1ee46210795d690540f2d8a4430bfc0a8091839d810479ac04c9bc5aa13012a6

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
Size 2.8MB
Sample260817-mp5e7ayanb
SHA256 1ee46210795d690540f2d8a4430bfc0a8091839d810479ac04c9bc5aa13012a6
MD5 b8f55b68011079274b88df415bba3bd6
SHA1 13f87b31767cac669fa6ebeb8228c8c4ff959029
SHA512 786ed3c7ac0820fe9c36af2767fd05f2093241b50502c11c1a67696d41618037a2ae0bf20458b95aa0a0a4d6fccc81c75f14cf8f5944f2bb46bffb8093c7c365
SSDEEP 49152:U+E9oqatglJ+EaJ/+E9oqatglJ+EaJ/+E9oqatglJ+EaJ4iw22:17k7k7M
TLSH
T153D5D446BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
3828	svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe
2592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCACBCACABCACBBCCBCAACCBBBBCCCCACBBCCBABCAACCCBCBABABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe"	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCBBAAAAAABBBBCBCBCAABAAAAACCCABCBACBABCACAABACBBAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe"	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2712	sc.exe
6052	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2688	cmd.exe
2532	cmd.exe
5808	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
3828	svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe
3828	svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
Token: SeDebugPrivilege	3828	svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2688	2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe	95
PID 2688 wrote to memory of 4520	2688	cmd.exe	97
PID 1592 wrote to memory of 940	1592	svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe	99
PID 2100 wrote to memory of 2532	2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe	103
PID 2532 wrote to memory of 2712	2532	cmd.exe	105
PID 2100 wrote to memory of 5808	2100	2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe	106
PID 5808 wrote to memory of 6052	5808	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b8f55b68011079274b88df415bba3bd6_elex_glassworm_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCCCACBACCBACBBCBBBBACBCCCAABBBABCABCCCACCACABACBBACCAACACABCCBCCABCCBBCAAACAACACAAACCCBABBCBCAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCCCACBACCBACBBCBBBBACBCCCAABBBABCABCCCACCACABACBBACCAACACABCCBCCABCCBBCAAACAACACAAACCCBABBCBCAAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe" start= auto displayName= "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe" start= auto displayName= "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCCABBCBCCBBCAABCCCACCAACACCBCBCCCACBACCAACCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABCCAACBBACCCBAABBCCBBBABBABAABCCBBAACCCCABAABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
1⤵
- Executes dropped EXE
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 6.2MB
SHA256 025dd297470dd2740397107210f976a3039ba253ffcd65545feba6b7f6c3f6ab
MD5 1795db315ce9e0a77a7d9a85d78b7aa6
SHA1 aaba9bdaeb521ffbcd2e701b88176f2af3c0acdb
SHA512 5619e2bda286a116262bc88b78fe6bace9b4e67de8cb69bc7d4c516340868bd0012e86b6e681f29b8446bce1ac68494f02a75381d409088bad7e18f1bfc483fc
SSDEEP 49152:U+E9oqatglJ+EaJ/+E9oqatglJ+EaJ/+E9oqatglJ+EaJ4iw2N+E9oqatglJ+EaK:17k7k767k7k7oSc7Ej6X
TLSH
T18D56F646BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 23.9MB
SHA256 ccded4777e3e3398670198e31143d35ecfe14e3fa704ee91fef71d77894fcf81
MD5 65abce9318e8d8fb71471e22f9e54381
SHA1 63975841fa90e5118f639a49e1b77efeb274d6cd
SHA512 25230ed01886872bb20cdcd38267f15c6e0fab5d74c0b6d600f2f56053b78e99d041b0f8c53dc9460b573eb2d2ba22e9ff4358dfdcbcce123698dac3e3473c42
