3b37175742bb4914b10e34865415890773c8965e79347a8795b50857976b3176

Analysis

max time kernel
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
Size 3.3MB
Sample260815-cfdk1axaja
SHA256 3b37175742bb4914b10e34865415890773c8965e79347a8795b50857976b3176
MD5 054b935eabd3ab9fc83220b6c1878502
SHA1 040467ea3d23aa7854c92c332f8796f6748c5a77
SHA512 d9917a27ac84a906b3527a1a7ac9ded26bb1fcc75d338b726b30d741077c04596d74700d2e5e2d21b665c1b008e2e22b00c27d7a6e4664e3ac445867d903b5a4
SSDEEP 49152:U+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglwP+E9B+ES+E9oqatglJ+E9B+ES+E9u:yQtQap7+
TLSH
T178F53B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
2680	svchost_ACCBCBCAAABACBABBBBAACBBBAAABCBBAAAAABBCCBACBCBACBABCBA.exe
2492	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABBBCCABBCACBBABBBCABCBCBCCBBBBBBBCCCACAACACBBABCCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe"	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACABBBCACCBBBCCBCBCCCBBBCCACCBCAABCAAAAACCBBCACACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCBCAAABACBABBBBAACBBBAAABCBBAAAAABBCCBACBCBACBABCBA.exe"	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2052	sc.exe
1640	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2072	cmd.exe
3812	cmd.exe
2616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCBCAAABACBABBBBAACBBBAAABCBBAAAAABBCCBACBCBACBABCBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
2492	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
2492	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
Token: SeDebugPrivilege	2492	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2072	4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe	91
PID 2072 wrote to memory of 4484	2072	cmd.exe	93
PID 3816 wrote to memory of 1152	3816	svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe	94
PID 4828 wrote to memory of 3812	4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe	97
PID 3812 wrote to memory of 1640	3812	cmd.exe	99
PID 4828 wrote to memory of 2616	4828	2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe	100
PID 2616 wrote to memory of 2052	2616	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_054b935eabd3ab9fc83220b6c1878502_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAACBBCABCAAACBBABBACBBBABABBAABBACACABAACCCBAABABABBBBBBAACBACBCCABABBAACACABCBCAACACBBBBCBBCABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBAACBBCABCAAACBBABBACBBBABABBAABBACACABAACCCBAABABABBBBBBAACBACBCCABABBAACACABCBCAACACBBBBCBBCABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe" start= auto displayName= "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe" start= auto displayName= "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBBBACBAAABBCABCBABABBAACACBAABABBAACCCBCCACCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCAAABACBABBBBAACBBBAAABCBBAAAAABBCCBACBCBACBABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBCAAABACBABBBBAACBBBAAABCBBAAAAABBCCBACBCBACBABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cf4596ccd45e4a7a7bb86421448daa57a4de1d7ea2576d0b7f4d06ca1a009766
MD5 ac0ea76d2d0baa47ce3ac0bd0d0b5147
SHA1 2063cb531f873d8fc30fea2ea15bbc9adeb929ff
SHA512 67875ae38298278acb69c2e1e44baedcfdfb68a711d3ba6c99d57e95f47ea2444343c20fef682286b57a3e327bd9e878eb0b18d848ee01182da8bf6bc81350f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 b56dfe09e78ae481cbff252f670d9903b94b1b5fe912f383c52a65d5e9a82e4d
