29cc3ab20cf243bc476a1104518ef8f0550b4d9fb6c95e091c6f40d7b717f31f

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
Size 335KB
Sample260809-rl7hlaswex
SHA256 29cc3ab20cf243bc476a1104518ef8f0550b4d9fb6c95e091c6f40d7b717f31f
MD5 68822cafe0e1873e638581b3123e4a89
SHA1 25a8b4a93f9cfd8a937590f948244dcca34e8139
SHA512 057f76384086e9530494fcbf9d6df955b8c3c49f93353cde70fc13b35badc6edffc4a62e6db1c80dc1ee998159872709d51d70c49e39cf6acfa19e0c7b3d4391
SSDEEP 6144:m+dTTUFgEs3XojAdFkMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUl:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxs
TLSH
T1A4748E0AF2A01CF5DAA78534898BD136DBB1BD521B10CB5FA364871B6F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
936	svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
3980	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBACCCAAABCAACABCBCABAACCBABCACAAAABBAACACCCCBCBCBBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe"	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBACCBBACBCCCAACCCCBCBBCCBAABBCABCAACACACCBCBBABCCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe"	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
840	sc.exe
2416	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5208	cmd.exe
4512	cmd.exe
1240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
936	svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
936	svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
3980	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
3980	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
Token: SeDebugPrivilege	4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
Token: SeDebugPrivilege	936	svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
Token: SeDebugPrivilege	3980	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 5208	5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe	93
PID 5208 wrote to memory of 1152	5208	cmd.exe	95
PID 4860 wrote to memory of 3708	4860	svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe	96
PID 5776 wrote to memory of 4512	5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe	99
PID 4512 wrote to memory of 840	4512	cmd.exe	101
PID 5776 wrote to memory of 1240	5776	2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe	102
PID 1240 wrote to memory of 2416	1240	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_68822cafe0e1873e638581b3123e4a89_elex_icedid_njrat.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCBBBCCBCAACBABCBCACACBCACAACABCCBBCAAAACAAABCCCABAABCBBAAABBBABAACACAAABBACCAAACCBABCCCCBBCAACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCBBBCCBCAACBABCBCACACBCACAACABCCBBCAAAACAAABCCCABAABCBBAAABBBABAACACAAABBACCAAACCBABCCCCBBCAACBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe" start= auto displayName= "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe" start= auto displayName= "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABCCCBCCAABBBCBBBACAAAABABABBACABCBBBCAACACACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCACAACBBBABBCCACACCBACCACBBBBCBABBCAABBCCBACBCAAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4b69fb766c5fbbc65803c615fe234cf199d8a3b29e929298cd7786c0bb4a3ffc
MD5 78217273893322f6e428317008c12377
SHA1 3cc270e6667e4653d9bcf788b232a201a75a8f38
SHA512 f6be5dd5a9e6f1b82c8ef1f6bfb27e87f2e858c8ea044cd92f7934f69d70eb6b8155ca1000d4ab365f1c9cc6448a3411722dccce2661b0408f2e6df25a0fa46c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 4dfb72a553865d8b8601aa34d1840f712a71521011edcf3471b513cfc5fc731f
MD5 d810ec34f6fb6e065b584c540543b341
SHA1 52db7c395244c2cbc278df98585518b6ec0cc3aa
SHA512 c414d468ae95b620916f95454ff679e586c74935a81cfc76a8107e0d99581107f5becc13ea2181dc33ea83f4f3327f9564b9f3334d3d462b27f41077f279fb55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4221b9834c5f3e31587da124eeb8ca0262494320ff3d7aea3e27532251c75e14
MD5 1ee19fc3b662ca9a88da29cdd126108d
SHA1 4f1381b1caaa4a756761152d6ed24ea7db1254e1
SHA512 179e8384f4a7fe5da66b3fe3f57919234e9db86b830614acdcf942306164b28c2dfe149c05aabd3eb0dd34fd84ccf1d6d17a6cff74084d6506f4d79fa2761f7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fff4153dae4e5e8c945f6a2476d5cee50f2d7838d55e1220ba0dc6a72170d057
MD5 8ca6f77b04f868a472e9ccf990a00a02
SHA1 eb394d3e420e26e1bf2b5b0205ab9b8bbef7b097
SHA512 cb39f08f1a916e4e15ac113d18fe2381200e93ff416fbeba53b9e0ff233a7e0ec6c907f2e6a9f7958decef5133de51d0117e6006c0ca721e839e506dd9398c54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b55664399349b19748f693ef5722b7fb302c6b8052e7e66a80aa6784a2363b5
MD5 938d7be307659c35845d9fb8476f45ce
SHA1 56b30edc8f0daa18ba04afdcc516b718c1a65aea
SHA512 1930d58cc698f620a5900b189c4fdd19bf478956307f6aefd05ce9587fe2eed18ec9bb5bacc612a453b2a5dfd1fc584783c4e2f584ba531c26010e05130be384
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 190307d0050f159eae6ebf9a5447d39f568873dead9f9df6fc2a0c18c0c61a23
MD5 bf63a7d70ccf7f5ba8158ad99f0e2562
SHA1 d9cd4deef25a0a4ae51cc7471321e252eb49b5cb
SHA512 d4d4d09c45f8c1a30129e78f94f3ad834efd592caad5316a086170b6d1e4011d97137123ddf8efe4d7e116e5973eb907f6904220cef16a261fc1d4499c4dd59a
MD5 SHA1 SHA512

