f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Size 6.6MB
Sample260814-e4tcgavcnc
SHA256 f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654
MD5 4e98c61d828bd1160aaacf84cdcc1ceb
SHA1 b41a7326024af95c640507ef00f9d3072926f940
SHA512 6942af1ed33a2c16fbdc989ead3821d2cf701744b6a135ce6b71368647ac6947f485556ae416a003de05675537e0eb793c7b5ece10392d8b7ca8877d36be6297
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESM:7Lpp7c
TLSH
T1CC662909F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
3920	svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
2068	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCBCBACAAAAACCBACABBBBAAABCAACBBCCABCCAAABCCBCCCCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe"	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCBABCBAABAAACABBCCAAACACCAABCBAAABBCBCCACBACABBCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe"	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2428	sc.exe
6128	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe
5960	cmd.exe
4252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
3920	svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
3920	svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
2068	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
2068	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
Token: SeDebugPrivilege	3920	svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
Token: SeDebugPrivilege	2068	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4344	4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	95
PID 4344 wrote to memory of 1480	4344	cmd.exe	97
PID 2576 wrote to memory of 5804	2576	svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe	99
PID 4336 wrote to memory of 5960	4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	102
PID 5960 wrote to memory of 2428	5960	cmd.exe	104
PID 4336 wrote to memory of 4252	4336	2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe	105
PID 4252 wrote to memory of 6128	4252	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e98c61d828bd1160aaacf84cdcc1ceb_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCBCAACABBACBAAABBAACABACCBCCAABBAACCAAACACCBBBBCAAACCBABBAABCBCBBCBCCCACBCBCBBCABCBCBCBBCCACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACCBCAACABBACBAAABBAACABACCBCCAABBAACCAAACACCBBBBCAAACCBABBAABCBCBBCBCCCACBCBCBBCABCBCBCBBCCACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe" start= auto displayName= "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe" start= auto displayName= "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACABACAABABCBACABABCBCAACAABBAACBAACACCCBACBACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCCCCACCAAABABCCBCCBAAABBABBBBACBCACBCBAAABAAAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 edee72219e97c3dc607c7cbc5eccde605c8d446cfe2f8404b131e757d3c3db8a
MD5 061ca68412804ce98059035075bd9f5a
SHA1 02766f3f4d93f68329e6f92ff22f0580ff84306c
SHA512 830e1a6d03f70085af469e372b9f87423a3779fcc7752a229fc05ba8fc7be4c8aaee0efe58f093454418b6aeaadbb097720a549eadcc831d7da5157f9ee5f107
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 cbd39dac5e7d5cf5894ad1567f817c43ba7a1b7148a1a29e30774af603a8405a
MD5 cb1a6556356d7185a1fc97864682cce3
SHA1 fe10f2f7ee26fbb9418cd3fdf770eab8bcf980e4
SHA512 0000ebd4a5c47e59d5b7533b43c1e0bb060b267fd756f09e916c49015bb18be406e7260b0322c911266938df3ac4b180f1028fd106524f3d9b8f8ddef76160e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 078529839db5cd0a2abba1bfe3000af2ef1017948ee35f162da14ac994765a09
MD5 c56ab1f16f4101da2a170b5e9575028f
SHA1 b44228a8d8fa93eedc98646c3765be5ae500eb28