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k767k7k767k7k767kx:VYYCYYCYYCYYCYYCYYCYYCYYCy
TLSH
T18847D446BA8984B1E0770630496682AE5771B815CB139E9F62449FDEFFF3BC09E31631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 1.8MB
SHA256 71173c985b94e7807080161908bcc3fdce79e7ffb98027fbf724ce690e77f834
MD5 16e452a8c80a0372b710abfbe56aff52
SHA1 ebf8817dececa5dec6331de7b962a907d8fe9f59
SHA512 0369ce450cd59229b0def4db5783206b59677f8cfc3fdfa363b133da9a29aa54b844e134d9f7bca830818205a5c5ed584e68d3b0398dd6ea1a869abe712a6a97
SSDEEP 49152:U+E9oqatglJ+EaJ/+E9oqatglJ+EaJ/+EQ:17k7U
TLSH
T1A595E746BA8580B1E4670630496792AE5730B815CB139E9FA2549FDEFFF3BC09E31631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 14.6MB
SHA256 0507590ae8699787ab54b37e63da67f95bdbf6a9d417f6e926c7c702117d937b
MD5 da0cec53fea1a01d880066f423ddee81
SHA1 086d2ea4e6b339f5b4275a8230dd14c1f091377c
SHA512 791a9a8e8504d3740ea503137c7680a77b0132e72768c6baa5404df0f1281098beb535b0e8fc245f6c16b182ac72ddf39b479078c5aa545ed18eb97d1ea9cfd6
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k7oSc7Ej6+:VYYCYYCYYCYYCYYBt
TLSH
T169F6E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 17.4MB
SHA256 cf99c61e77c02c25567e7d004506e63e80fdcf0eaab5b8cbbd65882a3e11e761
MD5 62ce91c5656862357b16f9ae0557d227
SHA1 c6ff6664743fb465b066fed2da5da8a26ec270d6
SHA512 e5eb4c4ad90547a256db986667419b791b78206c3de613bbd55f148dc5f5c7478a7d2115152de0b41548482ee782b093efefaa0f7f10b686acd283e1487b35ab
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k7oSc7Ej6X:VYYCYYCYYCYYCYYCYYBa
TLSH
T1D907E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 20.2MB
SHA256 fced5b30a95ccd22c964b9ae66bbd98fe536077d8668726f3170a4dbaa0bdeed
MD5 2e3ef65acd02f4f8fcb7be51687ccb01
SHA1 9d146ac3985564568a71ec7d961268bd063a6683
SHA512 f5e1aefa09be9b1115a36c76ee91cc8b0664bdad85ad2ff9018286b8b62014dbbe62c0ccdb70f29af31b6c295ffb72d154940c10fa334a62f5771221c202d067
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k767k7k7oSc7Ej69:VYYCYYCYYCYYCYYCYYCYYBU
TLSH
T1D527E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 832KB
SHA256 0d485733a9adf0f33213c10af9ccad765312f870214944b5e426152fc4ab29cd
MD5 439e04041aa4446d74030362f58d784a
SHA1 e6c9c8baee81f90b24f3af33e5f8e4ef347a21a0
SHA512 dbf9ff4e38439a8376a861c49f811f4cba4f48b9ee8ca031d2749ac2ee49ea15810f08951baff8d0f4ea86ef82581ed65f1dfdf9cdfef06c660fea4a9ea9eab2
SSDEEP 12288:mgUFgEsnojAeCGd+BeDuUlEqatglsLbMgUFgEsnojABAmZXuYXv:m9+EM0HdExqatgl8bM9+EM0oAhY/
TLSH
T1AA05F746BA8580B2E0670631496792AE5770B815CB039E9F6244AFDEFFF37C09E31671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f739e86c668e51cdc5aadf55f98208af294af74d0e0f3a016c685a7ceede6ca8
MD5 fbe8760ca08bcdc1ed45d5238648e809
SHA1 058e01cf92ec470a24582fd434b410106930dd6d
SHA512 7e59736a604219ee18f54f705c9e0e34440e76e42681108026e76b34cff9350716f914c3afee247d98e8a095150058598aab6c4b41bb028631e13af42a615317
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4b28e7617850ac0d92a5c2992c85f9f5af7dac20dba7ee13d34979a943d3c63
MD5 dbb3a94704ef03e5ec2608aeaa6f92d7
SHA1 407b2a04ca61b2942242fca2127dc02686c2171c
SHA512 5dad7c966c2f3343dcc8b07cd8576bf92ff5a58caaf1aa589463698b4a012e938edb67aea3d39a2e8055b9387c0fe30578c57f31c21e4cc293c2a645a4cb4f10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2890b83d01bc11574675f8d9fb933ea8832c4de11253428bb039af22d9f687e
MD5 33ea340d29b66702ba629610b2812f67
SHA1 c153bc3f551de625ec0e14a1aec57f02b62b3d82
