413e08f8cc9d176398991ee4eff15aec3bb6c5b9ce8532f8120872fa17739dbe

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
Size 985KB
Sample260907-fb13aaxsbs
SHA256 413e08f8cc9d176398991ee4eff15aec3bb6c5b9ce8532f8120872fa17739dbe
MD5 3eece4df2e412aaa87abba1382fb28fe
SHA1 d6f2d0a5b90655437430bb060aafaed4684058c3
SHA512 2e002a29dd38e400b9a66df75f778ea3365aa224b1e9e368c8e3a72ea1087317c7b841ce7a5a243bfbde187062d4fdf1bc6db797ae7067e29ced29dca6050892
SSDEEP 24576:m9+EM0qzExqatgl99+EM0qzExqatglzafDd70iTWCp:U+EHqatgl3+EHqatglIDd79WCp
TLSH
T192256C41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1140	svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
3956	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAACBCBCACCBAACACBCCAAAACCBAABCBABBBBABCBCCCBCAAACBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe"	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBBCACBCBCBBACACBCBABABBCBACABBCCBCBAACCACACBCCCCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe"	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3136	sc.exe
1448	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2996	cmd.exe
4312	cmd.exe
436	cmd.exe
404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
3200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1140	svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
1140	svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
3956	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
3956	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
Token: SeDebugPrivilege	1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
Token: SeDebugPrivilege	1140	svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
Token: SeDebugPrivilege	3956	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2996	1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe	91
PID 2996 wrote to memory of 3280	2996	cmd.exe	93
PID 1820 wrote to memory of 2760	1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe	94
PID 1996 wrote to memory of 4312	1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe	97
PID 4312 wrote to memory of 3136	4312	cmd.exe	99
PID 1996 wrote to memory of 436	1996	2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe	100
PID 436 wrote to memory of 1448	436	cmd.exe	102
PID 1820 wrote to memory of 404	1820	svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe	105
PID 404 wrote to memory of 3200	404	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_3eece4df2e412aaa87abba1382fb28fe_elex_glassworm_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBACCAACAACBBBBACACCBABACBCCAACBAABBBBBCABCBACAABACBBACBABAACBBBCBACBABACCBCACBACCABACABCACCBCBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBACCAACAACBBBBACACCBABACBCCAACBAABBBBBCABCBACAABACBBACBABAACBBBCBACBABACCBCACBACCABACABCACCBCBCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe" start= auto displayName= "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe" start= auto displayName= "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBCBACABBABBACBBABAABAAAACCBAAABCBBBBACBACBACCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAAACBBBACABCCCCCBABAABBCACCBCCBCBBCCABCABABABCABCCBBCBCACCABBCACBAACCBCABCABABABCAACAACCBBAABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCABCAAACBBBACABCCCCCBABAABBCACCBCCBCBBCCABCABABABCABCCBBCBCACCABBCACBAACCBCABCABABABCAACAACCBBAABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBACCBBBBBCACCABCCABAACCCACBCAABBBBCCCABCACACBACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9d50beea3b08f01a5def70a7770af6af843827dcd693c9d61544f06cc66faa74
