226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Size 1.2MB
Sample260813-jmkffshe62
SHA256 226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a
MD5 f21a9ffe1bcf99083344f40338ba1519
SHA1 6f6991fd07d5d80602ad412020a82196005e5fca
SHA512 afc3608d0b39e099f5d5a79de6118097e495d6a361ff144e92adf50d6d5c9d16c81227f34a63c72bacd3e3a94eb2fe1d1c4e5384c3e9031be010ff6ec4ecb4db
SSDEEP 24576:m9+EM0q9+EM0bExqatglY9+EM0q9+EM0bExqatglkafDd70iTWCk:U+ES+Ekqatgl6+ES+EkqatglrDd79WCk
TLSH
T114458C41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
4180	svchost_CBBBBCABBCCACBCAABBAAAAABBABABCBAAABCACBBCABBCAAAABACAC.exe
2832	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACBAAACAAABAAAABBCCCACABACABBBBCABACCCBCBACACCCCCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe"	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCBBBACCABBAAAABBAACCACBABAABCBAAACCCCAACBBBACABBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBCABBCCACBCAABBAAAAABBABABCBAAABCACBBCABBCAAAABACAC.exe"	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4624	sc.exe
3556	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1196	cmd.exe
2972	cmd.exe
5496	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBCABBCCACBCAABBAAAAABBABABCBAAABCACBBCABBCAAAABACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
2832	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
2832	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
Token: SeDebugPrivilege	2832	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 1196	964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	92
PID 1196 wrote to memory of 6784	1196	cmd.exe	94
PID 6960 wrote to memory of 1996	6960	svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe	95
PID 964 wrote to memory of 2972	964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	98
PID 2972 wrote to memory of 4624	2972	cmd.exe	100
PID 964 wrote to memory of 5496	964	2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe	101
PID 5496 wrote to memory of 3556	5496	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f21a9ffe1bcf99083344f40338ba1519_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBBBAABBCBABCCACACABBBAABCCBBACACCBBBCCAAACCAACBCAACACBCBACCCCABCACABAACCBBBBBBCCACBBBCBAAABAAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBBBAABBCBABCCACACABBBAABCCBBACACCBBBCCAAACCAACBCAACACBCBACCCCABCACABAACCBBBBBBCCACBBBCBAAABAAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe" start= auto displayName= "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe" start= auto displayName= "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABABCACAACBABCABCAABACACBCCCAACACBBBBAAABCABBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6960
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCABBCCACBCAABBAAAAABBABABCBAAABCACBBCABBCAAAABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBCABBCCACBCAABBAAAAABBABABCBAAABCACBBCABBCAAAABACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0c0a28e595e247917c68e9a449957299665508ebbde7832b8caf71ee32933c8a
MD5 294ced4f5cb7babf9f6ebd7010ddb21a
SHA1 a6669cfffe005e9cd07f73e300d31bddbdd5a3e9
SHA512 c26911cfc816f3bce3304d5dc458d79f647c39fcf0d2845970c9c031af694269f49539521a00a93a75a5813fd413cd560ec59c2a7389e3d19086b76aa831805c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19587.1000_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 255f67fe8ba6ae4b10f16968ba672effb4d613804102bab5ede71960a266192a
MD5 26fb1c87cd0ba851740b507c277a0962
SHA1 de06e3b19b282759fbebf8b1a8816cff9419ea0b
SHA512 25480dce8b86c2381082b559bd6a21504e660e341750999bcab009db5018ef784dab3877734ed6bdee6835947d34cbde6f342084967524ac9915b608d0e9b849
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 fd6f3f3ccf32cbd7f06e12b75660f2320554b5bd4c05418b6aa37079463b490b
MD5 7ad0fec455e802badc1e89ae3e4948c4
SHA1 fa159b77efe72d96b2cc0b919ed66ed020250d82
SHA512 c9d527a3d9bc7f6df7ddc0b992e076fc3bcc39cc151d309928daecb24828134e347b5f3fd24714225fdf7ea60085c4123490ae0ab6aea741a7dd445168cf949d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\qap`g`v~dtlq