SHA512 3c8ece30f13dabc8fef9309757ca73b9e964210104562b86ddf03dc3e9ecfa2c016609c3295ed30763d2407deb2cbeb47c64620dec0d1312d9bf928689183b57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 75d99cac47d64fef1c392dede934aa569336f7db7b9be218a9ca407029b248e0
MD5 e25a42d2df23342709e28886f2bea025
SHA1 66fc1aa4dffb7d99bc0783a637f8c67d05ff8d41
SHA512 a8fe46a6dcc6d1865632a6ed455611c37f399eec20d17f7ec799d062b56950651b9f6fac79faff2524dc2e10b7f14aabfab619c3754043a557259864e3f094ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 1c82c95356c5c15139e2ffb49202d1ee1363f177d2d2a7f49ca0353208829b3c
MD5 2146c1fb43c0eb9ebfc051880099d717
SHA1 4492ad4243f911781dc5b6cd3b8bd8697d7a2bc6
SHA512 64e5a2dbc3ab946ef373c82b2babf09c8578ba0acaf11d164502215025b43c4349fd12e96dff4cc580b3fdb2cb4fb407d358faaeec814baabc53cfa988f95183
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ar\qap`g`v~dtlq
Size 10B
SHA256 44cae51ff2b9014ed476613e7d0d1e4bdc4d79b16189719866752540d60aa0d9
MD5 e24adb55842f8d8a7a5d6cb8105c2daa
SHA1 66a167e2cb0a40f898167edbfc627b9a087ec3ec
SHA512 a1967b787cce24c1f2ae9f2f048f17ef774371f9a064b6888b52838a78aee5a7d51d5285e473bd8586aadd87e7c18c976a749d43d3361125f03e79930fffd31e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 d654313d91fbbb6dc37be5b22bfdf11366cfd3734d16734a2c703aa73d973c85
MD5 ab5134e21675edafba4073131b5fc325
SHA1 dadf7f900be12e35cf2c9b83f20f8cbb011b18e8
SHA512 8a7c11469c50d898e67821e253d1b834a3c83332e736856ac372c4d96fa25300ff1511ff062811ddfd08b19f8061205d104bac8b8e721e3005a2d62dae68c539
MD5 SHA1 SHA512

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 20.5MB
SHA256 70acfa01d296bd2df187a74bdad9d9fa5acc4c2c5ae87f30e2fcb0e8233c4b63
MD5 c35480fd8b83a02204bdc9f7689d6121
SHA1 04ec44fdc4c8366957837300c1ea04a95d8e19cd
SHA512 b4966b4c1a84633028cdbec8a8bcc91e58dc0b3c893cc4bbddcb9743c262f3dea4b980f4538b8624fd87937cf57a4a5e34aac8d9ee2982da95813f8c2864a3f1
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESA:7Lpp7SLpp7SLpp7eoj8sl/rc
TLSH
T164272A09F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 4.9MB
SHA256 f457f35a6a0b8404c0875858ec6b58c020eb93529a5a4ff9c6ac9a2ca88832f9
MD5 eb99fe429277267fd50d4556d3730819
SHA1 526cac348ffe52ee1c0f8128e63b9c579917c803
SHA512 44579546ceeb4f194004f84c8c40603e550e98bf53737627c02fc51d568e1d161616fa61a12a5c9c4c5c27157f07f73f7ae3499d584e19896cba09d3625fc2b5
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESN:7p
TLSH
T19D362A09FD4340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 128KB
SHA256 f5f693e058e5b9de1d715e326d4973cf8f7692b9e34f1b85f5d2e107d964d631
MD5 4a26c56decb83bc4352362a5b761a48b
SHA1 d1bc649b5cfbbe02c4ae1e37132cdc3db8a16b93
SHA512 78f8ad7192bc145d8eb0bc35e04a3dbd4591e708367fb80617235b3ded65751c848e019e502396c8f21517dc8df661d7d0cc954072daf8e13db4d9c975e74879
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFph:m+dTTUFgEs3XojAdP+dTTUFP
TLSH
T158D3F909F98340B1DD2F50F04DCBE3FF8A60BB25C5128EB7EB4DCB57A922B616428559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 1.9MB
SHA256 4d4d254a3ccf2d210652a98dd1615eafb7662bed7fe06978223a35ce5cd73e31
MD5 b4d9648101c1d02de3cec3b4bf0582d8
SHA1 13a2f8478060e7efc6005b02db62367f29ce21b4
SHA512 49a29b0263eda3fb08f6abf5dfffe23f487c9c1c9dfaa4cdbf7431c9cbd4bdfbb5f369ae6955c523ca6ebaded69dd589fd8ed3858402a682430ec6cdbc6e9c65
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESL:r
TLSH
T147952A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 192KB
SHA256 425ed9e8a75ff13b672e1a39abc75e0b5deeefe3cb0da59b981b2cf0c6428aa3
MD5 f9db7ad27d2c847b10e3280a6a67d457
SHA1 893fc855cd936b1856b4dbadb41012f807c1f289
SHA512 b30467a7dad9aa3b5e760cb3dffba44affa420b4ae90afed516cb212f66d8d4d6c9d12caf8a50857b819995aea8c448c164d8de1a583e7f470f6d4197bb775f5