MD5 94847446feb997639c0ad9e25246d182
SHA1 2ce4f05ae9d67f0ea14000ba16ccb5acd32ed7ac
SHA512 5b6c3c2603933adf20e5f71944b5ab45fdaf965d68e58f12e3a00ab69db9f724759289db31ae510da4da4e1afda85d2004dde7616b59be6401b692b8f4bca97b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\qap`g`v~dtlq
Size 10B
SHA256 8d9db964918f057d93170a2d529a74be5c2e5d6a4d810701ac9a0123043b0d9c
MD5 a3b163cfc4b26d711b75ed9f89ed245d
SHA1 ce2c20cc2bbfaad3fdcee023f531cf6ddae46a89
SHA512 5a691f9427cbaee234982e93f8a383687b951b53a15f660e3c54d95fbed8576e2b24a23e75d67bbe59886df4f007d9f5a8b5ef5900e71e7b7d34ad2a2c7a7133
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 b737bb978f6a47b9f656e0b24d0b335612070a88587dbde62c982b5064af4058
MD5 db57a24f7448561bff64f0d5dc48b855
SHA1 18035291fa4d2a59c717de8fcb1c87794b98289d
SHA512 591481325f733938613be6d22eeac5ade3d6eeac1b451481e48a4165021512da4669b95106c04b75016923ca48b3adc6fcab274101161f1a5e0cca8f6ea72658
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\qap`g`v~dtlq
Size 10B
SHA256 fc2a5d63c2201b2b58bf68d3076625e2a3aeb0b7a933054950f914bca46e7ae2
MD5 d05c919641b21942ed84b595219a391e
SHA1 1bf6ce358068377ccc0652b5021cd94427e82dab
SHA512 efaff443302932ccb9dd65f4017b2925c9da9a65b36192e7f16bad728b3a982a0951141ecb3b45b3f185b8c71e74191bfa1316e1939f3bca890a918fcb72df15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\qap`g`v~dtlq
Size 10B
SHA256 9b068297a99c734544bcbb8764662d4f6faa25dc56e4a5d14ce221cc659f0a07
MD5 eb3caf6017f2560fe4a2387bbb5d990a
SHA1 b16b008e75667f877433ba4aa88f937a7404dbb6
SHA512 295acd78129b3e1fc9715e14c57c7db1d33bf047bae6b384b1a2ba23436a39d0b13c1efe91536c0172babd0cedb591158fc33a5cca8a74c4b6f46e3fb5ecfd5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1926ce07a99c6bf08db35a85481aedd059513f949ed162fefa8638ced72c6594
MD5 82ac032a334739824f25a113fe8e5c90
SHA1 caa0caae9309185825a36819863474920317659b
SHA512 0b620e92c561e34ee457ce360d46835239e43f7ec9be5dd0fc6c6f28792b1f4f54ea8270011b326b6ccdf0c9b6d1080602d41e288b5bc27d160d6819a559f5ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a23fd81cd5444d2d26f4443d9280b5daf4c665b1d7afa437533f618fb3308036
MD5 7abf1a2d20bd6b67ee459a8ce61d2636
SHA1 532da99ec07c70502913d2b634013dedb36b2bd8
SHA512 7a042ad6167f8addae99d7bdab2c72b29a3a6c6b0844678e6e46cd27f8662d5be868e1a6f9cd328226300a9d49606ba9e4b0671bc57d59e1288bb9ae968526a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b85de31919e7937d30e26987251458423ba246c236a2b1be5d6750c0bc6c307f
MD5 497a812b354d0ce92b26321ac502bc68
SHA1 619ba51efb63d8bdea05ae424e8e7d81ba637881
SHA512 b8e92c9e27344fcba355d01f9dd6b6665ca34ab34a58d664f46173ad9955d835bf7a597012991f0698417acca95bb78c4609c393b1ff7978bf31daa6a0abac2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41774e6f84e14a5eb57c5b1ed5de0110c410b5667849f1c3e53efaec98f20ac9
MD5 93c28386b0d1a132280f5a82639525c7
SHA1 8b1e3fdcbe7dfcd3e5ed4c1d556d918b544f177e
SHA512 492194974c8d25203960b7e8b5e61374dbdd8e78e81ad48f8eb705ee86e1da0cc159ea484bc16ec6c345a74d1ebd452d64ff7ec78901619ddb8bfca264bb9f2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1b148d2e07b0639112136586cab5aa53619ac7e5a16327252842174e712d339
MD5 6e2c0e1d00a5efb8f2bc3e050c56f39d
SHA1 94e30b2865934ba11b71f170b6be5b2138616d0a
SHA512 47dd3a8c28df840aaa2fafa9e4e0393f00fa71af34805f313f424a8c290c8e86e488affce456e0779cfe0eb2fed4f3f6e621945d2a396b407e0db6051ede3b5b
MD5 SHA1 SHA512

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 3.6MB
SHA256 19cb703aa306a95ebacd14b0fcaf04ec0fd2344f90e5ddfa34f6effb1d998a2d
MD5 7235a8f48818e2c014e18aedb693324b
SHA1 7270e70f3e8b71f39a6fdeaf7a75a527068d1ce2
