6208f268a9f58f2bc3c920c7e5a64437ea7908909d8fd7e86a1885d3631e759d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
Size 6.8MB
Sample260816-esh3cszanf
SHA256 6208f268a9f58f2bc3c920c7e5a64437ea7908909d8fd7e86a1885d3631e759d
MD5 85d34a2a335e91d5608efda7c1abfa49
SHA1 faa41c9d285fd69b4ef32c69f68ffbe84c3ba47c
SHA512 d3b9482dc71b76052768fdfce016bc1ff0ef5840c89605672fa133ae8fee9841eae62e9936bbd75d431abaad64708ad4081e6a567d58bb4d81dff2c08eac44b8
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+E6:oYY0W1PszCYY0W1Psz/p7V
TLSH
T1F7765C05FA8340B2D92B11714C9BD3BF4A71BA114B228AEBF74C876F6A33BD06535356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
1744	svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
2840	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCCABABCBBCBCACCACBABBACCCAABCBAACCAAABACAAAAABCCABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe"	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBABACBCABBAABAABBCBBCCACAABBBCBCAAABCBBBBABBACBBACCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe"	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1896	sc.exe
1916	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe
2956	cmd.exe
4620	cmd.exe
912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5112	schtasks.exe
712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
1744	svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
1744	svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
2840	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
2840	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
Token: SeDebugPrivilege	1744	svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
Token: SeDebugPrivilege	2840	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2948	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4680	4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe	105
PID 4680 wrote to memory of 5112	4680	cmd.exe	107
PID 980 wrote to memory of 4352	980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe	109
PID 4352 wrote to memory of 3852	4352	notepad.exe	110
PID 4424 wrote to memory of 2956	4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe	115
PID 2956 wrote to memory of 1896	2956	cmd.exe	117
PID 4424 wrote to memory of 4620	4424	2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe	118
PID 4620 wrote to memory of 1916	4620	cmd.exe	120
PID 980 wrote to memory of 912	980	svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe	123
PID 912 wrote to memory of 712	912	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_85d34a2a335e91d5608efda7c1abfa49_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCCCCCAACCBABACABCABACACBCBCBCABACACAACCBBCBCAABBBACCBCCCABAACCBCACABBBACBBBCABCBAACCCAAACBCABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCCCCCAACCBABACABCABACACBCBCBCABACACAACCBBCBCAABBBACCBCCCABAACCBCACABBBACBBBCABCBAACCCAAACBCABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe" start= auto displayName= "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe" start= auto displayName= "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBBAAABCACBBAABCCCBACACCACACBABCCBBCAABBCCBAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACCBBBAAACABCACCCCCCBCCABCABAAACCCBAACCCACACACABABABBBACBABBACBBCBCBBAACBACAABABABCACABCAACCBAABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACCBBBAAACABCACCCCCCBCCABCABAAACCCBAACCCACACACABABABBBACBABBACBBCBCBBAACBACAABABABCACABCAACCBAABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAAAAAACBACCAABAABBABCAAACCCAAACCBCCCBCCACBBBBCBCCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 abf1c5529173d42a67c2adcd1485fdfc90d29fdb756c92d024ac792d09dc16d2
MD5 2ad9a2449dfdfc48abbc696780583d25
SHA1 2c2f83cdabb84595830493ea59aac9b0adda80c6
SHA512 a1a46d4f6a1848671ce4e620fcabe5340945ecee37f4040aa86641720cafdb9b61c4a382005db300e219f25e127440fa4a91264d504bbae2e0f702caebd62d1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 4dd587c171f8e2ee468fa7d0ea8a38516e41c2ec6673c1e428166a1fa20046c6
MD5 45a674af7c155715ece0aa0004287a76
SHA1 48fbc960f80717d3a29ba59aa09392142f1039c3
SHA512 501251f271b07706f1edf58f9677e512e9f0daf1dd49716f3e4733992432df38815793ba3a20a51b6686dc9e17560200bea4b12804a836551c391960f92b531f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 3ed3a3236156892fe4d1fc40a322af5f3e9d5f48db333ef89a0677de816984c9
MD5 fc2cc77d39dd87ef69e6751360b1d779
SHA1 3f114874d75f63b1ddfe46ccfa6bf3742a8e00c3
SHA512 09db543c5f860a659f43ac7577d94eb0540a0cad806e2a4a8687b5a36dd82ff83917d30bb212ad7c7f7ea86056f5c3329d812351d33bcbc393ae105729bf6db3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\qap`g`v~dtlq
Size 10B
SHA256 488ac3fde9078f216d1e6022831f97c25984ac252a7000e2c258ee9d6553de7d
MD5 de8d93a66d6bbd29664961315845936b
SHA1 bb6502713912132011e68fd0a43edfac1339df18
SHA512 0ce4425956671afc88fd0eed59eeec4f01171106ed3e1f686de3ee83706d487bbe64e59361f23c71f34d4c043b5ea505d989f0206424cd83ce5c409c7b8ed713
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 874ae8619d1a0595ce48369003bfd38396c955aa7ef234314ead412e3e5af79b
MD5 de82e9a6bab15988eca5917962cd8a6d
SHA1 76f4f4aeb177f9e1b8e0204b21277554f28c86dd
SHA512 593460d26d49df46bbb66ecfa79b224354721fb6f3a7e3f543accfee442db92334103c04adfe13612720f9a62d6f7a38294e05ffe1a2f544536cdb9aacb2e54e
MD5 SHA1 SHA512

