7524b75c4eb1205440ec919f48039d6f1847e6ee1ac5bb3c6d9dd81f00dd53f3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
Size 9.3MB
Sample260811-eagftafm4s
SHA256 7524b75c4eb1205440ec919f48039d6f1847e6ee1ac5bb3c6d9dd81f00dd53f3
MD5 1d11ba30cc8f603142a288aa61d0a243
SHA1 fe520d582f18faded34336a613ff443c38bf06dd
SHA512 f932c38a26a2b2642d52fc6d63cf6a4501be564f40eec3b87bcbf4a97e2bea01cd4bcc011c727c37669edb73aad6173b38fd07d087f01efc5db3155d350f76ab
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphOuozW:SthtN1MbQ9yDAD7KjjqkusjmqMhX
TLSH
T1A3A67D2DEBA481E5F9ABD4389977C272E97279110A33538F89D0C22F6F336915D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
5896	svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
1516	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBBACCCBBCCABCBACAABCCBBAACAACBCCAAAACAACCBBCBBAACBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe"	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACACAACBACBBAABCBCAACACBCCBBCBBBBCAABBBBCCAABABABABCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe"	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3308	sc.exe
2460	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3776	cmd.exe
2272	cmd.exe
1612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
5896	svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
5896	svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
1516	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
1516	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
Token: SeDebugPrivilege	5896	svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
Token: SeDebugPrivilege	1516	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4264	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1612	4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe	108
PID 1612 wrote to memory of 4608	1612	cmd.exe	110
PID 644 wrote to memory of 2612	644	svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe	113
PID 2612 wrote to memory of 4692	2612	notepad.exe	114
PID 4560 wrote to memory of 3776	4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe	118
PID 3776 wrote to memory of 3308	3776	cmd.exe	120
PID 4560 wrote to memory of 2272	4560	2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe	121
PID 2272 wrote to memory of 2460	2272	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1d11ba30cc8f603142a288aa61d0a243_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCAAABABCCBACBCACCBCAABAACBACCCABCBACCACBBBBBACBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBCCABACCCABBCACCBCACBCAACBBACBBCBCCBCAAAACACACACCAAABABCCBACBCACCBCAABAACBACCCABCBACCACBBBBBACBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe" start= auto displayName= "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe" start= auto displayName= "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABBCCACBACABCABCACBBBCCCABACCBCAABCAABBABBBACAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCBCBACBCABBCBCCACAAABAACBBAABBBCBBBCAACBABAACCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d881cbed030dcea9e91c62c8768fbe0c11eec2dec08efd92aa2829b4e8606c40
MD5 805b173779c9bad6532bc64b08a50063
SHA1 7e027abc675a507a9d281dfb2b64cbf86a678d47
SHA512 a43cbd6575185fa4f5cd1b1c33eb8507b4a2fdc534b5daa15f7314536f0672bce898a720e5df9b8de3dab85195a98d567d19c13314d13670f6a2561532d0c3be
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.8MB
SHA256 31e80e6351400b8c47d9061ec2959594cddb4b17e892e3caf5f6344f57fe0659
MD5 d8d8cd0223aed171d03fe027afb7ed3f
SHA1 2b4d20ce9e181d6d78ee58a5596a6b6eb630625c
SHA512 4ce024dcb4192dae0c34bb55d18b55b70f625d8c23ebcafb0f5b6144f72b3cf048aa862bbfbdc1949b328722995944a6aadbc3c0911a837810a0a500dd9c0461
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphOuozv:SthtN1MbQ9yDAD7KjjqkusjmqMhcpiO
TLSH
T127A68E29EBE480E5F9BBD5389977C272EA7279110933934F86D0C22E6F336915D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\es-ES\qap`g`v~dtlq
Size 10B
SHA256 dc2182415cdc5e9c16ea1e3d1c30c441c26aa1f5be6f94666f22b2b3520b7c19
MD5 41c805d7b5454ec1ce66370e638e45c7
SHA1 82c73ba56827b917ff51ddf636a49140b28e9c45
SHA512 d9a7faa4efe67d1f89e75852aa58066e4ed35551acebaa87eb7aa87b2be4ab0ed87cb4d8cfb553f148610fe05ce97d628c4dab2ab342e07e4e3ff7a63d007765
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\fr-MC\qap`g`v~dtlq
Size 10B
SHA256 ba32a7c80d28ba8b0b0edb208723bbea22080ac634ee4a0c25dbed3d664c3c90
MD5 d797120b5a4df3efcb91a75be55f5b66
