386dc0a45bf44d3e790628c2709f0f5ae72c638c605ed7e9b4825f07f43a2f03

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
Size 5.9MB
Sample260813-hdadfsswfv
SHA256 386dc0a45bf44d3e790628c2709f0f5ae72c638c605ed7e9b4825f07f43a2f03
MD5 5eb5d8a7028a42154e2ce5a05e2a3b56
SHA1 1417970827e295c69b00ccc91627fad85e96a981
SHA512 28e7b6d2bce92de45d7306cced795d1725017c15cb62d6045c501f2d30c8295b9a00e7b9d1dd0bdcfcb29e3a778d1b21d82bfad25719d54a6a2c1b1a3396f359
SSDEEP 49152:U+ES+ETqatglJ+ES+ES+E2+ES+ES+ETqatgl9+ES+E2+ES+ES+E2+ES+ES+ETqaL:93Vtq3Vtg/
TLSH
T179564C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
3392	svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
4256	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBACBAACCCCBABBBABBCAAAAABABAABAAABABABBBBCACBAAABBACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe"	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBCBACAABABAAAACBBCCCBCAACAAABBCCCCCBAABBCCBCABCAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe"	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3396	sc.exe
5560	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4208	cmd.exe
3636	cmd.exe
4508	cmd.exe
2516	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5660	schtasks.exe
2148	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
3392	svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
3392	svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
4256	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
4256	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
Token: SeDebugPrivilege	3392	svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
Token: SeDebugPrivilege	4256	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 2516	5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe	92
PID 2516 wrote to memory of 5660	2516	cmd.exe	94
PID 260 wrote to memory of 2932	260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe	95
PID 5604 wrote to memory of 4208	5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe	98
PID 4208 wrote to memory of 3396	4208	cmd.exe	100
PID 5604 wrote to memory of 3636	5604	2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe	101
PID 3636 wrote to memory of 5560	3636	cmd.exe	103
PID 260 wrote to memory of 4508	260	svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe	106
PID 4508 wrote to memory of 2148	4508	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5eb5d8a7028a42154e2ce5a05e2a3b56_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCBBCBABABABBCCBCAABBBBCBCABABBCABCAACACBBCBBABCBCBABCCACABCACCCAACABABACBBCBCBACBBABCCBBCBABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCBBCBABABABBCCBCAABBBBCBCABABBCABCAACACBBCBBABCBCBABCCACABCACCCAACABABACBBCBCBACBBABCCBBCBABBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe" start= auto displayName= "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe" start= auto displayName= "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAABBACABBACCCABBABCCABAAACBCBCBACABBCABBCBCABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCCCACCACBACBBBABACCBBBCACCBCAABACAACAAAABCABAAACBABBCBACBABCBACCACBCCAABCCCAABCCABCCBBACBCAAABBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCCCCACCACBACBBBABACCBBBCACCBCAABACAACAAAABCABAAACBABBCBACBABCBACCACBCCAABCCCAABCCABCCBBACBCAAABBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCACAAACAAACBABBACBBBABAAABAABCABAAABABABCBCBABBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 46a252bf11555a2013018859d6e054d57aac2d970ede3d8be779ea7ad33afbf1