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 1.9MB
SHA256 273ebbf869fd75e929028b143691ad43d5dcee86e8d5e55102926c964804a764
MD5 11de8c219624b0de1a2b2783a01e3dae
SHA1 6b2b968d4277aad53acdcbfbf182ce2d665eb086
SHA512 eda533b47cd93bceac65a67e154badfd634de252a8d70e659f3cdccd5e082da8d3daecf2d13b00a6b7bd8e4873dbcef3a75a3d51dbe0648bb417af899eba7fef
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+EZ:oYL
TLSH
T1FB953B05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74DC76FA933B906525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 41.2MB
SHA256 bbfe9cd3d5e18b02f0a3efd6f2a05861d643f63aa8420c5dab7fef9a99eecb61
MD5 0c96f1a473719736944aab02759ae2a1
SHA1 ffe26cd2d4ed52742a3ddaa392436a2f9628a5c1
SHA512 8f45fc326d7c78f11cf3e47a3802ec6d4f075c126cccb278190d7baba83f8d3826c4aa1fdbbb9e51511d48088c4ef3537888aaa2a2ee4bc5081ffe77a2d0418d
SSDEEP 196608:gxsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJVXD:/XD
TLSH
T162976D05FA8340B2D92B11714C9BD3BF4A71BA114B228AEBF74C876F6A33BD06535356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToTrace.exe

Path C:\Users\Admin\Desktop\ConvertToTrace.exe
Size 54.9MB
SHA256 6b32a0bbd2a93479c39b3fc0f108549bdef68679a733262ce877032455494286
MD5 2981d84edbdd706cb5e4096ef037b5a5
SHA1 835ac1b414194ccc6379943c39b7548ef3dab798
SHA512 4ede361c542e0dced97e616e57deec09f4e791b4a3bf805f03fbf40645b45f8f33edb6d6b6239773e0734ee01478a2d4730e817fcf322e1ce11037d6e9aa8953
SSDEEP 196608:gxsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJ6xsqxsJVX1:nX1
TLSH
T1CAC76D05FA8340B2D92B11714C9BD3BF4A71BA114B228AEBF74C876F6A33BD06535356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba66d1a3dd7e8720b5dacd069edf5c740f06ef3925516e37a4e5c58966718217
MD5 cfa3c29af9ca8bfbb71659e95cd41de4
SHA1 09db812644e073acb9c334983d9c0960c5105a86
SHA512 256b9622ca086fc15cbdf7eacee08db61fbc9f0fad6cb3714ffddd3c0ce9f4dc8eecf5c8616d03b711c57852c1873cac7e32aa8bb9a82779df356b7bfa43ff22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e371d6de29045689f400aad0440699c2acac626c1018d42552113d23f73aadd
MD5 8084a16eb426a8a9a41d48e3dd98efdc
SHA1 7bec1feca1e92f560ec9e913a200acacd4eb4790
SHA512 3691c41578f7549de9459840d7969653ac053038e65f58759fcd95f3e74ada495077aa840fecb4745f2f3dc8b8067db2688acc6f54d14c8fcedfb04b52ca8471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c25cf883106b825d2f2651a03bdf090ca60f28edbdb8ea92f4feb25cdaf4784f
MD5 db0abcb418ea420a19d82bf389b383f4
SHA1 8185c2aac175e2e744c926e738afe446a0b2ff54
SHA512 b4d8ef0d1f0911953d591c3f5a6e960b511227d7d347f4207def2fe65f3c7d560b810c2dd84e1bc347795aaed8527d81fb04faaaadec400a05f4957d26887f69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be76f7b6ddf787a272df735b48845f730d8358315dbbf770b0bec54d4252caa1
MD5 a7249fa27d1e66684453650dab11b5f9
SHA1 99b96aa287bf655bf31cf0f8d4b46afd282679b5
SHA512 3a2407a292533389abbde9466d8881750e84b57d62e0873d4b39bd287d236635a9f54106b8a37ed409d9bc4544cbfca5de28fd941fc08d51c8a0d5610cd47b5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d1acf1093e3dc76dbf8cbebaf3499ec2b0432482c6a4ac1e0a3e57628c0d531
MD5 e48091da4fd1e286ee64a87a16f72af5
SHA1 40f2bfe568c4f26b8068c22660e8314f75f2123e
SHA512 12fcbdf50c00456cdad90ef2cfd72152e577223f903c653d861eb9d2aef8baf3c42e8fce447b5747d3d62b78ce999824c05000f3fe7a01e82dc019b54203f77f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d2a678c5241efda94cb6555e4f4cf4ca14344a301a036bd6412cd2be3869a6c8
MD5 2383144e42817860009aee7e6c0109cc
SHA1 2e428be592c086a5ad46afd878f08097128ffdf6
SHA512 1a95de0f963e35e02e1228b402a936beea9c9d37f3a5f112513087963e5979a5e91a5bdfa26a9349b7faa3aca004c8b062ebeb7e58e220ebe22d68c06e1ee52c
MD5 SHA1 SHA512

