3107929709905250f0c247d81b60068103a4eb433b8dc2b2270ffda32f87624e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
Size 1.2MB
Sample260822-np5avsysb1
SHA256 3107929709905250f0c247d81b60068103a4eb433b8dc2b2270ffda32f87624e
MD5 82cac55afe56355571f9d8fdbbc46e00
SHA1 676e53724c83e780354bfd154b8a4a9a230c64a0
SHA512 c505598f4162d3ab5892f47f2c9e25ab3b0619be1eeccb06ecf87c516151d6f40aa6c0d18cd443a6953a862f50e7b5bf38f3aba996a6e7e06db35cd1b17161db
SSDEEP 24576:m9+EM009+EM0q9+EM0HdExqatgl8bM9+EM0Zkxqatgl8boQslZOZv:U+EM+ES+E9oqatglJ+EOqatgl/nK
TLSH
T133556C46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E5E337D0AB36765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
2272	svchost_AAAABAAABCCCAAACCCABAABABBCAAAACCABBBAABCAAACBABBCCACAB.exe
488	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBCBBBCACCACABBBCBCABBBCBAACCACCBACAAABCCCABBBABABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe"	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBACBBAAABABBBBACBBBABAAACBACBCCCBBCCBCBCCBACCAAAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABAAABCCCAAACCCABAABABBCAAAACCABBBAABCAAACBABBCCACAB.exe"	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1492	sc.exe
3196	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3004	cmd.exe
4828	cmd.exe
3884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABAAABCCCAAACCCABAABABBCAAAACCABBBAABCAAACBABBCCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
488	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
488	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
Token: SeDebugPrivilege	488	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3004	1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe	91
PID 3004 wrote to memory of 4536	3004	cmd.exe	93
PID 4276 wrote to memory of 4980	4276	svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe	94
PID 1944 wrote to memory of 4828	1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe	97
PID 4828 wrote to memory of 1492	4828	cmd.exe	99
PID 1944 wrote to memory of 3884	1944	2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe	100
PID 3884 wrote to memory of 3196	3884	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_82cac55afe56355571f9d8fdbbc46e00_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAACBBAABACCABBACBACBCCBABBCCBCCBCABBBBABBCAACBACABBBBBCACAABABAABCCACBBACABACBABBAACBABABCABABBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAAACBBAABACCABBACBACBCCBABBCCBCCBCABBBBABBCAACBACABBBBBCACAABABAABCCACBBACABACBABBAACBABABCABABBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe" start= auto displayName= "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe" start= auto displayName= "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCAACAACACBCCBCACAABCAABBBABBCACBBAACCACBBBBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAAABCCCAAACCCABAABABBCAAAACCABBBAABCAAACBABBCCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAAABCCCAAACCCABAABABBCAAAACCABBBAABCAAACBABBCCACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 89b635e6c7724882b14bc2faff61d14c1e882199812f3331cbe2d55e23c0d08d
MD5 d399778cae90a35e541c0ba556d85e33
SHA1 dcd1d7feb1b30461c43947f2df7ca036b25a57e8
SHA512 7bee9cad2f2a1a4bdd357a18343d3e0425d301cfe11e660d32d11f91f66530f23b2994b85f2113d321e7e74a9c680e99391c5df81899aec080884fd041075448
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\qap`g`v~dtlq
Size 10B
SHA256 a90258d61c278fb90601ce6179774827750b3e43874b37c71a2d886e51171cf8
MD5 1492db765feab881999ba0877568eb25
SHA1 ef3bdd58b94133de8e814a58cb6da5cea4e91752
SHA512 2b69315e50a201048c6f6d89ffcf383449ceb521e90aa866c7c61e46269bf61edce19043e2c2526b2b80a49f1ae369047c7556e4644e75c16e57af98dd12f3fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 417994733080f41568a338d77b53bb227bd7fa0fc5343c80c08f9327c5618c97
MD5 0f5422594771ddb67b3ddfafb45834d7
SHA1 787bf5466e3cf8ef81d3159b53a1028fa6d51914