Size 10B
SHA256 f51afb7a4300121accc12dc584fead06a37e07afd85e2caf8181a24ccbb13f98
MD5 54c1f1c62a0399bc1317b3238449ccdd
SHA1 6f1775a3aef0b4d8acd8df018a8a69a9d4e84217
SHA512 57cec64306c038b27c469a3cad9e956662d2ff7cd823c1f73aea08c8a0fa747cb2fe0ac51f493623654c93ee18103aae01379d0fd218001e74438c3a32550e50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 e457bebfdafc91a6c12f8abf63125948535d0c9b025b0d7ff11584c62ca23d13
MD5 65a07f1ecbf2ce850c37233e4abc2c03
SHA1 88efb232af3f492a1b22ccd3093b8f083a087c93
SHA512 dd7deb4c565af5d53dcce5ac64f6f83fad7535b21142cd7c75024d724f5b7fee14084ae64cb430349d504d4237857d6c6b95dba5b8d4edb648d719f45ff74378
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1014449518-1831897916-4205727055-1000\qap`g`v~dtlq
Size 10B
SHA256 b2cbffcfb20df276c778a051d7ffe3cb67a47abdff9a0874c6f3394e0aefb9d0
MD5 0f71e9100cfc381bfe7655f7610af1c8
SHA1 90425009c3d8e85a26b906ff8d9c44cc77429b6e
SHA512 2ac6bb9c8b9a5d38e4ede40b30c9d58bb0c6b213662eca56170ba414b412c94706f977660f61d04fcc64b16a678e97647ec15f0f4e37647f40f83a1caa9a1408
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42d0deb8cf05ababc5b09e07581db2ee37e979332bef7818d4d60c2192b83f8d
MD5 8b7c9daee677aef67aa8dbb88df15595
SHA1 40be15dc7bb62407f9a6bcd8ada2f18ffd834062
SHA512 16cdaac4cee2900f03cf27fe71f8b75753a20d454339f4fd5c42cf7fc1bfecc2a2c7024d577af797ac3130b495dd3ab1bd331c403ddebcaf3a3ab824c92c6647
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 737f11c49643291f87c06c7a5c3e9c407cb231c12147e65c52ce1175300f73a8
MD5 d88f364083490662433cb121276bd22e
SHA1 b425914e4a8d8b4e8b82f1086eb95204a2b7bb3a
SHA512 3466d8b7d65f03c72a23f956f361d4d505e8811ebed19a9e6ed5c38e6a160dae80de4db8e4b148e088ba10c49769c8165dc206545ec6627018ea457c777a27ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84bd0d61f12cc982abc943262b0995a658351f8dffc4da0ec001bd786a39955f
MD5 116e861c99ff19180637e07d7116de0f
SHA1 b5860c2a2b22ac4971365e40874375acad808e9f
SHA512 fc0b43f330077862993e22fbcd26abf8512e852be647c227649a5a7d58953cd1082be1f3fc82201b629802761d58c3101f85ecfebb98739abccceaacc88ce62e
MD5 SHA1 SHA512

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 64KB
SHA256 d3569602a5b82e19383832f4093a7f1a5b93a42445233522973dd41bdaba802e
MD5 32eec5ccde5a6ff6cdc0626daa589f6c
SHA1 2fd2c166b52f03e4a174d37caf382953970dce71
SHA512 4041c7b64cb6be577b2e5ad2ee43fcee5a8abe98fd781d527e35c697374f4021cc81e21f5c869af0f9d17616b9722b463557708734a7c370f84c717349a2cbc5
SSDEEP 1536:+sdt7O2Ut9G9vVRTLoy2jpmEY13kQ9GKd:PdtpUtI9vTTLoFpmEY13Xoi
TLSH
T11653E819F98350F1DD2B11F10DCBE3FF8A60AB26C4128EB5EB4EC75BB932B215418665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 192KB
SHA256 f1703451135029d7026a8ecba81933957ad9f83fe2833adc14fc741667ed5d56
MD5 4904ae3512cb5917c845eb7f74ba5d17
SHA1 cc210ca97a37d41a0d18fa5f2bfe256548daa1ef
SHA512 245ee10ff555e3de21b8e9b40eec169b9d02f9ad326be70980a2fc29c7e2da91fa0237c7901febcb550546f036dfe98d38e86ade7914a63335267f719efe41dd
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoVkj:m+dTTUFgEs3XojAdP+dTTUFgEs3XojA/
TLSH
T173143B09FC4344B1D92B51F04DCFD2BF8A60BB2586128DF7FB4ECB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 7.6MB
SHA256 2d8b6a2089a2448b7c0ecae44627cb1bb82316cad8d47199ad11f8090a6d6c70
MD5 b9ae97fa2c898bcfc535940abe5a1667
SHA1 36b843eea72b915cdb2c62a1e3a63b46ad651acc
SHA512 a45970daf83a4ae622d746177abf6aec6b0ff4a67b355ccd1c04d53f3cee410e805f1998759997fc12a7eabd097e080e37e829f22c258cc3c898452f0f76ee13
SSDEEP 98304:Qh+p7hh+p7hh+p7hh+p7hh+p7hh+p7XSeOhT0:f00000CeOhT0
TLSH
T1A8868D41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 448KB
SHA256 28c473776bc5058c7d89988c94e8490a07b7958b5256a80b296404775c8cb3f6
MD5 0df59fd3e8a689753b3b6c89992ff28b
SHA1 11d5c88e5aeaaecc00c2709e86442bd14089f6b4
SHA512 c91eabb5e1d49f12ffa74c961efc26250ef01475f656640e5e4429eea43679e22a12efc7d399139c1ec14f7a410a9940ec86ddeec4c885d03c5a42b6a047e668
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAbk+BeDuUlEqatgl8A+gUI:m9+EM0q9+EM0bExqatglY9I
