2a9efb49e134801542fb1e6e7f37bfc478051358acb157003da12f1e0b71ecfc

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
Size 3.2MB
Sample260830-2bv2xsttb1
SHA256 2a9efb49e134801542fb1e6e7f37bfc478051358acb157003da12f1e0b71ecfc
MD5 04a280157d425b9e76615feb204fc1d3
SHA1 2f24cca4c375924ad093b619c12acaab8acaccc7
SHA512 c64d70aca2d060bdaee24a968a972bc83229df4835442f3b2f6e4c9585fefbf54a3c5ffe537af60fc12e4cb2adfb98e19cbc4ab0a7ab7c38629bb120f31938e7
SSDEEP 49152:U+ES+ES+EIz+ES+ES+EIz+ES+ES+EIYqatgl1+ES+ES+EIz+ES+ES+EIz+ES+ES2:UAFp7w
TLSH
T162F53B05F98240F1E477117049ABD2BB4A71B9214B218EEFE78C876F6E33BD0A934756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
4104	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
5956	svchost_ABBCCBCBAABACABBABBBAABBBBCBABABBBABBBAAABBCBACCBCAACAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAAACBBAACCABBAABBAAABBCBACAABCABBACCABCABBABBBBCABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe"	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACAACAABBAAACBBBCACBAAABBBACCAACCCACCABACCBABACACABCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCCBCBAABACABBABBBAABBBBCBABABBBABBBAAABBCBACCBCAACAB.exe"	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5368	sc.exe
1456	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2324	cmd.exe
5552	cmd.exe
5852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCCBCBAABACABBABBBAABBBBCBABABBBABBBAAABBCBACCBCAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
4104	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
4104	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
Token: SeDebugPrivilege	4104	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5824 wrote to memory of 2324	5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe	92
PID 2324 wrote to memory of 5164	2324	cmd.exe	94
PID 5824 wrote to memory of 5552	5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe	95
PID 5552 wrote to memory of 5368	5552	cmd.exe	97
PID 5824 wrote to memory of 5852	5824	2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe	98
PID 5852 wrote to memory of 1456	5852	cmd.exe	100
PID 3284 wrote to memory of 5080	3284	svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_04a280157d425b9e76615feb204fc1d3_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABABCBCBABACACABAABCBAABCAAABBAACAACCACAACBBACACACABACBABACCCAABCAABBABCAACABCCCBABACCCBBBBBABCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABABCBCBABACACABAABCBAABCAAABBAACAACCACAACBBACACACABACBABACCCAABCAABBABCAACABCCCBABACCCBBBBBABCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe" start= auto displayName= "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe" start= auto displayName= "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAABAACAAABABAACBBCCABCBBCCACAACACABCBCACCCAAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBCBAABACABBABBBAABBBBCBABABBBABBBAAABBCBACCBCAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCCBCBAABACABBABBBAABBBBCBABABBBABBBAAABBCBACCBCAACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fe9d3cb652ab1adaca13b7441cf941a8d48469265f44dfd07417ce1af46a37d4
MD5 affa9fcf8807f20be1e5ec26638cf0fa
SHA1 463317b137f2e857718ab9d99d7b829b6780cdd8
SHA512 d447d9b05cb60d2bcba6882b208063b8da6d4dbf4d526d79ec21ed3d62d39355c3fccbd748d1848ec247232375697bd7f02df1b8b768c3a2bafefded8b9b8d46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\qap`g`v~dtlq
Size 10B
SHA256 e2a7580f02eab6a715985e81ae32b97ec807be0e263d93ebd450254c8a8ed709
MD5 ab91ace1bddbf9cfddc3a43b93843321
