c9d31464e4f8018
SHA1 f8786389d118137579654ec7b23d38b2030ffcfa
SHA512 753f065abb3293545245153fc0ecc91dc66d626f825abc07967ed6f8725288a11fd20bdfbf78b059bf6b1d49462b036c3313c445511875f0c07bf74330ecfe69
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglH+ES+E2+ES+ES+E9qatgl4Dd79WC9+ES+E2+ES+ES+t:oyvp7nyvp7N54hLNOhViynt
TLSH
T1AD269D05FA828072E42B01714D9FD3BB4A70B9214F168ADBF78C876EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 10.2MB
SHA256 bf19ccf67105fc0befc491c152a2de4167b00ccb9b36234a29402345a4f276dd
MD5 ec75db4b18e6d4f1859fca0038811a96
SHA1 6c13787b48103c5acf22ad7c8bd3d9e0582bf1f4
SHA512 1251d7bf964c5050557a0c418c155e6a11855f37dbfa04db8fa8eed393858e478fc392f0f390d15297681c11ce6c5fdd9749315adf6448ac2b234f8b4acf62c7
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7N54hLNOhViynd:beeeeNgLE7Pd
TLSH
T183B68C05FA828072E42B01714D9FD3BB4A70B9214F168ADBF78C876EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 12.0MB
SHA256 fb032e1a90a7be03055a8c6df0a5dbd5bb55c4aec4dd8920760f909026748072
MD5 c0adcbb5b6a23da43846cd6648a50be9
SHA1 08dd2d2518b90b9c48417c60c8b0a9306f07c007
SHA512 ca33b8270bd8979313e4589a02f535fc2068d235e0d119214b1a53bc275b40650902f53bcc8f7fa132ebe9fafcb1b9c4de5b9a1e3df48688e0c73c1fd4b6f9ce
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7N54hLNOhViyno:beeeeeNgLE7Po
TLSH
T1B3C67C05FA828072E42B01714D9FD3BB4A70B9214F168ADBF78C876EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoInstall.exe

Path C:\Users\Admin\Desktop\RedoInstall.exe
Size 15.7MB
SHA256 34577fc6dadb016e86f2089b9186533443f207967ea15fb591bc5e51bfff9350
MD5 c2bda4e1a1587ad3b00f4e7de77b8825
SHA1 a79c0e73a649e8735cddacc3421cd641fef4a92f
SHA512 3e3a0d92a82feef549097fda444717b21daaa17b8ce96b84b48345bb6bec17f72004f33eaee1d29aaf4bebbce883c2ec898dfa7fd62ab71745e00bb689e432ee
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7N54hLNOhViyni:beeeeeeeNgLE7Pi
TLSH
T11EF67C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8c7e7f1121d39cbd021c021e25842c63fdff718038da53a55ffed3dd47bf7ba9
MD5 aae17e6bc5eec69ad359fb7c09281711
SHA1 e46328d8bd130589b3703952b8195f18b14fd279
SHA512 0f4342d6c3edc1fbac84cea533ae3b699458bc158d02f152ff284e33da2268c62f0a6ce3f8e768be3b479b4ffd76dd72ee50957a1af2fed7511618fae97a7fa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8613126f046c2d24247494123cbe6e660a0f75cfa06253d56a5ef29a7b0d4d94
MD5 71b4f3d1aabc48a350964f0e75b7bbc5
SHA1 19cebd6bef6f2879eec89852617f6dab217e8196
SHA512 66f5446ca52674460d72a3a07d5ff617458b3dee81724e9ecd1f5a551533ab9eb43bcad1a1528b2daa43bf1590cb5519f0aaaf06559b4c65a57cad965947c02d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fa0926aa30fd21983c1a753dbaef22e7371b5e9dafc6b5d26ba5bf325d73f16
MD5 716cf8a70921e460f15bfa2118e1e9ce
SHA1 e033a519dc86584c39a72109428792a25377ab77
SHA512 d0dacb05e0ef674e0fe9897df64204c431bae79174339b5274f202b6b8ee8186f304ee536b392d6733b75102bdf2c7e0d4d201d785bef431fbd0314e246416d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6123495a8b96344796a2851e3b16274d268a417ec326cecf6c2c7e0c57417dbf
MD5 8fd0270154d94c821e1eab6649bbc670
SHA1 9a445f520d978813651201297ccd3919d2344b11
SHA512 8a4a96f039fc3dd7cde0a562de90cc84053c3d97eb7cc4592d394c5e73a6925d3d396f520114eb1ab86f53adddba7eeebae6b79821cc01a65713662d396cb996
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 419f0e6ebdbd33c8dea8230a90272e99dc93442e27f09b548897a359460308ae
MD5 78e926577333b1ddd417a2921da18444
SHA1 67b09b4f0889dc5f0c1e40b0a989aff097144ca8
SHA512 41dedfd3eff6e1b9bce341538be52c411bebada877539e3a84e664cf7071162df0271b048ae78588dd56e8dc341e406454ae0dd8ff6b19c23daa64bfcb92dfb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f664ebb7803cd3d446dd5d43a9b918f42e37e3210ec85c974ad3cfba6f0ecb93
MD5 23b848664e5d59ca0978f4a47dc4a3f3
SHA1 70b10943ca7a704726a33a67ed8715a70d86f0de
SHA512 2b08c776362e19a4944f12a7bbba6827255a06823a69c9177b851639bb56e620ba405cf3484ea7f6748564685b1dc1afd3f9b9d7f95cd601fe3850a2a39a62cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fa9598e22d2979be03fc8c900951af268de0e4ca0ca73d08a8905466cf50f69
MD5 8188ab6e93fb102d4f4403186e7e6f7c
SHA1 9c19846f3aec0c7c8c74061f2777518b3c6b2d0a
SHA512 c90ea0667730932034caa1bceeb093f11e767d01fefb3f15a6ac1d7dbc01bb86243ba2a4635bed29c3e36f8e13d0f356c1d245f94a37082026d07c7a6e4f7354
MD5 SHA1 SHA512