SHA512 19ed60b076c0d65903cdace15eadb0dc8f1ed9a687700d4454267d1d6f5082b94461e814d2af0f9e5c37e1ad68d3653c6abcbd23d25d2dd384698b7b6a19e27b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 2f8cb9759befd70100912afec0068bb8ef84a867ccd217c439c73e348e89f0d0
MD5 2e74361d725177d4f1fc2a7ed92a31cd
SHA1 854c358aa662c40e331faab817cc0631c21bc3f4
SHA512 b5e6edc9abb0ace7a5c4aa908df331b3760c70f06c501b702fb569a779bdfe95168a904c4019ee3b599407296aaba06ac223871ce72ea32244d1d88db30f7109
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\qap`g`v~dtlq
Size 10B
SHA256 113eeb7b722cb96de562008514d4bcc5a262ff1b0fae8602bc4a1319cd6421ab
MD5 bcd69f0595f969b85f6ffe5d4c51552f
SHA1 b05d20079165ac20fd2161d167f75408e8235096
SHA512 51773e70cf6a01e8bc04fc39bd319468873529b1650952bad940ea0dd7f9bbc6f051b55cb77338a638c10cb223e0e1eaf63c77cfe0caf95ef35380ebdb3879ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fe630fb9176a52b7a6e0dee7ac0da3680d83504093d802293af8863b4d25234
MD5 da245fee3a4b211dc7df7e82b15032dd
SHA1 a10389d2bda23ef9f7093631c869e442ccc1280b
SHA512 1e56b22a08910e5b6d28cf8273a47516ea283ec0c4ddba917d298f41e454325e8cff397e1a5a340f65319ff263270779e0e2e53499ba75e965475766af190ee7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20030c1e1d8640a7eda38264a95f04f0727656891aefef02b4f83d7235a98b4b
MD5 ce900eb5827b6bfebd7a018b18751676
SHA1 2e3bab035c54dd32515fa79ead7e4ccd53eab27d
SHA512 4556497e441d24ec1c8df4bf1290cf2599c3d362a94508afee32eddd80f8829f82abd6e5dda9f24b6c19f859c94883493bdc9488f71883aa89976a444fdcbaec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c02a5881af6ca471f3b69031c65279882ab55e078c35816d75f0401e68e2336a
MD5 8bca3a413a2cc04d3182b0e11973080a
SHA1 8c86e9edb8d0bc5325b3b1799766d05c071125c3
SHA512 160a8bfd38fb9e6aa7224b3817658c70f250d72e64a980f1dbf1d8851cc1fddb9030119b6b2a0e3d8eb9b2270a3228e69aac02609575bf958829afd658de0e23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d09f7a09d82c58bfb36719573c400888a0f693c261b41b0d88ba1baeb2f96d56
MD5 4795c04da9afee9da1530948b0ff7636
SHA1 c34a0c277f2c1a1b2c2f7d3986a5ba0c3eac3632
SHA512 d9ed1674c37c7beaf86f6a959688d3ae1eab98bb863e536b802f84669412de08ed7d40befcc8adab227e6a8652c9c491183e7a3f7e725a3f6fdd06894c143479
MD5 SHA1 SHA512

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 14.5MB
SHA256 3b1254dbd176cde8988adf61474eab9be7ad72b89a41966692224e79df7cac1a
MD5 782c0375008fa849251b9a57917d4195
SHA1 a26f99bd6fbdb7dfd3b645c4cea947ef5dd0e286
SHA512 df5943b9054b58b6c22357267f8664a3deb9a7a8583e7e3dcb2e3d48ad89f5a70cc4a5b42333be639aaffd2267d8caeaefa6c5fb86768f509fda33df2d9a2c39
SSDEEP 98304:3xiexiexiexiexiexiexiexiexiexiexikellB4twPWzR:wBBBBBBBBBBjnO6aR
TLSH
T10EE67D46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E5E337D0AB36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 4.6MB
SHA256 525555be3d5d955eb4448cf3ff59ed425651839a6f8dd36b38b09d6083b886c7
MD5 5a0518cf40179e86c50d607a4bcf0d4a
SHA1 57c095e727ebabea2a45d92108cc933ea2ab58a1
SHA512 8c01da3ca45a4d70dd13ba555b675edc48be4e87e09d92f2afd0e4fa4b7aad01143cc8004215d2b79bb18cd46786cab8e464bd54d2d4304fb1fa927092e117eb
SSDEEP 49152:U+EM+ES+E9oqatglJ+EOqatgl/nB+EM+ES+E9oqatglJ+EOqatgl/nB+EM+ES+EV:3xiexiexikellB4twPWzW
TLSH
T114268D46FA8584F2D46B0231489B82B79B71BC110F12D79FB398936E6E337D0AB36751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 5.8MB
SHA256 737fce8202817768f1b6d1a5ce54946a3078df54ed852a510b0a3b9ea55c698f
MD5 3673f20cfa9cf3bdfe53677d18bfb1d5
SHA1 ac04c2c41bacf2d5acb7d5a7cca2a60a00fabe8d
SHA512 73d476eadf5b8660fc12c7761cf3e412ccaeca33d673f354460676546c6bd1d0068d395fbc5308360ec03c7c9295ae5528dbacda803ee6a498fd7291fa73d15f
SSDEEP 49152:U+EM+ES+E9oqatglJ+EOqatgl/nB+EM+ES+E9oqatglJ+EOqatgl/nB+EM+ES+Es:3xiexiexiexikellB4twPWzx
TLSH
T182568D46FA8584F2D46B0231489B82B79B71BC110F12D79FB398936E6E337D0AB36751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 9.5MB
SHA256 f4b32437da95ee1b11fcfb8e4119bc6142153e9d92f671d793be43adce88bca0
MD5 51e16783f793957ab9ba770f9819d019
SHA1 4ec167cce8191cd3847fe1d2724668b845ca409d
