21d527756ad823c9f260fd4f5cf6a7620db5cec54ca321e95e2bff9e9ace5e5e

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
Size 3.5MB
Sample260815-b455gsxtdy
SHA256 21d527756ad823c9f260fd4f5cf6a7620db5cec54ca321e95e2bff9e9ace5e5e
MD5 299234a9afe4392f281bb75c6899cfdc
SHA1 b4c3779be8d6fe9cc7d42797cb8b9da71370253d
SHA512 a53fb97e0958a57fbfd73b2f3128b51583fd5e132fcf3acace8c37e5d35e926745272cbebf1c1809dba2538fe8d431385eab1d6eaadb67d0181cf70c2cc9847c
SSDEEP 49152:U+E9oqatgl2+ES+E9oqatglxW1PszNsQy+E9oqatgl2+ES+E9oqatglxW1PszNs7:1fMW1PszHfMW1Psz/p7A
TLSH
T1AD067C42FBC58072F5731631487B92B61A76B9110F31C69F6388566E9F33BC0AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
564	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
2608	svchost_CACBABCBBCABBCCBBBCCAABBCBBBCBCBCBAAABCAAAACBAACAAABABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBAACCABABCCCCBAAABBABCBABCBABABBACBBBABCAACABABCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe"	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACBBAABCCAACCACBAACCAAACCAACBACABAAABBBCACCBBBBBAACBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBABCBBCABBCCBBBCCAABBCBBBCBCBCBAAABCAAAACBAACAAABABA.exe"	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3708	sc.exe
3056	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5836	cmd.exe
3400	cmd.exe
1404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBABCBBCABBCCBBBCCAABBCBBBCBCBCBAAABCAAAACBAACAAABABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
564	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
564	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
Token: SeDebugPrivilege	564	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3400	3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe	92
PID 3400 wrote to memory of 4452	3400	cmd.exe	94
PID 3256 wrote to memory of 1404	3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe	95
PID 1404 wrote to memory of 3708	1404	cmd.exe	97
PID 3256 wrote to memory of 5836	3256	2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe	98
PID 5836 wrote to memory of 3056	5836	cmd.exe	100
PID 1204 wrote to memory of 3744	1204	svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_299234a9afe4392f281bb75c6899cfdc_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBAAABCCABBABAAABBBCACAACCBBBCAAACBBCBAACBCBBBBCBAACBCCBBAACCBCCCCABAAACBCCABBABACBBBBABAACAACBAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBAAABCCABBABAAABBBCACAACCBBBCAAACBBCBAACBCBBBBCBAACBCCBBAACCBCCCCABAAACBCCABBABACBBBBABAACAACBAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe" start= auto displayName= "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe" start= auto displayName= "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCABABABBACAABABBBABBAABCAABBCBCABACABBCBBABCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABCBBCABBCCBBBCCAABBCBBBCBCBCBAAABCAAAACBAACAAABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABCBBCABBCCBBBCCAABBCBBBCBCBCBAAABCAAAACBAACAAABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d5b06848cdae979ecea8cb73ef8c83213814deab8ca7e906a8f26ec578a3c027
MD5 cf6a892f2b53adaf6bf74662d1ad9aeb
SHA1 a45b2df6e6712e84fbb329601fa2eb9c5353e922