MD5 3194d091404a5eb628498e89fb3756c9
SHA1 fdf35ee91fc49ecb7af97876c547f405e7372acd
SHA512 95d4661d74bf68c494fee9fcfad677683af6532f70b831f9b34420eb554cd606742ac9d670087c1ff015fa3e0dab1232fa16ed71ba63c6d2b13148cb4dc2a9df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DeviceSync\qap`g`v~dtlq
Size 10B
SHA256 c2f721d3675502602a21dc63b1257b920a5ec12472c18bb43ff6b7e5815eb8f3
MD5 1348a61b54884e68d26597eaa08bd046
SHA1 47de531072a7cd276def2682773facfcdcfb0dd0
SHA512 a98914b948964157f9ddfe505260e885ac004ee685d8e4c4cf6c05f331936a2751bc01e2d8413a28a80893f9ec6c37ece99708e31c8b1ad7ffb74ba30e8d2c1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\qap`g`v~dtlq
Size 10B
SHA256 6e99d2a3f0a2c73af0a28c2a4d3b4fc117b6b5cb7aca751c72fe4408f75d5ffe
MD5 ce6577e1216a995f80d541555cbfc723
SHA1 df744ba0256ef115bcc643bae3ed6f5fee2d8ca5
SHA512 19a7031c76ad18170eb700f00e02cde975742704384c223d754c3fd8051a480b8856834cefd5e9a857f45a72705f35addca59d26afdd73bef9f99fab1bf6f42b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 13941c28a5a0def625bfbcbb8e651a6db8692be3309ac0605debd85ba59ddaa4
MD5 a5f075cf31a04402d032f08f6c813b67
SHA1 862d1bc206a7baf9834a192e7ce31d0555f987b8
SHA512 6bdb9eaa11458abcdf4fb3ceb86a96e301e593997164fc13e6bd3857fff5fadf97eea573f5e00d3d1bf1dbc9dddeaf83820b436b59095871688297a1051ce1ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 d5e58a67361a12c79c1e2e701fe92d9de85ef575c4275ace8d321dd9e820bb60
MD5 be52c67de358e6ea3d6269bf0763f7c4
SHA1 9f1944ab78d631f661fdbb0c4887150e4df4e042
SHA512 a61e36293dd0a7158bfaa094e713a511018664c42b74c1bc12d3c4b7bce52f825e5712af81b6d4608573b33f94c2286407e659cc8c78e19107f909b896633055
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 f35cdc83bd3a8ea4312dcd364ee277f8f5230056a4837e24b7287d9821884625
MD5 f57ff3f95376b9ecbdaecef74e93f1c1
SHA1 4d01b3ac81ff49babb4821a6a2d14d75f3fc049c
SHA512 4bee1c0ed430f82e973200d09ff787b2af2ce0b2921cb47e8113780bfd965862ebb7c90e33e925e39f3893d5780ff8f165eec5399e6dc57273432b327c4bbda8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 981fd0ee99969db2947e592d0dd8c2d45f1c2ea0b9d6312d21475a93f11861fc
MD5 3a33c66f36220b971130caa7fbfdfb82
SHA1 402c473ca35959986975ac1e48a4ed4a2c3159bd
SHA512 a4c8cff85b854510d70135e460f33af90d56628ec077a9115b288e6023a5e0803ac3854e5799a3592798f70ebc47f66986bfd35a8e6069ee16d148f8ebb89752
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3be8b58e6bce3e837a74b67f6d585b220fa47573debba31c8601090502a4aa7a
MD5 c913fde73b1bbfe544aab06b73fd8a31
SHA1 1e4e93e22f27c177bfaedf7c2066229023ccdd3d
SHA512 3d106bcc1d92a1ed6949b4bd700b231e0f9fbc15bb2066dad38c12974d07235f4105accd46f76f98d4a04407abfa2689b53d260184848aa5ae640b9a28bf58ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a794d2e571da3069a6216cdb1b6110e449d288ab3f83c6410dad7bfe4a137cbe
MD5 c44c40602611582c46ac03c05a48fb3a
SHA1 ee5a94b1706bec7b2e8da735e8d76f00a0d88e87
SHA512 27a4b1c36f9694c0a1f9ab8119b38e91348edd4a7b64b43f1a26e467f3deabb3721345aab3807e4890d8b9f91e65853ff125abe516324c5e083423956e5aef62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffcd94977001d7fc8ef8969c33161c999888f42b74f679000f13da69c84ac125
MD5 88b580f96cf51ac0105fa9988162e961
SHA1 51dc762b3d9ed490b2444893211475248ad5d01f
SHA512 bf7fee5c59bc32d2bd4c575e587f59a48a6223fc68f1d3f2bdfe5f735a6879f121ae7a4bfc685e67966658a07519fbff2e835dc4ff4a54d2ce59aa25650a0507
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c29bc1477983a64ef8b0a7fd58733f9129366d3d14098c21ced9633997eb429e
MD5 80f3d9fc85d3289f2ba131f14393a78f
SHA1 7226dada13c75091f76f91bd0780007c70587ade