SHA512 018a1c5b1cd494f2426dce109f3abad5d0582f37d31be95cf040a45047de1487a1dc291bfce340f761ca51f820ec6564a35f4a2b61544b3e8ed533eab30dbb04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d794d93193243a0b65f3c51ae7d6d17a9fef477e820e3e873976f51c120bd821
MD5 a7b50fef9d392413308c099136be5cf5
SHA1 c36cabbbaec0fb48fff312a6f942c9cb1d5c74ed
SHA512 8634ad93646ee18d4bd6b5ffe6a88b0fcff6706845cb9533c550392bc878b7e8986c5e372a024e97cc6e1d162f9f9d488203f883b450193e4bc44b2a156c519e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 135728fbbb1663861fea58c58cf3bcbee14fb01b8075bbfc80e6adbbaca22d24
MD5 e2d0745bbadadb4fc2276e754b1f305e
SHA1 5516a9c0ebebc29cc174d9d0096ae31094e58f3f
SHA512 f5f4337820cb28fdbc8351c1553335f466e78ea484142fd545f58f9128b50faddd333180fd23787390bd931e85822aefa86e68d287b40a93a51cb7f66b2cd333
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 453658603d317cf9146ed76e1a7f481b33b96dafdc8d92975a3438f4869a2d0b
MD5 810d9439f543fd85758a3516688d91bf
SHA1 6be032cc532bb634f4639fb8837b71ed1ccbd44d
SHA512 2b290660d041ccee312b668e1911e38831d2d7408cf1ffc137742e3cf4173f76827260c20aa77b101144a671dcc05f9de0363280f56a717aa78d19a7128a83a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d185bf6fe34b61d81fc208a4cb3b2b99d99d43c6aa3ce37f23e1af3e51be2f1
MD5 7f75a47d36374d890384d674d88af22a
SHA1 5a8db3232c9ce8670bfc92a950b41e1e9a87a698
SHA512 82ba993205601d308ac1a7090d32cb3691423402cf702b7897d77d5f9e732acffc7cd07ef3119a93089756fbcc2117ae22e3d83d4f0eb0b19dae1939b3bdac5d
MD5 SHA1 SHA512

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 28.8MB
SHA256 135e8e67bd9c04424868a986ab921601a568c3886c1d952c9e0468e50669273c
MD5 f89e643c4ef398fc626b1b230a25fc05
SHA1 92fefb976de687a40cdd26e7bc0d4a57a541f76a
SHA512 8eec4bbec9abcc04791476c916b5ef00ec955aa2cd43d928c3d58d217968d86f942e9346f01fa7ccedbcb45322bc8b8a99aa758b45d6294d1ec295eab0a41ba3
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k767k7k767k7k767k7k767k7k7UxVs:VYYCYYCYYCYYCYYCYYCYYCYYCYYCYYj
TLSH
T16F67D546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 23.3MB
SHA256 f4dbcdea2573b7bc51c227f04439d7a253c033825154fb25e89ca228a5793318
MD5 ec9017e94149c69655ed916e2caa1dd8
SHA1 de79ad24f19ca8774823ddae39d44d222908fceb
SHA512 c4ecd75139600a0b50b109372a1793cf8be2622067e7a12af809748974b3ebabe447ec46570e0fdd443ea24373d21f5953a4ff342959a27698651d23be75fc8a
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k767k7k767k7k767V:VYYCYYCYYCYYCYYCYYCYYCYYCV
TLSH
T10C37D546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 1.2MB
SHA256 41fae3c9f8432851b639a37ea09fc624f870664c0d249a4842b0327079286c8d
MD5 a6681a6dffafa88af573f1c9f9ab15c4
SHA1 22cb96ecc780b5e78ebe3a4752469020b838e585
SHA512 fb8fcf075d26104deb71c5074aa6b037ef58baf777258f219034853712a449c644eb85bc2609292640affb838f903e850b84e671405d276246341d7cf33be447
SSDEEP 24576:m9+EM0HdExqatgl8bM9+EM0oAhYn19+EM0HdExqatgla:U+E9oqatglJ+EaJ/+E9oqatgla
TLSH
T12645F742BA8940B1E4770231496792AE5670B814CF139E9FA254AFDDFFF2BC09E31671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 14.7MB
SHA256 5b37d0da17db7b2ecc0afd8f7cbb8235493d607f3b040be86d0dee39c005da46
MD5 fe2260303ff24cc357a79375ba84302d
SHA1 eae0e9751c97ebeccc5eab2a565f38e444d7bd75
SHA512 803c613666151b3b7e4021ea6253d0e47c248485905cf94a5e3b2281251e1d7ff8d1b68d16508489ef61bd6cdabb0dedceb6ebbabf9b52a3f6b27359dc906f6c
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k7UxVV:VYYCYYCYYCYYCYYu
TLSH
T1F4F6E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 17.6MB
SHA256 859daef635575a19bcf9b749ff1dadd070f4076c0fbf182253f11b6db6bffa49