MD5 e317dd9bf9cf892ee1619b8c9ad8aa71
SHA1 b067fdbf185246d793044c6097cba6e24753f4aa
SHA512 01bd8a13c09bea5f4754f956db6e89d1e969df3d66b90e091b80cce517e8bd69cd9480c2b2497495f7125b3c94fd10723b9d480f5e2e83df035fbed123df39a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\PowerGrid\qap`g`v~dtlq
Size 10B
SHA256 dba5eb47ab3981a8ca437dd49bf28b4a113b366565bd01709a64d1d89e95340a
MD5 f8cc15383f3943cb4b5cd764c41acfae
SHA1 f5eff228d5bcca79e4b96c25c97f78902e377ddb
SHA512 db8689f351ba5d9c4a7f64bfa0758fd2f5992c5450c13d714ed9955f9041ccd94959435230f4e64689c7ade391bfd3e2d118f92d2608b27d5d42b407624e1ad7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 e13d66e1d881db81a8241c2ad200114d4a0d46ae589ad0f328afb7d75f95aee7
MD5 226bc80f8a8dea75e81951f3f7c5e664
SHA1 e38bd2d8e989954a40738b374567a281b59d983b
SHA512 fb32175ebc31bdf9c9dfe8562dff7b40fc0ae459322f3997835f66fc7495030e499d6cf33b7813bbb36242519c5015dec46fa3d771c09fb5708bba98cb4626bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 e425e82c1d8ddd265aed028dc1cd675858bf7b2a45543176b8da98a5f61816a4
MD5 3e2eb557fa330ca522cefcfcdef8db66
SHA1 03c1a8db742aa07af3db1eddccdb1c0147ce4b9b
SHA512 ea751a17cfa431616dc59cfce4b85cca44a2b36af2ab1e616c5016e8cf14ddbe907f8488b0239afd4a70c43dbb2e091e54c0e62b578ba386edb0d08e1f6615c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\xh-ZA\qap`g`v~dtlq
Size 10B
SHA256 5bca9b03af3e115603caf12f5a4d0a5a0ec29bffbd14874abdaa296ad1a736b4
MD5 dbcb125b53f25927c4025d3a9ca281d6
SHA1 43454d26033f5743df0d4e6a3b5ed4d7c12ece11
SHA512 49d74ff0087db4773f5a98fb94dd9fecc5a8f5f182d074626892bd3e5036a9a2a1039d7d1ab05af67472e2c09e7282faafc9dfc3cfcdb851cbc7ff00064a08f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 cc15b301e63d4cc9632da42e6c66a61f4150fe7afad235d33cde8301260d981c
MD5 7592a094d1d56e7fffbc876147256ac7
SHA1 8f91fca84ba02c017e07af9ecd37a9305903161f
SHA512 a89fa6324179a9883212d184dd598400c784728d0daef9122e01e0fdffecd7b0891276b3bff9d0fc817a47616cad8919b76e92c22d0279e5e38e2baef2af6d9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91dcb9d49242ded44bbb3ecf02c042c2b5e078b171a5084080f0b67421890553
MD5 5151e06011408492e0ae8f93823dc890
SHA1 e77db99cac096f9a53ee4a4a946d3862c0b34d83
SHA512 4500e8dd6a08867ea594dfc6e67151e47ad60dc37ad9469529441a833d7e02f6c939e6dc5aa83622a4c4c2002062d481463a2610b8ce16881dbad67069e9e6c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe0013f384c397cfa9941004b4953aaf992bf9e821b13fdeb087961f7eee81bc
MD5 2992b38ebeed6fd11ced2dfde3c1b343
SHA1 329a1f29cfbe12759cb24e4265256cc5b2141292
SHA512 53c78bb0f7918bbd4def046f184b76953f768de045c9fef035d7e0af0bbdf8c1bf42d4afb39b46588e15db46caa35be3577b9aae18d60bd9b788324473d68e80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 722eed2ef6670964e5c9fee4079a8e48f1bfb2f8219c236fb8895a1a49c67202
MD5 40da7c013a54e8b62cfc5f3a6f3b77ff
SHA1 4b99424a87f4ca103888710e71e776b84f4cb844
SHA512 8ee16f7e24095d45af1dc602211921795f28d454df415703a91b9da42376be40d4de52efb166f13c4634f3362216ef554edbf625aec145b5f7914d345f0f418e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d89f42d4d9447d2d829e7d7aeacd5ee5d525d40fb01248987c8e3365138d74ab
MD5 a0a96e48cd84a25cc027a8606d684c0c
SHA1 c00ed106ab1f3b520f906ccca5b58bacbfcf8614
