3c7768f91769e7cd04cd305ca696c08987853adee951cbe8db3d6839e7d382bf

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
Size 8.9MB
Sample260812-teyyzsdf49
SHA256 3c7768f91769e7cd04cd305ca696c08987853adee951cbe8db3d6839e7d382bf
MD5 4e32db726e64b07b322ce92d2c77c2a5
SHA1 14fa19b3806f1bfd6583e87f1089f19ade05b611
SHA512 592a3ef2e3ebb0e79f6c6290858835633f565f32cb8f28a57d39f753ec45c5b9d921bf826cc351034bd405cf204df809817b185516158e297c63897a9e958c8b
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLcBR+EWLE+ES+EW5+ES+ES+ES+EWLcBrozMlTzS:Y1MbQ9yDAD7KjjqkusjmqMh2
TLSH
T16C968D29EBA4C1E5F9ABD43899BBC672FA717A110933534B89E1C21F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
1224	svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe
6332	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAACACCBACCBBABCBABABBCBCABABAAABCAAACCBCBBBABCBBBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe"	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACABBAABACAACACCCBBBAABBBCBABBCAABACACCCBAACCBBCCACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe"	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6084	sc.exe
5476	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2252	cmd.exe
6988	cmd.exe
2788	cmd.exe
6484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe
2320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
1224	svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe
1224	svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
Token: SeDebugPrivilege	1224	svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2252	3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe	92
PID 2252 wrote to memory of 2268	2252	cmd.exe	94
PID 2564 wrote to memory of 1420	2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe	95
PID 3232 wrote to memory of 6988	3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe	98
PID 6988 wrote to memory of 6084	6988	cmd.exe	100
PID 3232 wrote to memory of 2788	3232	2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe	101
PID 2788 wrote to memory of 5476	2788	cmd.exe	103
PID 2564 wrote to memory of 6484	2564	svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe	105
PID 6484 wrote to memory of 2320	6484	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_4e32db726e64b07b322ce92d2c77c2a5_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBCBCAABCBCCCACABAACACABCCBBBBCABBBABCAACBABBAACBCCBBCBAAAAABACCCCACCCCAAACACCAAACCCBACABACBAACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCBCBCAABCBCCCACABAACACABCCBBBBCABBBABCAACBABBAACBCCBBCBAAAAABACCCCACCCCAAACACCAAACCCBACABACBAACAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe" start= auto displayName= "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6988
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe" start= auto displayName= "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACBABBBBBAAABAACBBCBBBCABABBABCACACACBCCBCBCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCABACCBABAACBBAABABACBACBBACBABCABBAABAACCCABBAACBACCAABCBCAABBCAACCCABCBCAACCCACABCACBAACBCACCAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCCABACCBABAACBBAABABACBACBBACBABCABBAABAACCCABBAACBACCAABCBCAABBCAACCCABCBCAACCCACABCACBAACBCACCAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAAABBACCABBBAACCABBAAAAABBBACACCBACBBCCBACBCBBCAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
1⤵
- Executes dropped EXE
PID:6332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f213032fab2d73f9d9fa705d015ac4390c1085c6101833bb3aaa07cb58426138
MD5 9575c21b8daedda3a0a68984b55951e5
SHA1 4410295635ea81c6bbaf8b07305fb527c6d02fa7
SHA512 83d97defe26f3b505e1d4e3a1f41d0151380995ba12b39cd9057eaaffcf4f73f556ee855fa859e8be30f2e6ee51a315734bf2fd30815ee9467f9ad695ef236ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 769cb027d4383237f3077ec9cf7a3973b4260677bff85f5d648d85a76de95c29
MD5 c16f0b69d726de10962343d31e66df86
SHA1 f95337bfe887ecec73952e32424f9e00bdb83e3e
SHA512 32609258118f6e931f0cdd5703decc3afb2dac01055b4363e658b79eb6f47119cb7793a79b00ca824f2b71869d7ff32ae7efa4dd5b31ae965df802d60e681080
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49c84aba581158211db9d42046ea6f04c2898bd79f7ed8f62d427cea80ed6813
MD5 758dac8757492fc845bd6c8d774b9c35
SHA1 0133bb50e0599b52f8f84cad7733608f94d2a2ed
SHA512 a6a8809b0d9ddd167dd6eaa0cfc3529c46c3c1aabf16289a65dbd0d60cf6f52139805ba02b37009fc3db133a64be8263b92aaefb8114d882bbf4fb073e465c24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cef1bf1d53f6bd6b6e7a6ebc680d299fd0aa1fdd654b6004c0741122b6e9267a
MD5 7ee20db50d132606b95c576add0464bc
SHA1 558e2a63d757d5768c9f639462e3b13ced33b5e0
SHA512 ac19f160d5f3cf33b063e522283747312545be183a134137092691ef4dea48bf738b315f518caeb1bf4149b81d8a89c69c169fb02b309d7557909d9315a63ff0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c4d18997ef640321d2c06dc3d47975eafda06227fd266e9e91d6d12a006f5fce
MD5 dd20bccfc30e8584d85a8d01c9bc2808
SHA1 f6e0ea547087ef6298239a2ef0bce396001d35e7
SHA512 94a34dcf0bd1effe8e79b513604e545a530ca62de6b8d41fc81c0cb207cdaf0bbeff7215e1a747de26471cba62af74b1c70ec865d2909b6aeb7780405e514636
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 140fcda5ea771918105b216facc8be57575ca8e1edae63fcf779f53918cda68a
MD5 45910dd51c4e40032834a72152854aa4
SHA1 344f38204ac80575373d29f522c80ab62bb9d781
SHA512 5bb4565c38d749ee04d4cd54c2e4eb6b5110686e7f863b0212770dbae6aa62599a1443061b1a1d45ffd0815eb78d052597a0b7055549cb662858ece11df39a19
MD5 SHA1 SHA512

