5ef1a9b6f6d6024c2f03b115e13e184c552808ea912045c1e9d65a27bbd0bac3

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
Size 29.6MB
Sample260811-edd5vs1sc1
SHA256 5ef1a9b6f6d6024c2f03b115e13e184c552808ea912045c1e9d65a27bbd0bac3
MD5 15693add7360f1f6de60f9b8364a26cd
SHA1 c652c45b1cccb485831a06fbdb3159e61e9b857e
SHA512 02fe9943237d9fec5d3275d1fd102a83246c19c5bba77000ce2baaabd7603aa4000c92627a3ccc577f9f71448b7aa8dc7df977ac0b2343ecb83dc194582c333d
SSDEEP 786432:v5H5H5H5H5H5H5H5t5H5H5H5H5H5H5H5Om:4m
TLSH
T198674C19FA9640F1E97B51B04CDBD3BB9E307A1047228BAFE649C71E6D336919C39321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
1788	svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
4672	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBBAAACAACBABCBBBBCBBCBCAACBAABAAACBCBBBABBCABBCCCCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe"	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAABBBAAACCBACACCBBBCBCCACABAABCBACBCCBCAACAAAACCCBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe"	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1628	sc.exe
4680	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1396	cmd.exe
5316	cmd.exe
1540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
1788	svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
1788	svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
4672	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
4672	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
Token: SeDebugPrivilege	1788	svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
Token: SeDebugPrivilege	4672	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1540	3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe	92
PID 1540 wrote to memory of 2172	1540	cmd.exe	94
PID 2980 wrote to memory of 4280	2980	svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe	95
PID 3368 wrote to memory of 1396	3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe	98
PID 1396 wrote to memory of 1628	1396	cmd.exe	100
PID 3368 wrote to memory of 5316	3368	2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe	101
PID 5316 wrote to memory of 4680	5316	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_15693add7360f1f6de60f9b8364a26cd_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBACBCBBCBCBBAAABABCBBBBBAAAAAABABCBBABCCBCCBCABAACBAABABAAAAAACAAABCBAACACABACBAABBCAACAAABBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABCBBBACBCBBCBCBBAAABABCBBBBBAAAAAABABCBBABCCBCCBCABAACBAABABAAAAAACAAABCBAACACABACBAABBCAACAAABBCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe" start= auto displayName= "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe" start= auto displayName= "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABBACABCBCCAABCABABCCACCAAAACBCBABACCCBCCCACCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABAACCBCCCCBAAAABCCBAACAACBABACACBBABAABAACBAACCCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7b6353f86a1ebdb1ac8e3019a5b4360cb1ae8d2c3e8b1dea9bb08eb6ba637a20
MD5 bc27b022ee8fa8afeac5e7c338552cfa
SHA1 41d271509fd99afffeb2a80d9c77271cf21aeb74
SHA512 1bba19f02fe074d5cbdd6d84f9b9986556db62d430cf7678a5d4aa02edb5f686e28c2e506cef7077ae10cd0ce57e5a7ef0018870da80d242684fb9e3180d7477
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 2dac7b19a0d8fbec4dd2f3ef1106cba78d1f06ea69d0af20a026130eec5f5378
MD5 06b3e7e9699aa90e6b81e7269f248a63
SHA1 5fa9b99389dc7a99525f39dac1b12f5aebe07eb4
SHA512 1b86288a533e6397d9adbbbec4a83bc6b47d3939159ce0dde648c2a82ec795df43d331a393215a76e4c3c949364828d25675b4589677032f674936a8faef5390
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 28.1MB
SHA256 a35cf6b3093322744b574ef28d73b1ab4381594b8a2159b186cfee462cdd028c
MD5 b8581b895e742b5334d9bcf9577b105f
SHA1 64ca856e007bab5e74601d6bc058340bced901e4
SHA512 5a9d0d6280de09324f7ef9524733c53b4f2adc980277fcdf3c102d99ec9a396cbbc0799757afd20b43c1d4bc132bb82d9ba576ff156b8d21b6314f412d6d996e
SSDEEP 786432:v5H5H5H5H5H5H5H5t5H5H5H5H5H5H5H5OA:4A
TLSH
T189575D19FA9740F1E97751B04CDBD2BB8E307A1147228BEFEA49C71B6D336919839321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\No_Vary_Search\qap`g`v~dtlq
Size 10B
SHA256 b6e2ed62c0f08c8817df07334dee0a929ca9c5a28edf0df9dac69236c30c19a5
MD5 db370d81cfa60b0ae582f8bc09b8ba81
SHA1 3fb369387b13330f3e38670575803cdc4d50e891
SHA512 47a4a087d98f142995601b05e8c9d53b80d71ced52e8520ae1cdbb6df5b8a625862dfc395f4544435e34e3a03d34c62bb0b2cbb04d15408ccaba55169a2b33da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mn\qap`g`v~dtlq
Size 10B
SHA256 66fc29bac798a41b7d6cbb846df48512071e9b44f70671e95b270ab03de84b18
MD5 0241a981c471f566ead0a8bf695922cc
SHA1 0dcb8f74265f721ef945a2e271c8d54e29a95473
SHA512 595295a5be07c12c6ac6d3c4b1eb8bfe1b7125b9b8c36cc5c335bde8d0913a50f074a5070ca731d60c829ad0c8449c983245db45ad5eb9d8bd80c71f04a98ed0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f99051936d9c43a9ccddffc826144f5300c1eaf8efff852651fa95edaef5a70
MD5 5e4bc14bf540b2a7cb737781899bf843
SHA1 15153b85c871c93d75003d66e2d468259681e32f
SHA512 5f2a6935a53b4aa2463eed7fe35581d96858f26186723fc6c3d4dd4f87dbf8ac096641f1a3624df1ca0e09e5d13b102a60ec0ec15aa58e225886d8953ace1625
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44e41381611e3178ae99092760a03f845fe57390818cf746a6234f2de6551894
MD5 28d8abc69cd01aebcbcb67ccadc051e6
SHA1 a528b813f4b5a7c8d3f046a1dbd61102238a2a8f
SHA512 07a29e8236d649d46858245f7c9b197968437c074d5545c394f6cd30196e6f5fe264f14d7631ab6c6be3aac022fa68b6e28990d2e2cefa162c567b88d2601dae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 939d926eaec64894277f34c981681a3e30e37b580db8b5b84d93ca2b81bb6a59
MD5 ebb3f017e310fb5ae40eb0e90824692d
SHA1 d7d9ab9e042c9ec31ecbe54a3be5d4504349b702
SHA512 4cda2f19bbb9dc1b12bc0615ce28d0c4d649e1d548bcfe34386d1d969278b20ac7fee1387e9fb583a19d5484898074b8b77e715d8f50cb1c30366f20ac8a1071
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d836b18cd0dbf54c4e655fddf7b65e5d7149fe93c94b1fe2176335cff4101b6b
MD5 9ce2c015ff6bbfb16b0e779c12abe3a2
SHA1 30c8d77c8b6360b3cd3687594eca932dcafcf64d
SHA512 ee361e6bc042c744fbb1e4f82fa4072bf699a6470d72573352e7f8fe1faff4086e572da97c71bf78e1d9040fa223a5d0d36dd8b53bb188813111cfd0d6d837c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5270616096d91a9f8f5f2974e0dc8eef34d76872ac5d284f463d1de896668d2
MD5 6f5a2699cf9507f0df5311554cf27a89
SHA1 4543ba61d9fe05f77e5a9f64a3f277621527cd70
SHA512 989207533146bd68538644c1dcb95e2940a6a470dab5c95f330322f22e935783cf86bfcdabbfc592f2845547b3f6c4055775697c15254a575a334d4338849ad6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6dbffafe991eb4acde02ffcb1fc4b7c76e774a07110697c245b14ac29341d6ba
MD5 96d117fcf994d0ebbc35a26923148832
SHA1 4d570db3c8756ed1e3a54dc73d4ade5f0a9cb163
SHA512 cd51bb980b7b3e19cff82d81592eadf020ff9ece30c9b37c31ec29b2ba5bc0120057ee755dcc6cf4d6bc0c57b7ee0c326c6ed0eff6e3a664d8afb4e36243bcfe
MD5 SHA1 SHA512