SHA512 abba9f70b8594f212a7454aab1ad07ec91ab2be9fa78a826c55514585c7d2a482aadb988e58d90c49c3b7bbb65ecd249b56302cdba59a98e8c3584eb47d4e1da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffb6e1d4569745a8fc52e34e42a9a1fdd814c4b3ef787a6b54336edb404d00aa
MD5 9fa0a31543109efdec7bce75634b63ec
SHA1 15788fd9939a4a3722f55d151cc94d528297b8d6
SHA512 ef2be34277644204b86b25208ace213bfbcd46ce69c4f84b5280c0852ddaac6ba1513bf75f7d417710b7185117d51f6e55f5f79bc4ae15ed955aad63096a37bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b00f5723035f462899af40259e2a57f689b02a5361992a872917160dc0b32c3
MD5 8209392a2dde006f46fa2046bdb39271
SHA1 794277d92dfac4e2a4a306034b9bca3773fd85f9
SHA512 66fd89a03ee96381db4edf1e532b58a8a3a50dbcf18b7d368760b064899b9238da0aa6aefb7ba6928654aaa1d565729fbf4e5589b342be18176b0036061c9314
MD5 SHA1 SHA512

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 36.6MB
SHA256 050364b1a9101b28b104f696659ac9812d0696cc1a2e43066433a6cbaefd57ce
MD5 13807ba0c5a87b87061cc5fe2a7ee4dc
SHA1 ead157d2f69d9dede4d6c2ce4634bcab93259668
SHA512 7fd9eea00e02fd4784a5329aaf84077a7b2a2a10e66cc4aafa0bdb18f861506652d968bbf4dafb2115fc68afa3c4e5440477569c5b87c8bbbcb1101f3ee642b5
SSDEEP 98304:yQtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap7k:RiiiiiiiiiiMpb
TLSH
T19D873B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 10.2MB
SHA256 35532e1c99475b2b4288a11fc14bb9b29cf53459e043f44c56f6dcaa70b753d5
MD5 6c70f748a271d7cc49cfc171a7960300
SHA1 25ee9530c3c67484dbf98b12ac42df468ef8079b
SHA512 ad56ceecce65aacf83449585af08382fdddc6debdbe3bfd73855642b959f04d2530392f33aa3516326184f135f6afa071b97924e5ca192aa37e809574781e63a
SSDEEP 49152:U+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglwP+E9B+ES+E9oqatglJ+E9B+ES+E9o:yQtQap79QtQap79QtQap7dipIw
TLSH
T100B63B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 5.4MB
SHA256 ab3c0cca6e745936904d101a175d4ea0e64cf18d66343c92388e82ffa48eb216
MD5 c2566a2e3398218c437e7b98257fd156
SHA1 fe35fdd0753e9696b49432ac3ceea7d83be1e280
SHA512 85254c2da6fd9055b149e73625a253f761665c56ac0e17709253bd9d24f2a52ee1d3a42714882533eed346aa2c4a864d89ead24e14e65cea0f920d86f9799660
SSDEEP 49152:U+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglwP+E9B+ES+E9oqatglJ+E9B+ES+E9Z:yQtQap79Qt2
TLSH
T1C2463C45FB8980B2E477027148AB82B75A30BD254F12D6EFB348936E5D337D0AE31766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 448KB
SHA256 4597755bb6292e691c1266c4739e321c380888aa6299d0f8e6f81242c976c33c
MD5 bef1c753756c7f362cf093434d20f8b2
SHA1 8e765689005e8b47e2b6ecd3d97712e4fce1409b
SHA512 6ca0d7927547c03a57807d84062243aded73c8e21b5fee536d4451e5accc8e533b63cd1db2e1f1dea42f32699c66d41c3623c9c3e212431f261f80727b009b84
SSDEEP 12288:mgUFgEsnojAeCGbgUFgEsnojA9gUFgEsnojAeCGd+l:m9+EM0Hb9+EM0q9+EM0HdQ
TLSH
T163A42805FECA50A5F4B742B04DABC2BA9530BA258712C9FFF549C35E6933BD09D34622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 7.4MB
SHA256 77fc97f4b089d40e3c008fb86048c9d48f62f752c970e9545094bcd5ce977de1
MD5 ce52ff3c013656c68ff8bd50be882c64
SHA1 5e9206c6102c5dd80192c69726978ee09824f113
SHA512 878b17ba4e90b24036d25c10f83ed8855997c1472fb9aff27f03637a60073d45d5f0e39342b7de240f823fe665f6feb9ffac6455b34e28eafc1f7d5ec3b85407
SSDEEP 49152:U+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglwP+E9B+ES+E9oqatglJ+E9B+ES+E9U:yQtQap79QtQap79P
TLSH
T14D763B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 26.7MB
SHA256 ea928a9aaf39ff818ecab2209ae41e117f4864296a6da10a1bd1e9deda1981c8