SHA512 e21be936728d6ded36040ef3890ecba6455a78f5a988c9158469df7145743b84debda623778d540d75925ccf4b55150111b4844cda5bcf1f27236d2c4c2c5ad6
SSDEEP 49152:U+EHqatgl3+EHqatglIDd79WC++EHqatgl3+EHqatglIDd79WC++EHqatgl3+EHx:qQTp7GQTp7GQTp7tjJPTMOP
TLSH
T12D069E41BA818132F46701728DAFD3FA5574BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 13.2MB
SHA256 d49228f16616394a603b993c123628d6592899c7c0cb789117a9e52f6549d90b
MD5 770be9adaacc39f3cafb9a9e4ec03977
SHA1 cf739efd055083c74d49a80181427e8a101b2d0d
SHA512 0ec29745faaf6e2598455e25d1e77dec167a6348c4084cd0a3ff63337c9cb9df515e7106a65667614afefb78004f43a2ee005586aa1ff80b68723ffb24acb764
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTD:vDDDDDDDDDDDDhJ4K
TLSH
T17DD67D41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 5.5MB
SHA256 4eae2ab646729aa3fc6019458a590e7ed1ddc1f441a55ab8abe7e0aadc91e465
MD5 b03cc22e34eb65913aac8e52ba2db2d7
SHA1 49e156e6d86aa32510125c85c287a817bd5a2a08
SHA512 a0d9ff8c28ac2ba42cc5aadff15ff42eccd3a8dbb27f70e1e26e35d323ec6acb8852564152a85a2877b3e7582b5361267478ab47d67142ae59fe15643d029669
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7tjJPTMOi:vDDDDhJ4Z
TLSH
T12C468E41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 6.5MB
SHA256 21faa0a97db0a727d50b5d5559f45d36a1ea72c9231ce25d5d08fe379e40fa48
MD5 1d019c3129582a4b9d927bcaefb69c64
SHA1 574cbcb2166c7961aea69b15e5ef3301c97ff05e
SHA512 ff81d41d28231251cca707c4475ba0a0e4cfd5e276f94d9fd49184379cd6334d7d5708ed8a05c01ab50fd9cbcc3c661611978dd3bc8822b4dda81545008d4156
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7tjJPTMOz:vDDDDDhJ4G
TLSH
T129668E41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 7.4MB
SHA256 2cfe88d1197f9c3256f96c9cefcca4428adc95a63b13c8a49ba9ee18a80c53ac
MD5 e84cec286c506202a90e74bf746c341b
SHA1 a822de32cc213f5ea071feb78417a3d3892b4fc4
SHA512 f7f87dca31a13dee20d9f87ec1af7ad1e509e07c9e841da00200c75ab5439ba33d1623fa4258d11735c7a0926153d013ed584b1a1d3702e49f8f0d78e8aa3a6c
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7tjJPTMOM:vDDDDDDhJ4L
TLSH
T107768D41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 8.4MB
SHA256 11b0f7d6313fe043963de401c288de516e842673c9a743fb015bee34ad400827
MD5 8908f720de21e4087715397853a3cbbc
SHA1 141d44a09c5596b7ee1a743e2fbaac7b1cd3013e
SHA512 420ba698a270097274d1bc6563aba443e4f37ac490e412817c68f43938669bd96ee2dd836a82b338e93425ce3ba1c476191b1f487e396957e00ef0c9fe7cf219
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7tjJPTMOw:vDDDDDDDhJ4f
TLSH
T1E7967D41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 10.3MB
SHA256 87315046f199e72e24e6c6e3d2a09768dd540557291b45f799151616142d3278
MD5 1fe96f4fb13a87b1862adc9878d656bf
SHA1 6d59932ff81abf099e85ff5a622ecf1a877cde9a
SHA512 c1a896987548c38e87e00f4ec56c1944c90a978ec2133866bf72539e5ac23787bd82ad44a49fd64afa4d0adf50b2b3cd32e648f0444fff1b9452d8bfc947d846
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7tjJPTMON:vDDDDDDDDDhJ4S
TLSH
T110B67D41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TraceUse.exe

Path C:\Users\Admin\Downloads\TraceUse.exe
Size 12.2MB
SHA256 28c4d06b431c567ffb6915c91e0d2f0869bdd18ef0065692e069c920514520cf
MD5 f2f823c6c9990aed7a709a852ee8386f
SHA1 cefff441af3752ded0138fb2600c48aab7902dcf
SHA512 fe18f6c41aad45dc34079ed006f95ae0213fe9e5564ac0bbe1951851abef37c3db4d083087182a65c01837116e26e82bb03c470e1fedad8fb0a8511b817e958d
SSDEEP 98304:qQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7GQTp7PQTp7tjJr:vDDDDDDDDDDQhJ4g
TLSH
T161D67D41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5f6716ac1ecde32d004542f78d6ae53f8fcc5bf7f641a8d3337d06fed6f23ac