Submit Download

svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAAABAABCCABCABBBCBCAAAAAACABBCCACCCABBBCAABBABCAAAB.exe
Size 29.6MB
SHA256 5ef1a9b6f6d6024c2f03b115e13e184c552808ea912045c1e9d65a27bbd0bac3
MD5 15693add7360f1f6de60f9b8364a26cd
SHA1 c652c45b1cccb485831a06fbdb3159e61e9b857e
SHA512 02fe9943237d9fec5d3275d1fd102a83246c19c5bba77000ce2baaabd7603aa4000c92627a3ccc577f9f71448b7aa8dc7df977ac0b2343ecb83dc194582c333d
SSDEEP 786432:v5H5H5H5H5H5H5H5t5H5H5H5H5H5H5H5Om:4m
TLSH
T198674C19FA9640F1E97B51B04CDBD3BB9E307A1047228BAFE649C71E6D336919C39321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a8bf391b91b51dba303e8e28bb1419fe5853b23566ac6c77b57eaff0865f2d6c
MD5 d48ccd359d28b6b87e2758cc990a26dc
SHA1 41c5786c3f7d815f98ad2936ab421e6a8da259a3
SHA512 56999ff131bb3d1f7d9ccf5a25ec0e5d5fe328acfe8de6e9166071d8cb7db59a77a4e4169aef1a6330d8b65f809a686f76f817e408651680842d340f08b1e089
TLSH
T1D011E361E8F5D823F93379DFD53AEE430CA0379F285C6B2452594218BBA5C368E254F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ed9100e2f554e1f8027c6ef7dd6e1a489f27dfa7082ee325fb6a4714df0f2830
MD5 5f6cd720b7f199a14eabbb864bd1b888
SHA1 7aa597cdfd5e6c381dbc1ee7523985f5b0ba26d0
SHA512 3dce2b3e2e0a911d3c76b2cd94676241c7e70a29a761f4214f021cc4947050bca62cb64414203b8bdb249241aebee6954d923b8efa4b2af79719d4dbec72e55b
TLSH
T1D321D171E8F5D823B933698BD53AEE430CA0379F685C6B2453484118BBE5C368E194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-69-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/2980-31-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/3368-0-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3368-7-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4672-498-0x0000000000250000-0x0000000000271000-memory.dmp

Download