MD5 009b0632c377f05d38ff382a55a145f5
SHA1 dcd77c117e31d842770b5c6d30fabb47c80f3e03
SHA512 b08bb83e8356bf3c27e827d6732386e7ce40df7bb2753500385b883a0b05aa229456ccc196563124abec0d77b1d8dc82d7a5ffacac20eb32d2a0a2605b935a95
SSDEEP 98304:yQtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap7dipIa:RiiiiiiiMpj
TLSH
T195573B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 30.0MB
SHA256 f30f51d975825f0666d84609e6a9ed6cd214467598f6aaa844e255b76557662c
MD5 61b0f43a6cc767c574964e5110888da0
SHA1 9f1e6934137e29b3895c3337a3f878211d74f548
SHA512 8b684fc732ac6d3322d0f04f57d8caeccfbefa1027ef644f6e59dbe6ddbc032ccc2913c9b016e82165578e682d574fdb1d4d2305769977ef4df5bb1ce3c5d2f4
SSDEEP 98304:yQtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap7o:RiiiiiiiiMpd
TLSH
T1F8673B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 33.3MB
SHA256 403413e7f295d70fcf460f43f063383153839bdf5d66e5baf111408dc19b7f5c
MD5 231321914399ebfde09111d2677bb84e
SHA1 4ce0c0a2643a9655f117e2eb4d63f05595b66ccd
SHA512 464508080b8ebc64337fe452646c7bc1cb2437c505158fedb129dafbe418426ffab43dab6bb838c638488425b1557e167d39f105758415c3c11cc859fb477355
SSDEEP 98304:yQtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap79QtQap7D:RiiiiiiiiiMpv
TLSH
T10B773B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 df638ff041ac7af3f3a1c14b26569552217609bbf7e1688e1dace668ac324a0f
MD5 0612134e16a14cb14359c90ea29aba32
SHA1 6224e79d9083477ffe04e290e667bbed3f27601f
SHA512 c50818174c380ad0dd738f52b65f09dcbe917145449e09782cb97c23a39b7098c341f00e193ad14155b46b2dac1eada3ab140659df179056fc1d031f5bccca1d
MD5 SHA1 SHA512

Submit Download

svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCABBCCBBABAABBCCBACACBCABCABACBACBCACCBBCABCBBBCAB.exe
Size 3.3MB
SHA256 3b37175742bb4914b10e34865415890773c8965e79347a8795b50857976b3176
MD5 054b935eabd3ab9fc83220b6c1878502
SHA1 040467ea3d23aa7854c92c332f8796f6748c5a77
SHA512 d9917a27ac84a906b3527a1a7ac9ded26bb1fcc75d338b726b30d741077c04596d74700d2e5e2d21b665c1b008e2e22b00c27d7a6e4664e3ac445867d903b5a4
SSDEEP 49152:U+E9B+ES+E9oqatglJ+E9B+ES+E9oqatglwP+E9B+ES+E9oqatglJ+E9B+ES+E9u:yQtQap7+
TLSH
T178F53B45FB8580B2F477027149AB82B75A30BD254F12D6EFB348936E5D33BD0AA31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 dc00c8bd11b38bcd63d4b4db6e9679d08deac40b75e867162f02e7b553721980
MD5 191f23e463fb4e33db540cfae5fc709a
SHA1 3bce89ad26dd564c00634960fd1a3d2557de5763
SHA512 8eb6f848d2e7559806c2e343185eed409d040c252a164bb24da29c164ba7291945b10379e9600f25c09b827c7c0a26b7df46befeff917ecf9c8fd8018119ebc9
TLSH
T18311E759B5F59C57F833A8C786198BE30CB43EDB9C6C6E54224D821CE7C9C329D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2492-2388-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/2680-84-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3816-93-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/3816-69-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/3816-47-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4828-0-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4828-94-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4828-70-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4828-48-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4828-22-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4828-11-0x0000000000250000-0x0000000000271000-memory.dmp

Download