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 5.0MB
SHA256 89cad1d42f6a840a5aaf4e60b05648645e6ef4b9821f55c68f33159b012b6860
MD5 4d9c04d33e2cb49d7ccc4b0330f4fcd6
SHA1 11e425d22efda9047676a0e6d6800bf468deaef8
SHA512 998ea7861a400033e2e72ac5b881c04c3cb94c30b9f936ee7eb10f4da79c70265f25448b4f4e589af6778a66e8b414bda0e85cb1493c9238d5f6510283462ce0
SSDEEP 49152:U+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/Fwe4gz0amRPEgV2n:aUUUUUUUUUUUFweUam5EgV2v5yPh1e
TLSH
T15E36BF0AF6A018F5DAA78534898BD136DBB1BD521B10CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 2.0MB
SHA256 d19ff7807295d4498bd153af6bf6b91beb9b2b06cbac7be7f921c416d53b5691
MD5 382df846eb27fd664613e046026396dc
SHA1 7dbd3c2184270e64601f5607d9068047f3b927ce
SHA512 cc0619f347dcb6bc0230a2beaa3588d66b6fb741d552e6c41e70d0eee6ac78deb9cf8e674dd5a015d39c92bb90b7521e53b958a47dd87f3c3d10635d8a3bd3af
SSDEEP 49152:U+E/q+E/q+E/Fwe4gz0amRPEgV2v5yPhPdJ:aUUFweUam5EgV2v5yPh1J
TLSH
T12BA5E10AF6A018F5DAB781348A4BD136DBB1BD521A11CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 3.3MB
SHA256 a899be9f7dcb977ba9e65297ccfaeecbdda4b86fe71cc6d0d8358ae558d42968
MD5 6bd4fe7a89e1196097fc2d158d03b95a
SHA1 4759e59b844bd4c8121bd84ac47933029fb56362
SHA512 2cad5a1a2e2941addc9eec311e92ea22a9f0bdd10a6d591dfadd9955a47618edc6a79d558f035b07dd4bdd1b7f1c9c6eb22a939e5cfc4e0ef91717cee43807a5
SSDEEP 49152:U+E/q+E/q+E/q+E/q+E/q+E/q+E/Fwe4gz0amRPEgV2v5yPhPdb:aUUUUUUFweUam5EgV2v5yPh1b
TLSH
T1C2F5C00AF6A018F5DAB785348A4BD136DBB1BD521A10CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 3.6MB
SHA256 5463ed4ef199f5c1ee16b1776fd812764569225c57abe8e3d56925c5ecef0213
MD5 be77db233ecb65f9d031acddbe3a5690
SHA1 35cedff5273206ae0cd83f8c1b688a9794100daf
SHA512 8958f6a69780985a6b8bfbc6ce575ef10f536c96fe5bd02ba6f71ce2a05be79f82e925a4141e023a985b3409f8efa720acc5f54db4a94c11ff527d8509fd108e
SSDEEP 49152:U+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/Fwe4gz0amRPEgV2v5yPhPdd:aUUUUUUUFweUam5EgV2v5yPh1d
TLSH
T15B06C00AF6A018F5DAA785348A4BD136DBB1BD521B10CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 4.0MB
SHA256 ce90388b4aa6ed8faa5891b429f0ea7fd3f946a6d96ac6d372c2f8a21484217b
MD5 f1da24b210f87a94b83d9555cffd407e
SHA1 a4365f38a3e71ae08e57c029f2eca951448626c3
SHA512 2705337da02e34e9fd92cc4cf0e2ed543577dbdfccd3dc732babeb0685526e1c0d070f6c0c8d536aff74472c3d115cd6d58ddbdb2791f7da6f07c2d227239fde
SSDEEP 49152:U+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/Fwe4gz0amRPEgV2v5yPhPdP:aUUUUUUUUFweUam5EgV2v5yPh1P
TLSH
T11C16BF0AF6A018F5DAA785348A4BD136DBB1BD521B10CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinGrant.exe

