c39ba8ff9186e48690b5b6d8f2a26356198b05395d51709e24fab9189c916085

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
Size 28.6MB
Sample260827-vrtepsxxht
SHA256 c39ba8ff9186e48690b5b6d8f2a26356198b05395d51709e24fab9189c916085
MD5 59140739a549f7bb56c852c48869499e
SHA1 5aaa1a020cf957dbe8f5ed5207ed2301ffef8f22
SHA512 1811a1f13d63760d85547d3436ef6c624d12033af388f7f4842376b416ba7edb1974fd174fa5401ee90892cf099b53b82fe7915c4c2f103b32587829d77ec9c4
SSDEEP 98304:8E333E333E333E333E333EE333E333E333E333E333Bp7a:fa
TLSH
T1EE674C45FA8680B2E42B01714C9BD3BB4B70BD254F129AEBF348936F6D33BD0A631655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
6020	svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
2972	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBACACCBAAACAACABCBCBBBABBCBCCABCBBABACAACABACACACCBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe"	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACACBBAACCCBBCBBCACACABBCBBBABCCABCABBACACCCCBABBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe"	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1556	sc.exe
1560	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe
1564	cmd.exe
1596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
6020	svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
6020	svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
2972	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
2972	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
Token: SeDebugPrivilege	6020	svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
Token: SeDebugPrivilege	2972	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 1364	5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe	92
PID 1364 wrote to memory of 2908	1364	cmd.exe	94
PID 420 wrote to memory of 5480	420	svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe	95
PID 5328 wrote to memory of 1564	5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe	98
PID 1564 wrote to memory of 1560	1564	cmd.exe	100
PID 5328 wrote to memory of 1596	5328	2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe	101
PID 1596 wrote to memory of 1556	1596	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_59140739a549f7bb56c852c48869499e_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCBCCCBAACBAABBABBACCABBCBBCBCBBBBBAAABACAAACBCBAAABABBABCBABBBCCAABBBBCCCBABCCBCCCBBBBCACAAACABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCBCCCBAACBAABBABBACCABBCBBCBCBBBBBAAABACAAACBCBAAABABBABCBABBBCCAABBBBCCCBABCCBCCCBBBBCACAAACABCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe" start= auto displayName= "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe" start= auto displayName= "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCACCCCBBCCACABAABBAACBCAAABABABBBCCCBCCBCCCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBAABBCCBCABABBCABCAABCACABBABCBBCBCBBABACABCABCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 abbc71a77405f396d3de61479205fd1cdb984edbbed7d927d2f1d37e03199a56
MD5 528513f38b8a2597a6d42301b70874d6
SHA1 14039d3211019cab5eff39cd1006268e0f236f79
SHA512 56601149dc540d76ee583ab44888b9d4b2b7234d78b419f837f3b49ddedc4666183c30ac4826affc037092deca0c13257df85963bd219d57e9030b90ef1c5751
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Network Inspection System\qap`g`v~dtlq
Size 10B
SHA256 30d60fa4bc06ead1a6ea1edbc88fc731c8301cdea0a41604f782a514614a5b11
MD5 1b5ef47c30ad3f9cd7670a8caa8396fd
SHA1 612219295747fd9f195cc3940a09211d8e65f27e
SHA512 c3464bf08c9e1e8790b769581419afe843c8308ef1e2abd8e29262388f2ad16861771d72dd05bd5d4ce4cda42c46d064f2b82aa081ab591cb3767f17a6e2b742
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 29.2MB
SHA256 0696e31f2ce2a1461f5221bef5d605936b209e787e56395dfc74a4da40b3551b
MD5 3eaf5d7df3caa92af76b7e663b827cc3
SHA1 dbbd12102d326a6c3712b8b05147f8b44ff4355f
SHA512 bc2a80684f1b14a3280051dbfc6e8002fe634b1fd8c588862a1dfb519ee3a9a6794afda99d8bb2b7517d5b86b0712b2b2a6e3699c18e5fa2a2d1bd2a0274b91d
SSDEEP 98304:8E333E333E333E333E333EE333E333E333E333E333Bp7dgZ2Hb9t+2xf:fdgZ2jf
TLSH
T1B1674D45FA8680B2E43B01714C9BD3BB4B70B9254F129AEBF348936F6D33BD0A631655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 79229706223490408851582327e6cf17719820c02febf18aee8df6938f388fc3
MD5 f7dec3e56b9f2d45820d0eb118bf05e2
SHA1 f1a204b6f0dfcada8f8b70d45ed2d002013b1f58
SHA512 60512184c92e62d15ff6b881e9e92a4486a23019b1fa94c98d8443bfa0c1dc827f0e0f52f2c4bea1230047af1fc1af60d7b66f55e8e03f325b93f5a75956a91b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\qap`g`v~dtlq
Size 10B
SHA256 369f7341d7028320cba331da25ec937c07c2bb3f16da6a7dd4e344cce1c08f3a
MD5 beab8f7904856c62990b4883cae85b7e
SHA1 8f45aaa920caa72129326069a02596680f446940
SHA512 b830b5fa6e3189f6c2e819ec2d5b017706c5e90e98847b902ef8850ba9bb22299174b0adec52bfdb0138f734efd3496546640b42e55da29cd6982c6eaafb86eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\qap`g`v~dtlq
Size 10B
SHA256 42b143f8afba67cb03afff9fe31c1105c3e0b38319423ae521ce4daf9a2a9eac
MD5 b22d90c69b97a1bbfde34ae9d82019de
SHA1 6e2afbae1b7ec9ee32d51d73d71d1868b87a1883
SHA512 dfc803e07ab0c6aa605f856c3068522d2497c3c7e8740c7a66cc34b09bd7792d7fbcbb4c7507d39d68fb12fd22c310e540f42df7556cf9d11b12701358462de2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 2806d18440ef0c3353e007b30ad9e7c83e04efc769fba960e3f3856979719a7c
MD5 2a22db54cc92347d25f3a4103295dcd5
SHA1 04050718654b3099b844a72591e14a660c5e37c4
SHA512 fa4da42eb8a8bf9d1cd57cffc6f9e71b85f8d050e5c10d96d10703915a783c0a70349dfb303ebcf1aaddc17e6f468ea0f32bdbfe257d116234219a21524ad1c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a6d448543798a89221d668f0df5f3c12a495866e4fcfe66daf8339da921758d
MD5 d41a4456bd4181cd794cadc35e0cb4e9
SHA1 a100dbd7f50e9585373113a2722042e394a85095
SHA512 5c91e7169e5dafd5e82086c3950fc664afcdfac48caa7b7e1474297d0adc13667614f10a7ff31249ffc5b0ffe7ddbebc661af432b38672563c7b5a7e69ca6e6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 746ee33aa6acc5e7a1931cc32a5e681416bb7e27bf8c3cb55cf304c970941f91
MD5 f90636a2951435c94b3fcfec46030344
SHA1 beec7cb5427e105ee788a37ba73ac3ce8165cf60
SHA512 f2db769c08f36c724269f1a8079e2016175b8cb6f19fe1471696ea401eabeceec51abb02b86eaebe5096d410b72ed8bcf4612a329101428b02a2c577cde36af8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c52e5cb40d14ffdf8592863519251306b7ac8625a2d47b67ea0163933203471c
MD5 5140d684dd7ac7b0aa30fe179cdc1aef
SHA1 b7c1227f6cb6aace6dac70c5a76b83e47b8b36b1
SHA512 693bab2afac7bf2a4bbe1b180085c38434df1a6c7a3aa300921f5ba02f0748df1ac337ee4c2703462a472d4b93752bdbade4ac6e31f324652baf8499eb96ff38
MD5 SHA1 SHA512

