096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e

Analysis

max time kernel
151s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Size 25.3MB
Sample260810-eewraszhqg
SHA256 096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e
MD5 e310276326af08b02c14c27c325cd994
SHA1 c6fbbc2d50cfb6a91c2e998e9fd7595906f9de6d
SHA512 269d9095d4a1b2b87cec2693eb40958369c17c8a71ac9b9c05cd23a8b867afbbb1f752cef8b28882fc79a82bde32afd1fe527d6236ab8bfcb722f47f32f6c554
SSDEEP 196608:kFlfFlVFlfFl27FlfFlVFlfFl2FmHpn6F44IAWvh:i3Z3sB3Z3sFmHN6+Jrvh
TLSH
T15947D046AAAA50E8C46ED0748867D733E6313C1B4230979B46EDF61B2F737606D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c510-19.dat	UPX
behavioral2/files/0x00080000000182bd-395.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
3268	svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
5564	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABBCBBBCBACBCAAACBBCBAAACACCCBCABAABBBCABCBBAABBBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe"	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABAABCCCABBAABBCBABBBABCCACBACBCBBBBCACACBABACACCCBCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe"	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2064	sc.exe
2012	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2848	cmd.exe
2092	cmd.exe
632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
3268	svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
3268	svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
5564	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
5564	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
Token: SeDebugPrivilege	3268	svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
Token: SeDebugPrivilege	5564	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2848	4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	92
PID 2848 wrote to memory of 5692	2848	cmd.exe	94
PID 2044 wrote to memory of 3912	2044	svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe	95
PID 4760 wrote to memory of 2092	4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	98
PID 2092 wrote to memory of 2064	2092	cmd.exe	100
PID 4760 wrote to memory of 632	4760	2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe	101
PID 632 wrote to memory of 2012	632	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e310276326af08b02c14c27c325cd994_cobalt-strike_elex_glassworm_icedid_njrat_stealc_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABBACCBCACCBCBAAABABBCCCBCCAABABCCCCABACCAABCCBBACABCABBCBCBBBAAAAABAABCBABCBBCAABBAACABACBBCBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCABBACCBCACCBCBAAABABBCCCBCCAABABCCCCABACCAABCCBBACABCABBCBCBBBAAAAABAABCBABCBBCAABBAACABACBBCBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe" start= auto displayName= "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe" start= auto displayName= "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCCCBABAABAABBCCBBCBACCABCBBACCACABACACCACBAACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCCACABCBACBCBBCCACBBBABABCBBCAABBBBBCCBABCACBBBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ac4c61628693e9755c70ea8cdf1b61a804022f54d65de75ac6b50c388410cf9f
MD5 ecf895989569a0ea475fa9f87eafa65e
SHA1 e99c2fd4608402372de03fdedf0595dc34d70b41
SHA512 8b71260c81c659c1455fde0817a9d90a2203f1eb34fb606c4c16890482a54970a47b65b50993c59976efbf1c11dd161727aa9deede6b6ab6a906dcd22a8216b5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 25.9MB
SHA256 3efd8faf11a975c5bce624947322cdda2c2c50d4e26822e17a66f83a2dfb9f87
MD5 af578f19850ef53bd2364d3e4ad48377
SHA1 8f7e0b95f22ea92d36a0f4779767a4b1c062d726
SHA512 2e902126f32f7d73210868efff23ccae737d586db609fe1a1e882ef79e0e4d955c1c5ef662b7125f630557c9b7165986a016b3fbd52bab21f1e80a3789ee467b
SSDEEP 196608:kFlfFlVFlfFl27FlfFlVFlfFl2FmHpn6F44IAWvAgZ2jX:i3Z3sB3Z3sFmHN6+JrvN27
TLSH
T1A357D046AAAA50E8C46ED0758867D733E6313C1B4230979B46ECF61B2F737606D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 3f3d8a10171190b7c2f91e4ad8df7cd4a51ae1c86ccab6d41ac93692284fdcbf
MD5 3f6da29c4ff38efd5d892d0f051bcc4b
SHA1 a1dfe07818968ddb9d4c7f3edbbd2f20cbbc4f98
SHA512 67f29d5546cd11620a56033aadb317a7fb19fa8118bc5371894d59c7b21a591cd858f701d5f0c57b37582c2e4c3c0307a289a68c1af845bcf5d8fdaeba9b8460
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\qap`g`v~dtlq
Size 10B
SHA256 da797270d88c69d4810507bb5fb6204723923ca2e2c8f61b0f0b62a5a2fc5de4
MD5 c4c32c163377d7f9e78e503ab17a9f4f
SHA1 1d205be8cfbdf307f7770130fad2dc87356ed6f2
SHA512 07b74d362a459d0b116552adbc8c4b3141ba400eb318eea187f5a153cafeb94da1d9b72f0539856ed1616b38903d2cd7ce45fe21343eb3cee96899956909d7b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ro\qap`g`v~dtlq
Size 10B
SHA256 5a9463aa16b1a8b43a7146a8d14314011d50b78251b994041cf521713f006d97
MD5 d83861919d04de61d6aeac06ad3dc9b4
SHA1 b6af245560afad5973c450646a3e8d4044a3ec46
SHA512 1c4d0f712f0c951798a365e357bb65b00447d9e8ad6028af8e4b6271b8cdc0bfdee14e980650e565c800ad9eeb86a491be1987f84c3fb173c3a12ec084fdae52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf8c80595be69d12ed7956260cbfaaa49fd58ab349f157970da6915a780d7001
MD5 d6b25372657d446664676b9375868d69
SHA1 2114b663e7e26dbce674003043c08c6b31bc90db
SHA512 58f021b371d51509220fba67074777b3f1a1ee4afc4101c13eee49ce8f28ab1d926376b6f3728f72e46fb71de70b18f4ef14e1a8928c5156e5bcc9b23a35d202
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bd2cf89b65935f78739e17158e3f02b8faad63af574f63c0bca13dfd7df49e0
MD5 a1cd24cbeda1e1817cbfc6dba4a0a0fd
SHA1 952bb48b5c072acc2ba748e5623db2532b7dd532
SHA512 fca2163c64c47b8b2384637e3d57e6ad366352fd82046ac41a4b34f98a45ccc5044fa409460959f1b062849e1685eae4df39ca296737d1437ca9a0fdff91801d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ded240f47df39a86ee6926cac2f46498a6b8676659faf0e81b8d5882a13698fe
MD5 33b4c4a2020140a34f9be0e42e731ce0
SHA1 baf892aeddd937568ba0988eaa22a2334f1d7f1f
SHA512 74a7555143597a0c5f58da431afd57b02cd4993d9ad75eb3350abb8a2bbd60ba066015f1c16b5774f4e8bd1f66e0402d5c9f6f43bf04f5c5c5a7dc38bc4a7708
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c859f93d90b3f2766ba2eba5863f537836ead124f8677b86c50feb234379ed0e
MD5 6913df4a6ed5a0bfdfd5948907f542c3
SHA1 545185a5c9e9d75a714ac1365ba7cdcbc1013aea
SHA512 e8d627c14dd29301b1e12b4c9325bb4800182d9d95875eb86aebd9f446cde5c8545babc50c5ffa632695f8dda27612509c4fc039d3a27b1df5479a873c8b2168
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 118317ce13ffaa5a649c2d3245e5b0f3ae32de394668be11bbe6ba2d1e6f1611
MD5 777f06523f33e2f854c80329be213c6d
SHA1 3a760f61e86d892627aeaa2082c8708d61a51c97
SHA512 20843f817a0a1c65937512d233361d5059b09381ea837b5d3d566d86ed51150942c594968de8f56464825ba154dca1c3f42f3bb11d09a3af0fa848bb7340e0f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5bc48838b12ac02264ceab5927598001edc17137e79fe7015e562c73ce3ff0ca
MD5 333b6163cee1076f9d5217530d5610b5
SHA1 139b306db5f6bdc085bf89b6c8a67d9eb28005c3
SHA512 a23aba206f8c3589afbcde36e680422f39861866fcef61115b1e0f8aa0d7417f553f8cf9fa4ea275b5c17f9c26fff52c948e7c0fc5254c5b2cd25293c796b9ae
MD5 SHA1 SHA512