SHA512 f64ce60ffbb6a182710107d28e0f5f540f4cf52a08987dbd056f6c5cb93eed60ba7552c50311a861a6b3db62e7ab9c546f47ce479406af9d659a8ee700be1596
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 400afd3d9ddbe7a8de3b5e009a5700ae993f11be32304e64e5ad9ec2296a1cd4
MD5 8dcdeca4c546e7529862b5c5d42eb3db
SHA1 5bee6423266eb8f5f89eba5bdd66cb95f74d8120
SHA512 8dd9b5ff332d9ca5ca1b2e307d8de68daa491cfed9791b612882ad73c0f303c58e556b5a173e39a59c649d3081c15c5ff07910b9b7eb02687e9c9e8423c29759
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\PSScriptOutputs\qap`g`v~dtlq
Size 10B
SHA256 95069b020987eb5dae8db4125d3ecdc260fe5f56ad10f959fc2367b939a3deda
MD5 00de59a67987c31844f590f4c326cabb
SHA1 32e8ff268a36fe9affdbd4948a8a61d78e5431dd
SHA512 1d98a222a29bbdeb670c80d0a5db3eb1f796e1655b2c0044b0cda03a65c1793bc11bc0604511a9d142a4befb03296eab38879a8c3b21ec292723d5cc80c04c94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\qap`g`v~dtlq
Size 10B
SHA256 e7c5e76941c3b4c891e411b919441815fb8cbff92dfe0eb606648be0f2a109bf
MD5 8740cca5ff659195dc9fa85d2483b2a8
SHA1 1d8695c9d78d0af42f44e5b5be654f59a0fcda41
SHA512 82e8a1c725f3848034b545c1124fb72b08988bb15d51aaa7c5df59c77c51c4877d5a1f84c99cdd30427c5e70fc8913f594614024401cb6e2599f974806e96279
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.1MB
SHA256 5a03db92da35a6d0e79e2e079b851c916d2db49eb57d324c22672e4944f40879
MD5 0f66f04b0da2ec21c25ea4ada49e78e8
SHA1 e8ab43c5e6b1413ecf5231adcb49b31e8e3cb380
SHA512 993f7fb540dd113496df33e82f6f1fc9b64d9b9c552c69f6176a0d6896736ac0bd03159a8289b2f1368723db2ba08340f9b27a786d007f494b9d610399558112
SSDEEP 49152:U+E9oqatgl2+ES+E9oqatglxW1PszNsQy+E9oqatgl2+ES+E9oqatglxW1PszNsj:1fMW1PszHfMW1Psz/p7/gZ2Hb9t+2xy
TLSH
T10C167B02FBC54072F5B31631487B92B61E75B9110F35C69FA388662E5F33BC0AA36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\qap`g`v~dtlq
Size 10B
SHA256 5677e4f03d143c4742ceb5e7ed2011e4d5d23839e62de9f7b8dc3786f8245761
MD5 a076b9e9db8bc6bc63e67573d5ee9469
SHA1 1ffe51166dac376c2d4a393b65d3d5b05e9041fd
SHA512 3703541d4956d3bee700a28f236b6f5ff8bc4d891f56b47540c1754b249ca668ffc48499762c61f39ba41ffc898fdc061c23799fa23e948adf507cb107149d5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\qap`g`v~dtlq
Size 10B
SHA256 3ace4d8bb9e58a8920f1b0134a6655e811e9b5842597656daf1c4f474dcaa8e1
MD5 a1db8ae1ac18cbce0cbdde8786505d14
SHA1 b2d046d4fdfb6a2d6100dce3c96e2a662c5f738c
SHA512 ccca10f39be584fc0f2829f5c23255fed54f28ec60cea81760e6da3466c0c1b6ad338c1ccb063758daec79af5606c3a7aa4edee0fd7c7ddcd731601efac84896
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\it\qap`g`v~dtlq
Size 10B
SHA256 ba07e1158969f9f04836e8ab2d1b5fb1ab66c9a7a3f992697ce3005eff70b843
MD5 163e20cc23e34c3d0e774dfb0362260f
SHA1 5c924aa845b93f3dd13f1cb3bfefbdfc996404c5
SHA512 388d2d71f6734cce15c8aa1d5c8e40902f3d2a74cbd24a647dfe1a804a8b9a293c363861e7694fca2e3805d8f0a151a93253d4a025b0e446ab1a99d39a0d5123
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e95b7381be2307a0f40fa06a069e15ca5261857ea23049725ef94b61efadeb2
MD5 38fcc363ecc7ecf2263ecb08ea2edc51
SHA1 26bc8d618f3bf527aa5bbf000f926ddb199f0700
SHA512 75daa85236170188facd68bf322e9528fd2d466ab42dd01fb0d5fd937c8742df4047e2c913de9d9a699fbf1200de392c4557ec70bb944d44511cb1e336597da2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27b5f524ceedccaf1a24503faa2791213510bb78eb25bd0656813e0f103c4f5a