Submit Download

svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABCBBBABACBBBBCBCAABCCCBBAABABCABCBBCBBABABBBCCABCA.exe
Size 28.6MB
SHA256 c39ba8ff9186e48690b5b6d8f2a26356198b05395d51709e24fab9189c916085
MD5 59140739a549f7bb56c852c48869499e
SHA1 5aaa1a020cf957dbe8f5ed5207ed2301ffef8f22
SHA512 1811a1f13d63760d85547d3436ef6c624d12033af388f7f4842376b416ba7edb1974fd174fa5401ee90892cf099b53b82fe7915c4c2f103b32587829d77ec9c4
SSDEEP 98304:8E333E333E333E333E333EE333E333E333E333E333Bp7a:fa
TLSH
T1EE674C45FA8680B2E42B01714C9BD3BB4B70BD254F129AEBF348936F6D33BD0A631655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6e5c1e1ce35d96d1f960cd9c72981b1162c9634afd64d6fd358d937b3a88c0ed
MD5 5a4715c08ef268b810004b63a21ba04b
SHA1 291129abb037298eae69d4fdb26a8fcfb8c3f07d
SHA512 65353a60981f0b4f3c1d656425e98c86ccae91fbed16b86a0e2afd199ecac8ab1e79de43cda5c58d43e101edf1545f3dbbb88488de2d54006dc60b49232bdaef
TLSH
T1D811AB5590F5DC97E83264DAA511C9C328BC36DAECACAA54630D0198B7C6C35CF551D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0a4e21fcfae6f6f94da921a4c4141dbcaba0bda1406d5a5f8851b54433d616fd
MD5 e0768b9e0c46c77841f1b471a21ad37f
SHA1 3ffb054269151065e466f8257a595efa5392d66c
SHA512 20f955376161e01162fa34334d0c583a64dee6357148bcb5129873d9033830144faae5ec998b65f9ee68416cc3b8286e5a0d858465a6f066e37d76b37be4380a
TLSH
T15321C96590F5DC97E83268DBA221C9C32CBC36DAECAC6A5463090198B7C6C35CF551D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-31-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2972-905-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/5328-0-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/5328-7-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/6020-78-0x0000000000280000-0x00000000002A1000-memory.dmp

Download