Submit Download

svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBAABCCCABBCAABABCCAACAACAAACAACABCCBBCCBBBCCACACBAB.exe
Size 25.3MB
SHA256 096e5a03e1b3f0dac710cf1e0d9191e144ea104b366205f725c0f9d40d38d14e
MD5 e310276326af08b02c14c27c325cd994
SHA1 c6fbbc2d50cfb6a91c2e998e9fd7595906f9de6d
SHA512 269d9095d4a1b2b87cec2693eb40958369c17c8a71ac9b9c05cd23a8b867afbbb1f752cef8b28882fc79a82bde32afd1fe527d6236ab8bfcb722f47f32f6c554
SSDEEP 196608:kFlfFlVFlfFl27FlfFlVFlfFl2FmHpn6F44IAWvh:i3Z3sB3Z3sFmHN6+Jrvh
TLSH
T15947D046AAAA50E8C46ED0748867D733E6313C1B4230979B46EDF61B2F737606D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a6e01e65d0e667e876db2dd3dda54efb233a97701caf2789a3aa4d23153913df
MD5 43c6c05543f7517c469ac1425e8ddc2b
SHA1 da6ab8b648d0d49ea349e0b5076555005ecfaf69
SHA512 4ecb3410bc8cb95656ffb30fe8e5f79aae0858ba3c21e938542acd7dc930a05bf1f72a8a75557f4df1f796a322fe7752a68629efc70492c433309dcef81c9202
TLSH
T1C311EE90A5E9D853E931648B661EEBE20CAC374BAC546A28138D951D7B8DC32CD5D0D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1cd2f9ae771179b16cc29164175b0b31b412cad68d7a4ac7278900f9a0a02404
MD5 68f4f6fff4158019451715b7b35428de
SHA1 438cbd1ba06ed3d04f90268e4cffc51e6e7061de
SHA512 2efee9ab7e7719e71cec34707e1c371f0f7b653e6634a3dece9b525ae3995e8b0e02442d9be424efe6be2ca1bfc20b53c3a4b0ccc665c68e4e8f8e97d1e42674
TLSH
T18D21CCA0A5E9C863E931648B671EEBE20CAC375FEC546A28238D951D7F8DC33CD590D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2044-33-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/2044-23-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3268-70-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/4760-0-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4760-7-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/5564-71-0x0000000000410000-0x0000000000431000-memory.dmp

Download