Submit Download

CompleteClear.exe

Path C:\Users\Admin\Downloads\CompleteClear.exe
Size 15.4MB
SHA256 9d93016d1f075bae132d0d3e957801d8716a488d67af2b057828da56893df7a7
MD5 43aeff8a7c2d8025bd975b9b9fa73fba
SHA1 e05bf9ae8d3b94492f49276bcc6b2bed1b87cef9
SHA512 796a37abdd78981f5002983aa27d76c7b240435cf2695056309b411a36b0a26de157fd967481a249cb1f4c8176fd247ce8f1896c0b413e0532b17fbe047e511b
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nK:beeeeeeeK
TLSH
T134F66B05FA428072E82B01714DDFD3BB4A70B9214F168ADBF78D872EAE337D0A635655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteClear.exe

Path C:\Users\Admin\Downloads\CompleteClear.exe
Size 6.4MB
SHA256 d1e117220ef991959a32d06794e7d64d6bfdc01ccf3854301eff74eb2ef8eb1d
MD5 fa0e42323e0c8ca6f96de263b2efa6eb
SHA1 85ea8b823f633d96ebd8f346b72218648f260b25
SHA512 146725cdc8ecd00ab74d118bcadaad4d812e3dded3a8149851350925499d0f000b94138520673322dedf08b93c59e9ccab64a44bea9eb44c662ae11391fad5e2
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglH+ES+E2+ES+ES+E9qatgl4Dd79WC9+ES+E2+ES+ES+w:oyvp7nyvp7nyvp7n5
TLSH
T141666C05FA428072E82B01714CDFD3BB4A70B9214F169ADBF78D872EAE337D0A635655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteClear.exe