SHA1 961dc56e2108fa86179377cf61ff3e0aaf9154c8
SHA512 fe0a24b5ec3f1c1ee883aac44c1288471a26dc589304968388a1fba1b3719932a6eadbcbd86413fb485d073adebe5bed589124fb328db488f105b4445ffab06a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 6db45b472aa6c2c1a8f05f92c14c3c77478e081b363daa93139a2bec15750405
MD5 1ef9778b3a57f59d461b643bb05703f9
SHA1 5283ed68fabaa1c2bb17023dd012ea1b3a223bbd
SHA512 ec3d2741abbf8058336223ebd534bf17c5e32858837a5634dddcda23132d6221827530ce6cf4ceb6c86bcd8bca34b31494e206d733f88746603e905f82ad0274
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d589adce5343e2b8bb2a986d55c7cb744c29fd0a69578e795c596c88eb7f6fdc
MD5 b069eed2c52b2e076c15c9b2af4f23e9
SHA1 9888a6c18b74a45a33d07dce3f2bfd43cb8372fa
SHA512 8ce8b86986af7f45f71c4696c50266c8775694adad10898ce4962477b1ba8139ce63883bbff83022f9e3b8b734bbf1372957df0355fe1eb5944bb36fccb399fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bda75e6b701f9f586d60cbc9ae7f3063fa79bb09e0f7b5c6f621b4abe98f7c52
MD5 093226b8dcc98189c9dfaf59f5e36d54
SHA1 32acaedcb5a06c87e2f99670dec227bb68673621
SHA512 7121ad28387233d9273c94e47b7a7135e6b0d7740f4c313621c4b3bfe3bf55bf24a6b81a8d7d05f58ea181e0ed46078a7431d7fa2e92c3a84077861b58ee0dc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc9b717ea7527d611063684f0af524265fd4e8f0e7ab43524751d99ae911c25e
MD5 4ef2d0c338e2421d3fea4ee459d619e4
SHA1 b7551793ee99ff365d69352471e9485f8674fb0b
SHA512 2d5e0f164d79cebd91c9ad80c47166672564e18dd046944de783e2480be74e1b151a97be3836e282d19eedd0ba08dfcad04ffe0e48d6d51c8ed0c1b4db7e8f21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e124f71eea143c92ab6b482f755643cc457639247736aabb71716e3bdc979c74
MD5 8582b2c5b0d79b9ec3042537aa825bd8
SHA1 86fc125143e2eae55152d1017cbda90cca03068a
SHA512 f4d0b8f911a8be6a5294969f6102ac00b8a7873064ca691f729b93f60e62816b4a89a0068757908eeb5bcfab6498f4164bb678a336467d0e36a84d3df52537b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ab31fa70ba0da86d6ee84f0e5f58954255c0ef544d548b60351bca2eb018bb36
MD5 f97a0ed1ccfb7e27ff6e0b1c00a2ec38
SHA1 460a87b12ce1728c35e58bf536f2b925c7c39b97
SHA512 04aefbfa838a08d24f0fa0aff19606bc2a0b2f50fc6a66498e95c57738503a71d9c8e891d50e23b32aed9fc57962bbb74f9bc3f7a3877b668a1112ce7e9badc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 708e284768c81c02a697e37566ef6e092ada88c4d3a7c657137c87c3d4c1b9ff
MD5 1b51d0faf625c62adc8a1606facfbf69
SHA1 dcf6abe94b15ea8188019976198d0fc4d00a18d3
SHA512 8b2d4ff621523d41c603098a3f6b1de4fa15b07559f7c706dfc8b3401b393d2b967a08a0d44d133259c688864b3ebe3139b81cf824ef001602331547d6ca8574
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBAACCACCACBABABBBACCABCCCBCABABACCBCCBACACBCCACBCA.exe
Size 9.3MB
SHA256 7524b75c4eb1205440ec919f48039d6f1847e6ee1ac5bb3c6d9dd81f00dd53f3
MD5 1d11ba30cc8f603142a288aa61d0a243
SHA1 fe520d582f18faded34336a613ff443c38bf06dd
SHA512 f932c38a26a2b2642d52fc6d63cf6a4501be564f40eec3b87bcbf4a97e2bea01cd4bcc011c727c37669edb73aad6173b38fd07d087f01efc5db3155d350f76ab
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphOuozW:SthtN1MbQ9yDAD7KjjqkusjmqMhX
TLSH
T1A3A67D2DEBA481E5F9ABD4389977C272E97279110A33538F89D0C22F6F336915D28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 26fe0fb663df56f6bf5bda22bd7f3cd44477d3291cf4d5175a1a78b38fe1fadf
MD5 b33addc2afa2a77f5ba6039f3f43611d
SHA1 5d89f37494dde8fdda8d3f6a9eda0b1a06931191
SHA512 f0ee82dacfd757aa380df9f7c79129836f4eb7f14707fccbe9ca4f4f03d5f6d1a1188920b9e18a7ca4985028a5492b9f903dfa6877d1c74004273f3b23aa221f
TLSH
T1FA11E350E8F5AC53FC32689B9B2A5EC708D43B97AC586B64231D4219BBC8C738D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0b0092cd66c931e7faaefa73fca904e2627921c746a5c9c33306b93d57026dac
MD5 b989a04eb230258ccc0b64df4dd93d9c
SHA1 f57ff6c178974f565287ffdc72f34c945c5bd9f6
SHA512 a5963555bb9fc1b8a9638280649099a35aaa708e3b40af6e6bbc260f424f07709c68d71d781e29faf657c0ebed89a4307a70eea6221aea5762f776345967341f
TLSH
T1A021C650E4E59C53FC3268DBDB2A9EC308A43B97AC586B64231D4219BB99C738D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-34-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/1516-1617-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/2612-57-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/4560-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4560-7-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/5896-86-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download