SHA512 cea544b737231fefbd1d364e462575881819ffe49823acb6fcfdf287be794a1a540a4de572d57b77c79a5b8dd8a2f74677daced83cd46a713a1968345cdcd7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18b58004d82706c6372b7833fe1dbaab81780ba862264862707fba6ba53827ec
MD5 6feadfd983561a0b0b0cea44c2b61fef
SHA1 d895a6529fadacc98a4a802d512dc5c57022786a
SHA512 ca2d52ff0a3238303f959f0fa8713bc421f5ca3044d2c298e2a0f9d159bef2dfe8aa6da11ce987d4cccf885f1ceb431643c2507648c187d0e1cd362b61107688
MD5 SHA1 SHA512

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 448KB
SHA256 e23ca67be48cf3fc635245deba2f7ddc6178c30305d191a3cba12ea537b7a800
MD5 14c318b72ba1d9e3f9e8e5da5ffe6b68
SHA1 ea92ddfdcca54633ac783316d33f80260cc54a6f
SHA512 c502f037d7c254582f6e539c627e718f25a99b9fbc6d0d7215338ff950575e81d9e09ffcbaa4e94ef472738ead7a99893e1097d988d333d013e3599b06a72b83
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojO+BeDuUlEqatglTgUFgEsnojA98:m9+EM0q9+EM0OExqatglT9+EM0q8
TLSH
T1B4A43B49F94341B2D82B01B14CCFD2FF4670BE258F128EABF649972F6933B905236695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 18.3MB
SHA256 877ef55a8ec90430556a775c40f2e6d14215efa738e59a263f174f1ffd8154ac
MD5 3fb38c9af5e2d3c4e4bb7a1f5d79e8de
SHA1 615da5efd9b4c8e09d26e5a3516fa9edc81534c6
SHA512 2ec96fb17d7ba1e4bfec54bca9c42e9a9aa0b3a5ea8b0b64f1d5123414780ab6725b9410395d3546edeb81fcb2c3f54b15ca64f454b095d3b9a3354007b54c5c
SSDEEP 98304:93Vtq3VtgF3Vtq3VtgF3Vtq3VtgEnQPPP:JkQkQk2n
TLSH
T1D3174C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 36.1MB
SHA256 61ed2dcaa0324a957ee8a3ae080902191dad4f07a21da1565ee05045ae706e13
MD5 0d0ec19ff1189e9cf68669ec5acc863f
SHA1 180e31175107635e0fb59cc085fcdb4c26c5a43a
SHA512 950c604859e1568b23afa3fb81765cf1d6690864d703b5b14aa3fb436d088d4a204b10bca1516489341da6acb08e50977b910f7566169bb0ec2168f21b0305bd
SSDEEP 98304:93Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgEnQPPX:JkQkQkQkQkQk2P
TLSH
T14D874C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 384KB
SHA256 879684730b151d2f3abaa67ffe244d0404ef7590282725de2e2e6c52bb995679
MD5 7deeaad4aa48ff33d787c63ab053c386
SHA1 6a10235a2534f14c8b401e04f3241f661d660b33
SHA512 e94a22343e8967aa156cfb2302455fa2481f267703b616681d11fd4160864fa0b4e489b63186ea2517b878a28d219109752c90c4dfc852816d9f02b00fdb4f13
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojOofOiYlrOF7ojDuUlMtq10Q8m7NNqM9N+m:mgUFgEsnojA9gUFgEsnojO+BeDuUlEqB
TLSH
T1F9843C85F94751B2D82701B14CCBD2FF46B0BD218F128AABF649A32F6A33BD05336595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 47.9MB
SHA256 93f3a71f500b59f7d60588eb9dc606779a4670c515df45626a7912747af72077
MD5 11e7b7836daac64e23383d8b4d1ae523
SHA1 9def3f40b19aad4af4ad5cfbacc91e0c7e8b05b3
SHA512 ad89306632365b2ffe2e2d3175d50851b177f1d2a0927bb77da99bfa260db1ecba0f096a189d66d10a0891b298fa6370899eb582ca2fd6f9923eabc54454c249
SSDEEP 98304:93Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3Vtgw:JkQkQkQkQkQkQkQk2Y
TLSH
T147B74C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 71.6MB
SHA256 6b47fdb103f1382a8b90007a250de89df69b9e61d56581b070a3412c7851731a
MD5 620f5d42021355fae148245faddc083e
SHA1 d56ec3e6c2e29f78b53ba9fcefaa8c8661ce7372
SHA512 7a4dea023cd76c51e557d1326ab2e727cf76b4e821d9aff60624b49d86fced4304ae81ac44169fb31f32a41f7ae4d62a1ce981efd26601132011e6dc57e3cefb
SSDEEP 98304:93Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3VtgF3Vtq3Vtgo:JkQkQkQkQkQkQkQkQkQkQkQk2Y
TLSH
T12EF74C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c39c040cd6f0a72198b4923117d767dfcdea430503a17494706bad78965572b0