SHA1 24b4e6b443d3cdb173a4d2e052c099d4d1198e5c
SHA512 fcc549e66b4a6e7d541c4356dbfe4e1f87dec5652e4953c79d876c9664b457e78c6161f0bc39ec7f0f5046e96d32b06369b99d90cc53fa98a9f08f5675ecb70a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.8MB
SHA256 28967761315ef6fbcfaeb5e49a217f67e008339095a749ce7af8167e019d496b
MD5 7cd698a04ff5cc8a6ef992161713209d
SHA1 258a8c8b0d7d23c0a15a1d7c156843a9dbb2a558
SHA512 57c9188545542b298055c32f87e69da5558c8afd6754b5d4daf19d3585e197c071ae6b4213d7e83ef5620e239b2e433cdc0b932fb6f76038370a0063cf812bd8
SSDEEP 49152:U+ES+ES+EIz+ES+ES+EIz+ES+ES+EIYqatgl1+ES+ES+EIz+ES+ES+EIz+ES+ESe:UAFp7vgZ2Hb9t+2x0
TLSH
T137067C05F98240F1E47711714CABD27A4A75FA214B218EEFE78C862F6E33BD0A935752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\qap`g`v~dtlq
Size 10B
SHA256 cbe8c4dd3e520544d9ad9ccbf74357da34df9d42e3a68092805b9e1acd3b30dd
MD5 fadde6c985c57159bec0fce665bb5b9c
SHA1 5f4280221f06bac0c8fd14ff73cbf806a3e9ac69
SHA512 5f59502f177b16957c126e9aa5cbd3f3974ca4c037cdea1730ded74f1005fd88f56554ff7603f72356d86afd50a4ae438a14e86b64543d26b6417f68add703e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vi\qap`g`v~dtlq
Size 10B
SHA256 ab9720f401f4c4e63605ddd3a3c0305116dec045f74806c0dfbda11628fff4fe
MD5 90b823407d657182fda961e880c45bfc
SHA1 b0327f077b71dd060c6fe7ddca7bea19620bda49
SHA512 a91bcb3da4a04a970d4c480bdde1fa1bdfd7dc63121bb437f9c6d9caa7b13620d181ffac45f12d0c4aac066a773d8ced34dac99d9f5201626d71b0097430c63c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 1d2ddf44084477bd841967206a251aa478b0726fd69eddd81d340a3133e50c3f
MD5 5fe6b844046757d63e9f1ba0ce58b05b
SHA1 b57af7b3fed57c03809dface7d5439afb2fe413d
SHA512 50c0c9f3f5e87ba1866bef52b02c891ce38dc714664502b52634ae7c95f0d5c1a454233088cd8dff69b576492bf014176e16c0ae00c786cf7b283a48241151d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e00fd46887393d97ab0cd019b08c7e6b437e87a030824153e3d621e86a21b964
MD5 a5c67722431a7f41b0aaf5c31f120924
SHA1 0cb1e3db1a3ee6a76880daf29921cc4efa8ffba4
SHA512 85b0e7669681e66d59b490f144a5f18da82ab92b9faf117da12e4a09ef61d4770856f3922673b016633b1e8b9cab4f68d1ecb97b773b16a858c46dfe04ed7fe2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ce8c04f029146f134131500a4838f9afb3b8735b80c3c38bb1d219d6029b88d
MD5 b44e6419c8eb6862bbd12604552a16a2
SHA1 50b6b2b186d431691ecce36856c0596f047c8f93
SHA512 5a956049ba522a01f2fd662e71432fa2fb908e403ec078e055dcb70a14d7f01f3665d203b7240a0560a53bec7f39da5c9c5d633ac40473c095636e8dd1f8e2b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f97d7098285b6a7a945da7d73718ed3d9e010058a92ea030bf81220c8753494
MD5 078cb6f7bd09e30256ea56e37a10f0fd
SHA1 934a37744acec70cd7269a05da9b0b65fc1299c4
SHA512 645cd9ab530da925e6fbe577da62ef977a69a0a8f233d55b85b89582bbdd11117362f6b22b3e658aa2bba9410777349990378f713f60f2ab181159f904d2fd1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6734cb53e75cbff921348f03123a566b208d8be0c46bc5b8f3d845d512ac47c8
MD5 b00692a046dc975ca953aa9e37871722
SHA1 240a58fb6459fcbaabe396fdae61e2a3ecd1043a
SHA512 dc59ef3342bf6c4592fa7365abaea17431a12eccd9441a29fecf24c793c26bad889e740900d9a062e165cfaa377ac9c5dc3ed4064a69b621183be7a5b4c1019b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 0573306b406c0f45e5efd6eb97cc7968484ffbaa6980573a3d90bd187caaa64e
MD5 b78d7ccc64551f8d7d705f06c0165bf9
SHA1 9a6f27d65180bea934528400ded09229369ca1e4
SHA512 cfd35d8d2bf0dfe1fa2f5ddc257b01ab2db812a112e80afa2c842aabf08926e995670b3d15e761b2af862e9e39615f590804e0e45d8261f8dcfad876cff6ae47
MD5 SHA1 SHA512

