f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Size 6.6MB
Sample260814-e4tcgavcnc
SHA256 f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654
MD5 4e98c61d828bd1160aaacf84cdcc1ceb
SHA1 b41a7326024af95c640507ef00f9d3072926f940
SHA512 6942af1ed33a2c16fbdc989ead3821d2cf701744b6a135ce6b71368647ac6947f485556ae416a003de05675537e0eb793c7b5ece10392d8b7ca8877d36be6297
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESM:7Lpp7c
TLSH
T1CC662909F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
3392	svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
1656	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCCBCCACAACBACCBBBAAACCBAACCABACCCABBBACCABBCABBBBCCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe"	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAACBBBBBCAABCAAABCABAABACBABAABABBAAAABAACAAAAACBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe"	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2600	sc.exe
4868	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
764	cmd.exe
2588	cmd.exe
5088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
3392	svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
3392	svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
1656	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
1656	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
Token: SeDebugPrivilege	3392	svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
Token: SeDebugPrivilege	1656	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 764	4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	95
PID 764 wrote to memory of 1140	764	cmd.exe	97
PID 4356 wrote to memory of 4220	4356	svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe	98
PID 4220 wrote to memory of 5044	4220	notepad.exe	99
PID 4556 wrote to memory of 2588	4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	103
PID 2588 wrote to memory of 2600	2588	cmd.exe	105
PID 4556 wrote to memory of 5088	4556	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	106
PID 5088 wrote to memory of 4868	5088	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBBABBACACAAAABCCCACABBBBACAABABCCAABBACAACCBCAACCBCBCACBBAAAACABBBAABCBCCCCBACCAACCABACBBCBAACBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBBABBACACAAAABCCCACABBBBACAABABCCAABBACAACCBCAACCBCBCACBBAAAACABBBAABCBCCCCBACCAACCABACBBCBAACBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe" start= auto displayName= "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe" start= auto displayName= "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCBBBCBCBCBCCCBABACABBABCAABCCCACAAACBAABBBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCCBAACBBCBABBAAACBCBAABBCCCABCCAACAACABABABABACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d654313d91fbbb6dc37be5b22bfdf11366cfd3734d16734a2c703aa73d973c85
MD5 ab5134e21675edafba4073131b5fc325
SHA1 dadf7f900be12e35cf2c9b83f20f8cbb011b18e8
SHA512 8a7c11469c50d898e67821e253d1b834a3c83332e736856ac372c4d96fa25300ff1511ff062811ddfd08b19f8061205d104bac8b8e721e3005a2d62dae68c539
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\qap`g`v~dtlq
Size 10B
SHA256 98b284f6fe3db50ccaa0430ae8fde2b473bb2277b3a0fcb1552c8200cea11522
MD5 f47c17d1e03833f23680a45133ad522c
SHA1 7d5069787dabf9eebc8e1b0182164157ae1e327d
SHA512 d1abaab16fc8aaeb2ebeb6b8fe1ce2187c2f468d121aa6e4c3aeee6c088c52affe3ae2a41854f78d9b10601b47e6d81e41032c2e40d6ab5911f30e00d4b70eb1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 078529839db5cd0a2abba1bfe3000af2ef1017948ee35f162da14ac994765a09
MD5 c56ab1f16f4101da2a170b5e9575028f
SHA1 b44228a8d8fa93eedc98646c3765be5ae500eb28
SHA512 3c8ece30f13dabc8fef9309757ca73b9e964210104562b86ddf03dc3e9ecfa2c016609c3295ed30763d2407deb2cbeb47c64620dec0d1312d9bf928689183b57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\qap`g`v~dtlq
Size 10B
SHA256 cbd39dac5e7d5cf5894ad1567f817c43ba7a1b7148a1a29e30774af603a8405a
MD5 cb1a6556356d7185a1fc97864682cce3
SHA1 fe10f2f7ee26fbb9418cd3fdf770eab8bcf980e4
SHA512 0000ebd4a5c47e59d5b7533b43c1e0bb060b267fd756f09e916c49015bb18be406e7260b0322c911266938df3ac4b180f1028fd106524f3d9b8f8ddef76160e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 44cae51ff2b9014ed476613e7d0d1e4bdc4d79b16189719866752540d60aa0d9
MD5 e24adb55842f8d8a7a5d6cb8105c2daa
SHA1 66a167e2cb0a40f898167edbfc627b9a087ec3ec
SHA512 a1967b787cce24c1f2ae9f2f048f17ef774371f9a064b6888b52838a78aee5a7d51d5285e473bd8586aadd87e7c18c976a749d43d3361125f03e79930fffd31e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bb75646aaa931b0d26ce8c47728238bb77d82b8f2b1901a5c492d9f14025252
MD5 e1fd2142219bd11c224b74848a5b67db
SHA1 b241f930032161a39c1bb4976ac0b1add2eb815e
SHA512 5926a9649144dbce4f7e17531fb19a483bc3cd19dcd9ac68d6bf94605673341142e4ac893334dfea857e966656458e14150569a629c66269bc67ecef51c36196
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68521946f08cd735ada3aac9619236eddca4968b0a323324ed25593a433db981
MD5 b181f84843f6d149247b251ac9c6aaa6
SHA1 3a5dfb88f4c3b72d86c28589b1436eca5aeebfb5
SHA512 1b3c9b66facf68dcd82e8c3f20d73e0d998a3ac430240695b7d847fbd3811063a723c719300e95cb362535ade0a17bf754d2fd704bca7568bc7cbd24d27133f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d274a16050056c3baa8a934ad5aec1c8b494bc5456fde6694c53e0e5431f4e70
MD5 0be33a5abd9044c893726f2ba26d09c3
SHA1 3eda767ea7033f898b82c26521aeb89758078cbb
SHA512 5ad3613cd37afb698bdb0475556a55e7ac5662208c654f511e70b46cce2b6b6b170878f3b34f600ea675facd5dc2e136dced84daa0e41eb9a14d0e70583e3933
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60be10b71545427f85e082a8e2488a5fdd5a60cbac3c7a2a5e9b183f9ba7797e
MD5 b5a13ed9ec226263de9e7c0b3ef17e0e
SHA1 20d9c1e1dc0c53da8c80441f2f7ec10fc8519381
SHA512 841394056c146ff84bad07bb3ad11e3d760170b25695a6c8eb6dbe7b9887006cbf4b40db64710ecee70d8d8421859ab0245a40048ae248c2961939f325797f04
MD5 SHA1 SHA512