MD5 9fb37d7a3dd76840f774655ae16dd10b
SHA1 21a956752941385b8b8371821517beedd2316e0c
SHA512 7679e414e61abd58f80e50d35f170a044d1a374e51230aca23684714753f69a83334dae484c6986c87c32e3930c6a057a950c5fc98a1c31d5de4edbd1f4c3240
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 259278d044415866351096c4420fc9a5f34316a16e79bd167c210f14f91ec498
MD5 fe68215c6318625dfa783d54fd5026d6
SHA1 dcefbda5a9e31492c9a91d79447abae88393e524
SHA512 ff4352214fd466117dd004fa08a084bdbc19e1582068c7fa6535efe33dbf0fe35bf23bafbb7b9b9f4b17cae8484ff6ff56b553ca668ee5ce1dc0583c9c04bdd2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dea580370bf255f5f1432d2c69d537b012e08e86adbe59abcef4716466719243
MD5 f791bf35db98b0839361f36807ac29ad
SHA1 db231a9de68ab6abba1c27584775365332850a23
SHA512 e3a8023aecd166fde301e6bb585fa88175658e6d4087ca237689f4982faba3cf741355b26c685be652f9b972fdd55880d141c7d18d0c8aba0f54b660c55645cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7dc9ce5326074abcad4b9e3792a8ac9394e74fe3580f584290ceb9b1510a6278
MD5 abe5334587fe6491a5da2bce37c1f4aa
SHA1 24bf66e9d7b69a5451b8e5b0ed96a0614dafb16c
SHA512 b4a0748656ec4fdb9b7482208ab59dba001b840da488f6532b00db2e05856c564db2043126b47eb645c7307ef7bae52ae051365e4f5daee074329b43bfb7f43e
MD5 SHA1 SHA512

Submit Download

svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBBACBCABAACBBCCBCCABBCABCCCACBBCBBCACBCBBCCCCBAABCA.exe
Size 3.5MB
SHA256 21d527756ad823c9f260fd4f5cf6a7620db5cec54ca321e95e2bff9e9ace5e5e
MD5 299234a9afe4392f281bb75c6899cfdc
SHA1 b4c3779be8d6fe9cc7d42797cb8b9da71370253d
SHA512 a53fb97e0958a57fbfd73b2f3128b51583fd5e132fcf3acace8c37e5d35e926745272cbebf1c1809dba2538fe8d431385eab1d6eaadb67d0181cf70c2cc9847c
SSDEEP 49152:U+E9oqatgl2+ES+E9oqatglxW1PszNsQy+E9oqatgl2+ES+E9oqatglxW1PszNs7:1fMW1PszHfMW1Psz/p7A
TLSH
T1AD067C42FBC58072F5731631487B92B61A76B9110F31C69F6388566E9F33BC0AA32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 614686e75be20ecd5fdfa3385fb4f36b21a27f1609fa6b980106ef4ab742998a
MD5 ba118e72d8ab6a175bbae34bb6b688da
SHA1 02f25e5042d40d4e433bd30d88344705d14b4e8b
SHA512 b1e629002abe455736ccc222d8bf32a3c88ff8a881d3e1eedc55165f6002b23fdd494eb674709b3fd8944176f2747c1e7f7d5bc32163e85f2ae0895d7d35ca45
TLSH
T12211545064B5DC53FC32A89BAE2ADAD25CF53BDB9C5C6E14230C521DA7C9C328D158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 834B
SHA256 d496d2e8568eda0ffba878e97a14c0449fe52555cd6dc7e23a26d425f1dd475e
MD5 5cf300b9740e3e24fd01bd2849ca960a
SHA1 6e77432dd8d959871ef86289ea45093f151d735a
SHA512 e8cc21b08c66a469b4557db89a1dc595e074ab6d69d21f54ad3a9874ff1a61d66590ee461b9bce1c5ab4fb5bf3f8c7ce82e5c99401d1fb2bc214a7a101fe7487
TLSH
T10201525064B5DC53BC32A89BAE2ADAD35CA43BDB985C6E14230C8219A7C9C328D118F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-3015-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/564-3893-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/1204-35-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/1204-22-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/2608-3892-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/3256-6-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download