SHA512 7c3a2fc3abf455a76a133a650a8a9268241e9525271f1bf5327dea5a5f670a3c6c88dfd12196a081a4ec9c2a5707e311ee64a9c463c15a4735dfd53897b2ed3c
SSDEEP 98304:3xiexiexiexiexiexiexikellB4twPWz7:wBBBBBBjnO6a7
TLSH
T16BA67D46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E6E337D0AB36755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 10.8MB
SHA256 4bfa97d8b20a6811d01f996fa96c8b34e36d380d1f1686295d9b9f0f3c7f8203
MD5 df9a7c8a286db1df52262a7c20932dd5
SHA1 82464bb7023e8a5025a2154af11f99049850c530
SHA512 fa078e53bbd9c2804647c292e7bcf23a0b74153b42cfd89a8a1c3cf4ffd07187e3ae4185b35bee3852531ef08c4df5c8d0eb872524aa3f176420ca39537bdc51
SSDEEP 98304:3xiexiexiexiexiexiexiexikellB4twPWze:wBBBBBBBjnO6ae
TLSH
T151B67D46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E6E337D0AB36755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 12.0MB
SHA256 5ff0b042412f6e4db2045ad0132bbd21ea12b120997251eaf0d9620f9dfbb2e9
MD5 8b55bb78f8eb5f81970a51da0f25b7bb
SHA1 695732eb25596b068b61a1253c90c5509c86b485
SHA512 a1c3a9d8a5ca71ea7826ab78df36ad47d52b8dad80016d585448f19c21b454b131a788aab210a4e90c5ed3b0c9ecba238b73ab182d95f92bcee3b1e8923835b9
SSDEEP 98304:3xiexiexiexiexiexiexiexiexikellB4twPWzF:wBBBBBBBBjnO6aF
TLSH
T1FEC67D46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E6E337D0AB36755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 320KB
SHA256 db01746959a21c4bfbd352a753b334050f9157278273ada9181c0669e33c441e
MD5 3fa83d3b15893d0ff425404405662ebf
SHA1 1d0fb4acfce0bef8d160f70f1e11f7fffe97f6d4
SHA512 102d35ac1f30384149bdfa61a34f895361bb4066e59fd82599cc1b7e2dcd772b8f98abbb8f80a8478be405adb6f2749a8aa1e42441f88d68584c980a4f7dbd7e
SSDEEP 6144:m+dTTUFgEs3XojAdd+dTTUFgEs3XojAdP+dTTUFgEs3XojAdkNVE:mgUFgEsnojAHgUFgEsnojA9gUFgEsnoK
TLSH
T101642909FD8744B5E97B51B04DDBD2BF8620BA2587128DFBF609C74B6933BE15838212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d96f346716d84e995d501e85a7d60a899fa2e2c470306fc51285ead4df08f8e5
MD5 0dec35662791c413f6f368b31ee83daa
SHA1 9f22e3cf01cd61c5e47e1cff2797e2bca84947ea
SHA512 34205a54841de44520354c500c29ad00473965619a3355cfd15cb617ab32d508c2065ab6c70ebd123ab3af9ccd974e1a29ea646f2b22a85e4d27268d0912b84c
MD5 SHA1 SHA512

Submit Download

svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABABCABABBAAAABBAABCACBAAABAACCCAABACCACCBCCBABCCAA.exe
Size 1.2MB
SHA256 3107929709905250f0c247d81b60068103a4eb433b8dc2b2270ffda32f87624e
MD5 82cac55afe56355571f9d8fdbbc46e00
SHA1 676e53724c83e780354bfd154b8a4a9a230c64a0
SHA512 c505598f4162d3ab5892f47f2c9e25ab3b0619be1eeccb06ecf87c516151d6f40aa6c0d18cd443a6953a862f50e7b5bf38f3aba996a6e7e06db35cd1b17161db
SSDEEP 24576:m9+EM009+EM0q9+EM0HdExqatgl8bM9+EM0Zkxqatgl8boQslZOZv:U+EM+ES+E9oqatglJ+EOqatgl/nK
TLSH
T133556C46FA8584F2D42B0231489B82B79B71BC110F12D79FB398936E5E337D0AB36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4e60163cddda7f4c3d68c6213443615fcdc694dbcce83640be43d50280b73cec
MD5 581e3b674470dff4eb648580f1272f88
SHA1 11ee933c9982b7b7f4630749a54bc4af69220628
SHA512 2d439903e1f4653df3099b8992601f06298b6ecc82e5de4d1ea3e71a352db8beefd0be159912d618cae0724b4b7beda0dbd8c2b4b6e1b4b8ad8d492fbfcc27bc
TLSH
T1E81108B6E0F5E877E6332CCA8119D84A5CE4369BA5ACAE0453058218A7F5C31CD69CB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/488-95-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/1944-10-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1944-69-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1944-93-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1944-32-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1944-21-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/2272-92-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4276-70-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4276-94-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4276-48-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4276-33-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download