MD5 d1bb3de4ebda89b332851f0f68451397
SHA1 ea26612170efaf24d8ec8f989fc15e80386172e3
SHA512 11b9b04d1f68561eeda67d100d4d73c8ee66379e7cbd7bdf8728ecf6107341c48b52de237d0b7f64421811bdb793b052f07bea02895e441bba7541f91506b030
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c756cdf2c390487457a38f2864cdc743eca694958214e42a185a0c6837bc87a3
MD5 0f01b5280366e5cbc386e0a4e71889f4
SHA1 eea208758d9b5a5f101c57cd7b60484e1ed24886
SHA512 172e009ee40cced262465a6d092aaf92827309654fa3534176b88803008f8bf842082a2d5646f1ab5b9f4d328a9b3cdd87d026fc5b13794956b03209094b8d64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 3e6e266f3fb6c2603fee141a5fe1582a61702fa3824660b4a63da7c339dc9b1d
MD5 cc8885adb0f4c1d491ff40921491de55
SHA1 1dfda1628e0597594b0a5bba41e9a530b3dac20d
SHA512 bb7398dfecab2ee758bd379075c93f12719ff3c3cee65b69c4d9e47deeba31602e9385ebb6e700ef725b87d40a872fa40b2b8d46eb44d435b5bc5a613e7f724e
MD5 SHA1 SHA512

Submit Download

svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACBBCBCBCABCAAAABBCCBBBAABBCBCAABACAABAACBBCBABBBCA.exe
Size 5.9MB
SHA256 386dc0a45bf44d3e790628c2709f0f5ae72c638c605ed7e9b4825f07f43a2f03
MD5 5eb5d8a7028a42154e2ce5a05e2a3b56
SHA1 1417970827e295c69b00ccc91627fad85e96a981
SHA512 28e7b6d2bce92de45d7306cced795d1725017c15cb62d6045c501f2d30c8295b9a00e7b9d1dd0bdcfcb29e3a778d1b21d82bfad25719d54a6a2c1b1a3396f359
SSDEEP 49152:U+ES+ETqatglJ+ES+ES+E2+ES+ES+ETqatgl9+ES+E2+ES+ES+E2+ES+ES+ETqaL:93Vtq3Vtg/
TLSH
T179564C49F94340B2D92B017148CBD3BF8A70BA258B128EEBF74DC72F6A33B906535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bf6e953953d601007c716ef49b008856a032d6151f7de90a548ecfee6ca9335a
MD5 0cedb4a58b3f3efc9d9305190635d852
SHA1 28cb86b5832dfcac52a231f5acd5dce9196880a5
SHA512 1bbc7d30b15177de7df7a8c2a02374e2d9d6b1b27ec87b12fedf60a240d7a79abcb89dd94c162a956a5734ffdc176d675adcea57182e6837eeba7676ca473b7e
TLSH
T1FF210BB1A4A5CC63FC3268D7A727CBD24CA8369B6C5CFA285305421ED6C9C72DD158B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 dc9bd74e75c66854865340d19c7caa9c7454904731bb91d78e9c9d77f3e305f7
MD5 8a5b62a244ce4fe152b7235b7c72d2dd
SHA1 9718ddd7da14768c5fb46cc99d290bfb4d582a95
SHA512 642b8acf272ab2321cc2a032a77850573a12a554dd9b64d53f75bdab88ab2802ce17ef40c94c30c27562133f9f1d73a75ed13ef17f89d48e683df9dd0555ee24
TLSH
T131213EB1A4A4CC73F83268D7A72ACBD24CA4339FAC5CA9145309421AE7D8C72DD158F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b84a8671beebb34653eaf09f63f81ba525d18ae0c1ce8632d28a0c5d624a9b91
MD5 df647e59030f3c986efc8f1f2123be03
SHA1 8acc8b7823dbeb048a7b63e706432458d4d3cb87
SHA512 2efef009b8fea9ec9cecdad0d49febd780c18f21ef32fb55f875326f66e538581db892eb3d59b12f2ebeb21a82cc260f25bea7914ecc51500a24594b6eeb07a6
TLSH
T18E11EBB194A5DC63F83228D7A327CBC24CA8368B585DFA285306471ED2D9C71ED158B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-69-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/260-92-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/260-47-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3392-420-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3392-83-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4256-1520-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5604-10-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5604-46-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5604-21-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5604-68-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5604-91-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download