MD5 d0ceadc6571265cec891b7b62304b404
SHA1 df667f31a0baab0538849f811ab4ff9a9da07c9c
SHA512 875a70f310667bbffadcb72e46e4cec764934b530263293a656f91946dc5214311c8428c5adafd1dd582cd0db034eb076c68c3e108eb32285dd68374c52c1e7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98c6be85875c7e3e50dbe5adfc3c561204880c38738ae367af01c86538edc7b4
MD5 4b666165d0d15b3ca60cdf0995319775
SHA1 d371a7ef65ae1246b95a6c6399088c6f7bbe6b80
SHA512 65e17bda1d2a026bafe4a07ef8f2b39ffdfb9f820d04aee6f790b4e7fc5f48ba4ac692132b7841fe1219b286c96e0d4ee13b40c62854fa11728876cac1cd5ded
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\CloudStore\qap`g`v~dtlq
Size 10B
SHA256 5ebafae1f3d3c2528d916c278f48482357043605e1d5ddef4f6a794668d02529
MD5 25d911fb3aafcc66c4f09c5bfc7995ce
SHA1 fe08cc09bb49716bb91c8ddf4af639c525816b28
SHA512 42bf799276ee6e2d8d6a479078d6b257726d77fa2b632940ab16b9a0288383e4bfb13e85c70b51e5aa0a8d42501b6e4c38484aa6a25d8ca770de61c29c2da160
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBABCBABBBACCBCCACAACBAAABCACACAABCBABABCBBACCCABC.exe
Size 985KB
SHA256 413e08f8cc9d176398991ee4eff15aec3bb6c5b9ce8532f8120872fa17739dbe
MD5 3eece4df2e412aaa87abba1382fb28fe
SHA1 d6f2d0a5b90655437430bb060aafaed4684058c3
SHA512 2e002a29dd38e400b9a66df75f778ea3365aa224b1e9e368c8e3a72ea1087317c7b841ce7a5a243bfbde187062d4fdf1bc6db797ae7067e29ced29dca6050892
SSDEEP 24576:m9+EM0qzExqatgl99+EM0qzExqatglzafDd70iTWCp:U+EHqatgl3+EHqatglIDd79WCp
TLSH
T192256C41BA818132F46701724DAFD3FA5578BD214F258ADFF788636E1E32AD0933275A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 4127283dec215603f19020ba3a0c9b0d2450fb3615fac73c9a381d1aa8ae9f54
MD5 732f538a3ccc526b177c5887300e8ad3
SHA1 fe69db30b7d33379bfa70670272727decb3e7681
SHA512 312ff4cadc08d087a12476b4255d7a632f0bf1f7b65ee8caf5cb795f921f07ede9228e4fc317aa341c433a8390729f17412e14d35bbe8c06d555cf68c8dcc71a
TLSH
T185113B60B4B4C823D571389AAE2DEF5708E83F8EAD949B88330C43187795C368F51CD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d3a5ab9908846dd4e8227956a8b183c415bc1aaa6ab78ecae4fd7a7a5c4b5a56
MD5 61804c0c0aecbd03ab2bc0afb3a7b5be
SHA1 3b7a35ec1eb02770176440851a69d62e5ced50ef
SHA512 f68b40b2582e91768f7f76a621fafc1f9e056724fa6f254da7f3e4203c3c713cab7bde1d9f66b129c89e030942228db968fba6d2662facaa89374207a9ecb838
TLSH
T1CD21DB70F4A4CC23D17168DAAE2DEF9708A43B8EDC989A84630D471877D9C368E55CD1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 126caa4440217fc73e5c484fee0a50547a439269747d8f9fee7bbd37f64aedc8
MD5 c455be4b0204d2aa6ff6175f0cf448dc
SHA1 2086459486214019e73a74eb107b77460767afac
SHA512 7559370fe630ced8c96d6c01ec1bed761e545fbeb4c068e6e66ecfe3d7fbbdc1aa5b58d34b43f2c39dbb3be14222cbbc938ddaf2ef62eb18e92355dd3e358770
TLSH
T130112E60F4B5C853D571389A6E6DEF5708D43B8EAD549B88230C431C7795C368F51CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-104-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/1820-46-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1820-68-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1820-103-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/1996-47-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/1996-10-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/1996-107-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/1996-21-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/1996-69-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/3956-942-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/3956-4090-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download