Submit Download

svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABAAABBBCCABCBBCABCAACCABCCABABBABACCCBBCAABBABCACAB.exe
Size 3.2MB
SHA256 2a9efb49e134801542fb1e6e7f37bfc478051358acb157003da12f1e0b71ecfc
MD5 04a280157d425b9e76615feb204fc1d3
SHA1 2f24cca4c375924ad093b619c12acaab8acaccc7
SHA512 c64d70aca2d060bdaee24a968a972bc83229df4835442f3b2f6e4c9585fefbf54a3c5ffe537af60fc12e4cb2adfb98e19cbc4ab0a7ab7c38629bb120f31938e7
SSDEEP 49152:U+ES+ES+EIz+ES+ES+EIz+ES+ES+EIYqatgl1+ES+ES+EIz+ES+ES+EIz+ES+ES2:UAFp7w
TLSH
T162F53B05F98240F1E477117049ABD2BB4A71B9214B218EEFE78C876F6E33BD0A934756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 834B
SHA256 3def79f546bafa4093297049ec9c2019aacdab43f619ae913f8d87d1c00adfd2
MD5 c4be49a6f92d176d21260ae72751b6c3
SHA1 2e66152ed1e7556a6d1536c589cdb99718d8a2c8
SHA512 14d94541d09f373f402c1f4dc511c9079334f863d6ae9e7217503d955e5e9bfdc304cb85638906cd5d2474a5625e7e8e53f681c08293983c0333827d4aa0b423
TLSH
T16D01E9A1D0D9D8E3EC3668CB8325C9D608F83656AC5C6A445319802CF7CEC71CD5D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 787B
SHA256 10af76a870200845953d15ac36cb25f53776aee6669d00c84553220ae0e0c0fa
MD5 080c1217961abc740de0e117e8cfa7f5
SHA1 11bf98ece23ef0de17c1a6283a3bd97bc79c64ea
SHA512 77d7d058402d8f1691bad552207d93b358b16cf1d1f3629eb47e5e1b623a53dc58d21ad74d14ea5d9a82d31c11d0f419ad14a13e4023dfc9bf2efc28b14fa20d
TLSH
T1BB01C8A1D0D9D8D3E83668CB9325C5D608F83656AC5C6A54531A802CF7CEC71CD5D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Pictures\qap`g`v~dtlq
Size 10B
SHA256 34cf0ab8153da523e0640d19ff40612a45fc0149b46119def5c90205e97b3917
MD5 90c7c6361f12a798c4dcaef301655d2b
SHA1 de868ec82ac9214af6db6ecfb20329aad535b3c4
SHA512 425e14b896dce921d293213330731b8d0a428d8b4f27d47775c6b204a0fcbcd036c7cb1b48456e875135b2e62fbc8c5a8a89dcd1f141902323a1d3a45e9c66cc
MD5 SHA1 SHA512

Submit Download

memory/3284-36-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/3284-23-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4104-2710-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/5824-0-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/5824-7-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download