Path C:\Users\Admin\Downloads\CompleteClear.exe
Size 8.1MB
SHA256 e040f83178a48052dd0b57f154f7d018382f140488974022ae15ed9585a1b3a3
MD5 b039fb7923e0a4d344c33bc9f3b6cd9c
SHA1 bfdb9de9515914d4dc84aed4175225dbf5c00db2
SHA512 3eb6f925f6cf252c8f97deef6237d7164eca8cd08aa51215da87b1c52a5fadfc8bd1182b9e392c93146f49b91fcfa15a2b2f4b5319fdbe716ef726e6a404eb24
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglH+ES+E2+ES+ES+E9qatgl4Dd79WC9+ES+E2+ES+ES+c:oyvp7nyvp7nyvp7nyvp7ecBCKI
TLSH
T1BB867C05FA828072E42B01714D9FD3BB4A70B9214F168ADBF78D872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteClear.exe

Path C:\Users\Admin\Downloads\CompleteClear.exe
Size 11.8MB
SHA256 3f61738905d972195b4664393c40482b72f37da17f5446967cfee7ce32a6f5a8
MD5 1cfe94cf558481bb132f3787bae484bd
SHA1 9db235c3e51ff8b82543e397d03ba47d95983bde
SHA512 45711ef8583a1f64ca583cc475e27421d3d6f339a2dac77fbd27f8fc5015a867f7dbf0d4f399eaab2703827fe74d9e6be0f4cfe9e0328f1f182a17a8773cf3bd
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7ecBCKH:beeeeeecV
TLSH
T196C67C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteClear.exe

Path C:\Users\Admin\Downloads\CompleteClear.exe
Size 15.5MB
SHA256 88e52fdb2a68be29a21fb969469bd4cacd410ff9c5ef1e20c07b85810a72caf2
MD5 28196df12b55b710bc2109a7bef4ee38
SHA1 25d7f6ebd548d7f782125c00f70f1af07c12dd7c
SHA512 d0078f258ea7570184d79ab98a9f6d2bd50480bdbac53f57c018e88dcaa89628e72a20aaadecab4ec3d52afa5f68a2a32361abfb65e3c1281c8c469352d45972
SSDEEP 98304:oyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7nyvp7ecBCKK:beeeeeeeeco
TLSH
T13CF67C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cdb5a347e75c6c233edb2228478da60897c78a2c92e2cb5cd21672340c7ea993
MD5 55669cb6667dae3984cdbd0864cc2ad1
SHA1 46eea4ed979b05b0fa8f31006e07531a97e5437f
SHA512 8cc34e7ed010e6507ea1453ae3b8068c2d5986c3e59df70d5ecaecd46828e8ba4217c17a1ecb07f6fd49ec219844f77338860d96f7bcdea8cfa2baab3d474d0b
MD5 SHA1 SHA512

Submit Download

svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABABCBCBBACACABBBBBCBCCCCBCBBAACBCABBAAACACCACBABCBC.exe
Size 1.8MB
SHA256 69f6cde143d203d2f396752f8ef637970e79654a557cfd546573023682b5ea0c
MD5 49b60c6d6de77f6c509618012143ed97
SHA1 45a1f10ea022d6cc7b746dd6945c14c0a791735a
SHA512 1c0dc916a03536235aad7f30bc5cce47ed4c4a0ab67570da15e829ed1d16695f5f1d4b3c814c7d168d387ea3b6ad00728c9124019dcf5191918a2491ab3c32a2
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglH+ES+E2+ES+ES+E9qatgl4Dd79WCm:oyvp70
TLSH
T1BA956C05FA828072E42B01714D9FD3BB4A70B9214F169ADBF78C872EAE337D0A635755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 fb1013385318c144e9e330d0a9b1225a65b487ada1314099f5eaefeec2e92109
MD5 3b47405eeab6eb3791eb4d64e28581f3
SHA1 d2cb06aed7fef95d2a2b105c706d324e5ba33612
SHA512 2e7855ba056135ea8bd26df941fbbb9f424a403a46a15d2f194f1d91f88a524f5a9f7a02e6dc0f2ed8d367cba93bb3552551a31909e5be47010f5053101914f9
TLSH
T12E01B9A1D4E5D823FD332CDB763F9B864CF8368F6C697A1C260D121E7651C62CE114A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1460-62-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/1460-88-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/1460-124-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/3564-16-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/3564-89-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/3564-0-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/3564-63-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/3564-30-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/4892-125-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download