Path C:\Users\Admin\Downloads\JoinGrant.exe
Size 4.6MB
SHA256 a67e3eb3e4751ec4e818fdf2cceed14142db5e741f935a4c1544dd60029ef144
MD5 c6639a48c74f80432d0b6ae4dc78ac49
SHA1 45c37a7695e974ee88016ca8df3b7b80038e9bd7
SHA512 1ece5f3ffd2f1897e2ab773d88a677a1139a213908093bf57920d2339cef9bf08b92f33909b4527a13fa829fd3058ca38dd4579ed99d715fec571ccae43397ea
SSDEEP 49152:U+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/q+E/Fwe4gz0amRPEgV2v5yPV:aUUUUUUUUUUFweUam5EgV2v5yPh1V
TLSH
T16A26BF0AF6A018F5DAA78534898BD136DBB1BD521B10CB5FA364C71B6F237A1AC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43239f1da99ce57d847b1a65b9c568f7da5755aea9944c301d58703a25a6643e
MD5 99aa1846ea0bddc17486f66c5a81ff34
SHA1 2754d0ca3a690782a1ce4534b663ec8ffbec34f9
SHA512 e47fe34aab448d69c2745614cc29fedd3ac71d6eaa87a3375a591d85529bb65c17052ef25979b758ed2239b9c55ecf1af19ace84e5f114fa03b0d561e22ac4de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a1cc8badfe6955944a8557da7934b2a33845ab9c6266131d74d874d7094899ae
MD5 77756be5e15e30b331f95a2ac34575c2
SHA1 3e563b2e23aef6c59cc543be144530a028bc34ab
SHA512 67cfee6ac14f124643d4e86e361c12328be3262c42c2d3fa25617e5a9fdf32a40bd09d17db3c4a47ba18c379c92d8250626995cb54c22e39c456e5b99e48e12e
MD5 SHA1 SHA512

Submit Download

svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAACAAABCAABBBCCABCABACABACACCCBAACCABABACBACBBABBACB.exe
Size 335KB
SHA256 29cc3ab20cf243bc476a1104518ef8f0550b4d9fb6c95e091c6f40d7b717f31f
MD5 68822cafe0e1873e638581b3123e4a89
SHA1 25a8b4a93f9cfd8a937590f948244dcca34e8139
SHA512 057f76384086e9530494fcbf9d6df955b8c3c49f93353cde70fc13b35badc6edffc4a62e6db1c80dc1ee998159872709d51d70c49e39cf6acfa19e0c7b3d4391
SSDEEP 6144:m+dTTUFgEs3XojAdFkMIRIwo1igg1NBice1sTAQOehTlO+8RTZWVtSUl:mgUFgEsnojA8rCB1igsNBfcsc+ZOnZxs
TLSH
T1A4748E0AF2A01CF5DAA78534898BD136DBB1BD521B10CB5FA364871B6F237A1AD3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 de0b5b291a32119973e2889eefff5ac1139b26c5b9b4a997d6c95672bef6c961
MD5 ebc03c344c4245ad8ee148010fdc9268
SHA1 a94549634c9e9ab755db1493652b9ed59f7db438
SHA512 5e22fe63822db2a4d5e767bc2c255ce5fc087a687998015968a6e63f483a79ff2b254a6fc07dcd042afe2ab6919601de17486ac6f258956c53b406e67da005cd
TLSH
T19C21F950A0E9CC53F532A9CA523DDE8BC8B43ADE6C9C6A5453059218BBD5C32CE598E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b7363aa64ac9281ef327e30e56bf266a873d61b7450564995ec78426def92bb6
MD5 dd71b92c6e6303d66c4b5973b5209838
SHA1 f0809f58e365173a2b1395e2fca9867b7ba656ae
SHA512 f1ca14e11577994eebd10dbadbca80cbcbe5562bb354e01c08698860504a8664ee1941c0fd6a3325ee4fa68fd64fedf407f102acc2f3f9d47eb99c4748521d09
TLSH
T1CD112B50B0E9CC53F532E9CA512DDE8BC8B43ADE6C9C6A5053059218BBD5C31CE594D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-106-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/3980-109-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4860-70-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4860-33-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4860-48-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4860-108-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5776-69-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5776-107-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5776-0-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5776-47-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5776-22-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5776-11-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download