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 27.0MB
SHA256 641c7ba26e586ec24a614272d3d402f45fddd94fcdf2d930fa1a013a15e29143
MD5 a11381bf63077fc0d0ae5deb2f00ee1d
SHA1 bea25f3e57319d0ff0bf22051aff74fcd9042a87
SHA512 34c89f697d335ecfd1563a63ccf15cf404e0dbc74c47803662e690aff07c41cb622d9efcfef6f01f7e8e55311ac9a1d35b31f2ac7a06b3baea14f9c223fabb16
SSDEEP 196608:Y1tIDewjqkjiqML1tIDewjqkjiqML1tIDewjqkjiqMkeOhTs:Y8KwekyL8KwekyL8Kweky7STs
TLSH
T1B0578D29EBA4C1E5F9ABD43899BBC672FA717A110933534B89E1C21F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 27.0MB
SHA256 7d8c53240274dd67f4d2602a7206e261db92b97403f1ffd1994257ff2fd1bfa1
MD5 59dfae5abe0b5bdb8fcb3568b835d978
SHA1 f4870e545887dd5af507d1dd8faf8740db05907d
SHA512 abc2b3790a39257b67f3755ac10369153d4ae21ede78b2b858c09c307980d8f3b1380454a1a23897c84179532ff7ede1b543928f21d7235204c5218795c62bf5
SSDEEP 196608:Y1tIDewjqkjiqML1tIDewjqkjiqML1tIDewjqkjiqMN:Y8KwekyL8KwekyL8KwekyN
TLSH
T1DF578D29EBA4C1E5F9ABD43899BBC272EA717A110933535BC9D1C21F6F336914C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveEnable.exe

Path C:\Users\Admin\Downloads\ResolveEnable.exe
Size 256KB
SHA256 26948ed861c8f4db1fdaa26bbe7d94c62d9e4194c2e80c31e28b641bc83057a4
MD5 76d1d9b4c24d6cceb61562de090e268b
SHA1 883dc4a34acc13c95fc1dba5e2cc47dcee998ac3
SHA512 5e804c50ba35342b7fb45720cd4d93d7b547b715a2a7f346e0a017ef66a77098426fbaaf7746a23ee2b289c208e0805665cdbe80c38f49fe1e02d41e67ccccbb
SSDEEP 6144:m+dTTUFgEs3XojAd7czhQXJgGczhQXJgz+dF:mgUFgEsnojAdCagGCagzS
TLSH
T1A7447D05F94780B1D92A10B04DCBD2FF8A74BE6187214EE7F69CFA1F7A32BE15424694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7abb8ab5a9efccb195f2f3ab4c89816a6bb0c9705bafab655301aa8383e3e84
MD5 9f26ff5264cfbdc114a45d8071572873
SHA1 a4f70d419fd53f1f70a477aa24034ddb3a43b3c1
SHA512 c286627a9735076f75ec385502dc4c90b181905e97122c1118db02d1157a79f4753ed9ee28c7fa02932c08d3a11a0489a6689f0fbbbaa9ec473246f27de30f97
MD5 SHA1 SHA512

Submit Download

svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCCAAACBBCBABABCBCCCBAABACBAABBABAABACCABACBBABCC.exe
Size 8.9MB
SHA256 3c7768f91769e7cd04cd305ca696c08987853adee951cbe8db3d6839e7d382bf
MD5 4e32db726e64b07b322ce92d2c77c2a5
SHA1 14fa19b3806f1bfd6583e87f1089f19ade05b611
SHA512 592a3ef2e3ebb0e79f6c6290858835633f565f32cb8f28a57d39f753ec45c5b9d921bf826cc351034bd405cf204df809817b185516158e297c63897a9e958c8b
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLcBR+EWLE+ES+EW5+ES+ES+ES+EWLcBrozMlTzS:Y1MbQ9yDAD7KjjqkusjmqMh2
TLSH
T16C968D29EBA4C1E5F9ABD43899BBC672FA717A110933534B89E1C21F6F336514C28731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c5a7053cb0e5a87e19f7a9110fedd272cd2acb1287d720ba107a465b5f14474f
MD5 b8caaf14e3546e1a74535248fee475e5
SHA1 d9a37f88c41758427ebee1b0ffaa09d3a3ac3da0
SHA512 4385a10bd61a81e0e770ce92b238e4c00392f770bf0109dbf2e8843b8c98c622bd1ff40b3e856291e21f8633ff2940644ee3b41ef41fd8111c3c1bad97154156
TLSH
T156110E72E4F5CC63E96268CB962DCB870CA033AF586C5A14134CC31877DAC359D194F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2c2a729ab33e02634ec291f386a3f69680dadafac71f8b153dc1b8cce01a28fd
MD5 952019a5276d0fa198d58a1d6c8444dc
SHA1 9f8c5cdc467484e8310c05bba65838f948a07280
SHA512 f95b8168f52e9d3ad2d7a6b87e3531fa7632512e2fd8c02e304d7edab5595ee0c70beb2555acadeb5158a6ce388d4be3832105b99fa8ecb2d65b016b8d02039a
TLSH
T19E11EBA2E4F5D857E876A8CB9629CB870CE0369F686C6A241348D21877CAC359D194E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-83-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1224-114-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2564-68-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2564-92-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/2564-46-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/3232-69-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3232-93-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3232-10-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3232-47-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3232-21-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/6332-110-0x0000000000880000-0x00000000008A1000-memory.dmp

Download