MD5 90570791eaf920ecd9582b627505163d
SHA1 23cb0b9421bfe925ff4923450c893163b6ccacf9
SHA512 97b3b0e67181058fa9c60f7ba08fd4ff4c324b7cf379eee038fabad31186d375bfcd52ae9c1bb32ccf0d01144d6ee6560c742b4bf8b2d3f1508e7d6cc26e4ea6
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k7UxVz:VYYCYYCYYCYYCYYCYYQ
TLSH
T12807E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 20.4MB
SHA256 f9795d32f6418300642db97d60595155bd32f77b234c77f1cfcdfde39f8d78b9
MD5 41d210306b116b91fd5f0e03700e3969
SHA1 4ff59c8a6f328711afff7ac0b2655827005620d2
SHA512 e377e3c82444b1b92a3be8f98cb0bed89febd9c63d99292c022e3d9feb836a92c66c45e7e6af376774ebc1f3043ccf6545b4c7627384844786ec2b57ffccc761
SSDEEP 98304:17k7k767k7k767k7k767k7k767k7k767k7k767k7k7UxV/:VYYCYYCYYCYYCYYCYYCYYK
TLSH
T17127E546BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 512KB
SHA256 d51c305c67a98afef442ccd392c520888448d933366c2c9dd79c65abc66ed343
MD5 82df101d5af1d3c94eddc3ddf2cd9bf5
SHA1 4e20023d5467f46c8bb6320d4e23ef0db62da160
SHA512 8b09117b3f634e5cdce18494963f0e0509185652e84e8ecfd9d0621db454c85fb4d4777e6e44d75183c89b7c51d42af4a9f470f395f5c6e5d61963484e35bccd
SSDEEP 12288:mgUFgEsnojAeCGd+BeDuUlEqatglsLbMgUFgEsnojA/:m9+EM0HdExqatgl8bM9+EM0G
TLSH
T1CCB44C46FA8684B2E477023148AB83B75B70BD154F12D6DFB348936E5E337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cd9221f9a45297728d926b65452ac4f5153d8e7c9d0cd35952a601d0c22be232
MD5 f8b8d8773511cf9e9dad82841d022717
SHA1 a8d29c1f1d8912cea11a806b48933ef5bf4e5ebc
SHA512 d654a9ee841a462c51430066d41abd647f9e699bc78c3c52dd80d12654f8b5121e224ea74753bdb92fb7b0bb1049259963816bc7d9a6e9b2b856f66fe2135ddf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 65ef7991e7729aae0f5854ed50535036eadaf33468122131274b5840c4920288
MD5 3fe79a29d19507f7d35d4fcfd340081e
SHA1 d3406de10c85d421a5c06f60d67c167d88a0a02b
SHA512 7bd2683cab184375a94844b553f66a29fc9f1cdd34af3c7f38942d9b72153f1c5f5a734e23d2d63b59292d1b292c3f14f95245028ad20578cc4ee247d4e46bea
MD5 SHA1 SHA512

Submit Download

svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABCCCBACCBACABAAABABBCCACCCBAABAAACBABCBCCCCBABBB.exe
Size 2.8MB
SHA256 1ee46210795d690540f2d8a4430bfc0a8091839d810479ac04c9bc5aa13012a6
MD5 b8f55b68011079274b88df415bba3bd6
SHA1 13f87b31767cac669fa6ebeb8228c8c4ff959029
SHA512 786ed3c7ac0820fe9c36af2767fd05f2093241b50502c11c1a67696d41618037a2ae0bf20458b95aa0a0a4d6fccc81c75f14cf8f5944f2bb46bffb8093c7c365
SSDEEP 49152:U+E9oqatglJ+EaJ/+E9oqatglJ+EaJ/+E9oqatglJ+EaJ4iw22:17k7k7M
TLSH
T153D5D446BA8984B1E0670630496682AE5771B815CB139E9F62449FDEFFF3BC09E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 50fb62af8ed4d5af33d492cfad79e59a70ebe0003a2e4eb32d240c3424cd276e
MD5 1613e2b0bf6d6b3921344e314e815c35
SHA1 79e4bc313115725513ee2bb9aa9dcf3b0b721026
SHA512 0f23b2c1b144f2ebc0dbef2c253da3c06d8d64e3bccde981ff61aaddb2de8d3043c2d197951249b5cff772143012969170bb57e8c39a885959a0116e043213d3
TLSH
T183113A12E4E9C853E873398B933A9E831DD823FF991C6E205205451CEBD6C328D154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1592-54-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/1592-90-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2100-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2100-63-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2100-89-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2100-30-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/2100-16-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/3828-119-0x00000000004E0000-0x0000000000501000-memory.dmp

Download