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vd:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAe
TLSH
T136140809F94344B1DD2B50B04CCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14083843303b9e7bd9413129a7e66f91b7cd02042dc56508d9f0cffdcf1a181b
MD5 23f0fec61e937c0daa024e5d93f2626c
SHA1 b211b097ae3df59c4f31f313e563d6cc8f9babe5
SHA512 ddc90bfff508a26e5c779cb44dbdee50b30c079ee2879dc2055f76dc9f577b3dafcbad01dd12a23237f6651c8f14a86b6aa5bbf3bd5ab3d9fa5662f1bc055dfc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 167a8fc1b2cbbf16f3978f182dbb3ff751e498f897a48f101f9c86dd5b249920
MD5 24f2c1fc1720c84c9b84ec904d5fd415
SHA1 4354643b84c73b14a50022790ebd4d7a44c29800
SHA512 0eb59c42551d8ef2f2135775610d16f743b1ad7dc0a1a741c263de5a04c10288045faa1e252b01be181d61d72a136959e6268c7a676d5cfeb0f6dc2c849d2c2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66e0bb2d7a356a44eecdf36afab16937b2b3f3791265ff1fb6c9637864cadc9e
MD5 c3ddc1c2804ed82ae51b96c9b728ade5
SHA1 3c2474018f2c3cfdaac62205e4e2cbb717daf10d
SHA512 80d430320d34f46c979d408b1c2f2f48a8b868264d0e2ea714adaee1137c41496e52337e7479116b7d4cd0d0c1729a5f076a49f3c1ec656cc30ea2161a74f7ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 98b284f6fe3db50ccaa0430ae8fde2b473bb2277b3a0fcb1552c8200cea11522
MD5 f47c17d1e03833f23680a45133ad522c
SHA1 7d5069787dabf9eebc8e1b0182164157ae1e327d
SHA512 d1abaab16fc8aaeb2ebeb6b8fe1ce2187c2f468d121aa6e4c3aeee6c088c52affe3ae2a41854f78d9b10601b47e6d81e41032c2e40d6ab5911f30e00d4b70eb1
MD5 SHA1 SHA512

Submit Download

svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCAAABCCBCBAAAAAAAABCBACCCBCCAAACBCCBCCCCCCCABCCBACB.exe
Size 6.6MB
SHA256 f22fad0211b35ee265b94c4b308bd17fd3af2542c68d9ed54f177032c4857654
MD5 4e98c61d828bd1160aaacf84cdcc1ceb
SHA1 b41a7326024af95c640507ef00f9d3072926f940
SHA512 6942af1ed33a2c16fbdc989ead3821d2cf701744b6a135ce6b71368647ac6947f485556ae416a003de05675537e0eb793c7b5ece10392d8b7ca8877d36be6297
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+x+ES+ES+ES+ES+ES+ES+ES+ESM:7Lpp7c
TLSH
T1CC662909F94340B1D92B11B14DCFE3BF8A60BB2587128EE7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3ef43747d1bfb6e868881569a7e8caf2a4996fd9605b9b8653f52f0899f88809
MD5 c6853c615c27b1cc7267310270e2a2da
SHA1 9de163d83520c3f4c660dfa3464ff808a2293f35
SHA512 04fb564a00c32e6c2cd10783e53b822f66506f32bc8566a9db0635ea06b2d25ca0afb169746f9079cbb51ae90aa7c4e3cd11f0db50146e0d773e72c1b237bd8d
TLSH
T1EE210B65ECE5DC73E93368CF821E9B920CB4778F9D1CAA14130C4128A7D9D32DD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1c7750637e730337320d2e4e0b569fc6f834d5bfd11dfcb3bdc00b0a070fbc4d
MD5 a87094c5feb5d415284870630906b168
SHA1 73e997e411c657c76c7ce6e91e17fbb0289f6952
SHA512 b60eca0b00bf5353965f1d56639f9f113242ece78e8133b3833d5e14c9d8a9e258889f6ecf864393d0cf843e70fd1adf70ace560a8c26fd8105527f1849507ec
TLSH
T1B9112B21D8E5C873E932288F821E5B920CB4738F9C5CAA08530C412CE7C9D32DD558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2068-420-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2576-107-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2576-95-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2576-47-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2576-69-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/3920-105-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4336-48-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4336-0-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4336-70-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4336-22-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4336-11-0x0000000000830000-0x0000000000851000-memory.dmp

Download