Submit Download

svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCABCBABCCAABBABABBCBBCCCBCCCCCBCCAACBBAAAABBBACACBB.exe
Size 6.8MB
SHA256 6208f268a9f58f2bc3c920c7e5a64437ea7908909d8fd7e86a1885d3631e759d
MD5 85d34a2a335e91d5608efda7c1abfa49
SHA1 faa41c9d285fd69b4ef32c69f68ffbe84c3ba47c
SHA512 d3b9482dc71b76052768fdfce016bc1ff0ef5840c89605672fa133ae8fee9841eae62e9936bbd75d431abaad64708ad4081e6a567d58bb4d81dff2c08eac44b8
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+E6:oYY0W1PszCYY0W1Psz/p7V
TLSH
T1F7765C05FA8340B2D92B11714C9BD3BF4A71BA114B228AEBF74C876F6A33BD06535356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 19784c2483064064ad5c9c5d9e5cc02fa4cbf69df410d914b0250a69838e6de1
MD5 293303c0be9874efac471e88ab54d46b
SHA1 42131eeef143db2469ee25a0b237b926c9843a2c
SHA512 67e28bf63b64727ca200f9dd25c6b4623dbbce99da1deb388bc3fe6680cb09b54a401463589fc56ee82fcd8fb1a4b98cffd9235dd62e11b1c195d9c58337a4cb
TLSH
T1D2110B61ECA5D463EE332CCF532DEE920DE5374FA8B85A482389421CA794D318F418E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c326048c8014b394a3d42ef21b073f3b9f622ecccdb9f227041d363043fbfad1
MD5 60ab83f0babf31653475ed1034c5b16a
SHA1 810a2d10db792b991fc1062d0b5356d3fb06db48
SHA512 9d605cda0213048bf14d26d32e1483897194a8f7432487d7c01e37b6071ea0c0afdc918ec09bd2eb993cc33a140393f4da5776e398dd4bf5bbfe626b2014038e
TLSH
T11B21F661E8A5D863EE3328CF972DEED20DA5374FACAC5A4423894218A7D5D31CE058E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 41cab782d446c9b8d16b981c217805c9cdfd0994187cdbf3e62d4cb0cdb7c42e
MD5 e2f14c66778b79a6114309b792ee0a21
SHA1 27914f91b65a52fa0c0544c6c257936e970ce7b7
SHA512 b61239a3cd7337faf34b58f79df5e69db89516de19aa15443f98095c1c21ba7cc5de8dba0b40e9795abfbb6162f169eee24e8ec50eca6ce148ae48e79fa60ddf
TLSH
T19E11EB61ECA5D463FE332CCF532DEE920DD5374F68B86A482389421DA794D318E518E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/980-108-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/980-71-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/980-50-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1744-109-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2840-1425-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4352-77-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/4424-10-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4424-1422-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4424-75-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4424-70-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4424-49-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4424-23-0x0000000000050000-0x0000000000071000-memory.dmp

Download