TLSH
T1DAA45B45F9869172D82B01B14CCFD2FF4670BD218F118AEBF689A32E5933BD05336699
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 10.1MB
SHA256 382b6e0cb10c51e05cff30a0c0c1234862f2f13eeb0ddfbb7a8df3e362f8a237
MD5 57aaed71e1019db5c11726f427610381
SHA1 62f9f6d3755407c64e21b596c336bd7b8d6e01aa
SHA512 92aa842819d6c76f917be55b02cd2c6fb9b92d8892eb216ccf0d02bc5df1446a7ed3ade2a37f52603ec63b30c8c7d959de37273892e2ff042d240b3b240df49f
SSDEEP 98304:Qh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7XSeOhTM:f0000000CeOhTM
TLSH
T105B68D41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 11.3MB
SHA256 4fc4c4e1d92078441d2504bf52914c7a66023f1b87e3714e72a7fb1bc3a46c7e
MD5 7da0c845050a75428552c81648ffc1b1
SHA1 f84379018723708929b4a2e9046cbd936a1adf56
SHA512 245df5378b6d175e5cfc2ce2b4659bc8b3e27184b3ee01be01b7504b923d6852094057c5c433dc7872a02646e7f73922a7f475f116937d1748156def76f444e5
SSDEEP 98304:Qh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7XSeOhTU:f00000000CeOhTU
TLSH
T120C68D41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 12.5MB
SHA256 92b09395e6ca5f7a6af9750bc27e18e321abb3e3b56b93045f524bfc5055c32e
MD5 a775ab290e9e523717823a42f8e009f6
SHA1 bf095515f569d9c742567243769d3ff62c143f9c
SHA512 14cd7381f5a8cc76037e3f0a69f9dbabd88b2fc42c4fa252c21261594b02b13a8677dba8898605f83e57cfc17c878c01321aae112be98fc0f081ba7bf42eeb04
SSDEEP 98304:Qh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7hh+p7XSeOhTX:f000000000CeOhTX
TLSH
T1DAD68D41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5e63421f4ee7455ac3a06896d52f986716bd3698deb52bfd6d70683134004ab
MD5 5f0f5770370b3f0f8b1c8a95694ff61b
SHA1 6ea5a3167d8acdf793ccadcb6bd84fb3d313b6e1
SHA512 115caa33e8d5cf213d9a3af6e0118718ed3c75fce21854bc0bdeb0b53e73e3c1fede37a1081be017a4f6031ee2b0ff9b6282fd269c78bf8c1cb0e7331c72be40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8464ae5dd1e274541ebaf63bb433e3773742adac1c55f28cf470ac8ec929a627
MD5 5238cd6a02fd4292c3950e01e2c31331
SHA1 9ab364087d069651cfedb2ec5e66ac14d96335ab
SHA512 f1ae50a6cf497a309fae6e1ffcad7396aa40b46916e2215d6dd568eacb23ea946f31afb1a0f4367fe7a0c5537cd3a8625901fce3cff9b1cff55a0a01f0d72f16
MD5 SHA1 SHA512

Submit Download

svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBCACBCBBBCAACABBCCACABCBBCBBBACBBABABBAACABABBBCB.exe
Size 1.2MB
SHA256 226fb8ba7965000a94ab02820b0976188aa005827eaa895caf96e16803ed3a9a
MD5 f21a9ffe1bcf99083344f40338ba1519
SHA1 6f6991fd07d5d80602ad412020a82196005e5fca
SHA512 afc3608d0b39e099f5d5a79de6118097e495d6a361ff144e92adf50d6d5c9d16c81227f34a63c72bacd3e3a94eb2fe1d1c4e5384c3e9031be010ff6ec4ecb4db
SSDEEP 24576:m9+EM0q9+EM0bExqatglY9+EM0q9+EM0bExqatglkafDd70iTWCk:U+ES+Ekqatgl6+ES+EkqatglrDd79WCk
TLSH
T114458C41BA829132F46701724DAFD3BA5574BC218F118ADFF788672E5D32BD0A33275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5ffc8b151ba065c9601c8e6ddb70804774169d880d03803d2fd8ecdd7c92c22e
MD5 9dbf20325f09e7e2db85e4953134207e
SHA1 936aed0bd1ee3efa6439854d0f31e6e81cbf0c4a
SHA512 d8c23a2cd9817a6070fb52188beb5e198e4effcec1867d56a450a21c09dfeb2426eaaa5ca83164897215677bab10e9e6d1c48a4ca7c6c773f07d092b62185646
TLSH
T17011082195E5C403FC32644AB72B9AD28CA832D758986B581305421AFBC5C72CD3D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/964-93-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/964-0-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/964-69-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/964-47-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/964-22-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/964-11-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/2832-95-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/4180-92-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/6960-94-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/6960-70-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/6960-48-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/6960-33-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download