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 2.4MB
SHA256 176abd077d425d2de47aa7cea0ae55b253eb9dfcaa550b26a0e063d9031093dd
MD5 e98c0f51b61bc4b09372db8f919014a8
SHA1 bf498557099cc87e7d9ad074f5f472bbcaab60e4
SHA512 d8efbf268b61f838b7db75b4a7287fc530931d978659dbc3fbf0957233b4bc403d6608a41a2a5239d01734a6460bc6b97ee81d5de0ff07a5f790165cdf5009db
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESd:9
TLSH
T1E4C52A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 192KB
SHA256 425ed9e8a75ff13b672e1a39abc75e0b5deeefe3cb0da59b981b2cf0c6428aa3
MD5 f9db7ad27d2c847b10e3280a6a67d457
SHA1 893fc855cd936b1856b4dbadb41012f807c1f289
SHA512 b30467a7dad9aa3b5e760cb3dffba44affa420b4ae90afed516cb212f66d8d4d6c9d12caf8a50857b819995aea8c448c164d8de1a583e7f470f6d4197bb775f5
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vd:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAe
TLSH
T136140809F94344B1DD2B50B04CCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TestSave.exe

Path C:\Users\Admin\Downloads\TestSave.exe
Size 53.9MB
SHA256 4e117f6710d431a590b2804f0f94babfc2123f9c4aa3f9de9b9e677514a44e4d
MD5 f647ba3853b2f17b1bf48b54b0cc142c
SHA1 f95dcff1271df801e43c50e831f40dfe10d60338
SHA512 c9804143df6707cd693f9455a178f529ad736c8ccfbf19fb4a57b74203f8c618b3b5cf7471a6ec30aa4fc7f00058464cd2a9bdfcd7223c0ad80c2e2fab136cff
SSDEEP 98304:7Lpp7SLpp7SLpp7SLpp7SLpp7SLpp7SLpp7SLpp79nydaI2pmT:Xqqqqqqq5yda1U
TLSH
T18CC72909F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 59be24fb70b039fccc818fa72ad0b3bf45a21e7b2d377437eafefb2f75388950
MD5 c4ef1ac674b782f44f7616404969f630
SHA1 151227f56da071ac474d5d02ddb86e9f354d6dfd
SHA512 c64367b61871a51f2609a9eed362753e8200a18e8a1efa8df3fd4517df649b22323d87d62fc886da1687a1234da1eb2f2f0bd1ca7d5dfe4937a14a4712efda84
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBABBCABAABAABCCABBAAAACACCABAAACABCBACBBBABCBCCABAB.exe
Size 6.6MB
SHA256 f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654
MD5 4e98c61d828bd1160aaacf84cdcc1ceb
SHA1 b41a7326024af95c640507ef00f9d3072926f940
SHA512 6942af1ed33a2c16fbdc989ead3821d2cf701744b6a135ce6b71368647ac6947f485556ae416a003de05675537e0eb793c7b5ece10392d8b7ca8877d36be6297
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESM:7Lpp7c
TLSH
T1CC662909F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 9aeaa94dfdb020e2c1844651a6be91c054d5d4dd50187915efb2b60cf0c9b07a
MD5 ce3ba7facf43fca3b90ac77dab2bfb16
SHA1 1bfe56a28b5c22a8ae3211f48642bb449f8f76c7
SHA512 16f95b80fabde97d7659a33329a5e961f13def741178e9636ca6d6bd66f499b49fd9a8eb836fe0ca054a80391e9b9b20d6a876758f1b8bd58c8de94ed80b8948
TLSH
T182117B289CE4DC33FA33A4CB822A8BD208F4779BA81C9A00130A51287BDDD31CD554F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 e8f4d2b264e29f69e1d095ff7e72cc4c38262de32f8c24964eaad08b1c22c0c0
MD5 e310cd0a2dd3815c46f0605f2dc1161d
SHA1 0efdf01652470dc36b8077fa53c4553175eefd95
SHA512 d686f7df91a2a9e9b5697c9a0ea7c177967dbec91c2d17f65b827a52226e7316c87ea7f450af9c4678fa4c89a1e155c8de91ce55eb6fc2c967164cfbe5df0b18
TLSH
T148112B249CE5DC33FA33A8CB922A9BD20CF4639B6D1C9A40130A51287BDDD31CD554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-114-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3392-113-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4220-78-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/4356-75-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4356-115-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4356-51-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4356-36-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4556-112-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4556-0-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4556-74-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4556-50-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4556-24-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4556-11-0x0000000000840000-0x0000000000861000-memory.dmp

Download