94f8838241be5c47009e359950244efb7cd413fc2f29b5f0de87462f30ffe738

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
Size 2.3MB
Sample260901-1vzzjsfa22
SHA256 94f8838241be5c47009e359950244efb7cd413fc2f29b5f0de87462f30ffe738
MD5 0a6800735b2ef9315e8499883a188c88
SHA1 2dc5ae01b53611b4d4f27f0dffb84bd7394453a2
SHA512 90758a67c54b50ca56285f955a26a795f3bd36f44ce071d83a577cf1cb6bba9faa6889dbf3f150d1ee34a3bbf914b708e0a9c8aac155ba8f642a2d9249853ac9
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+Eg:JOs
TLSH
T130B55D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
2372	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
3984	svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCBBCCCBCCBCCACBCAABBABABBACBBBABCCAACABCBBAABCCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe"	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCAACAABCCBACCACCCCCACCBCBCBBCCACCAACCABCABCACCABBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe"	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe
2288	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
1644	cmd.exe
5872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
3984	svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe
3984	svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
Token: SeDebugPrivilege	3984	svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4288	4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe	96
PID 4288 wrote to memory of 6120	4288	cmd.exe	98
PID 4148 wrote to memory of 1644	4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe	101
PID 1644 wrote to memory of 4588	1644	cmd.exe	103
PID 4148 wrote to memory of 5872	4148	2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe	104
PID 5872 wrote to memory of 2288	5872	cmd.exe	106
PID 2836 wrote to memory of 2480	2836	svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_0a6800735b2ef9315e8499883a188c88_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACBACCABCCBCCBCBBCBBCBABCAACBACBACCBCCAAAAACBBCBCBCACCABAABACACBCCBCACCABCCBABBCBACABCBCAAACCCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABACBACCABCCBCCBCBBCBBCBABCAACBACBACCBCCAAAAACBBCBCBCACCABAABACACBCCBCACCABCCBABBCBACABCBCAAACCCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe" start= auto displayName= "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe" start= auto displayName= "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACBAACABBBBBCCBBAAAAABCCCAABAAAABAABCBBBAACABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
1⤵
- Executes dropped EXE
PID:2372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABAABCBCBCACAACBCAACCCCBCABCBBBACABCACAABCCBBCACBCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 1.2MB
SHA256 25d36080f5ca17f88711aa2e983f34ba04f45eea583357d8fd5ee962cd4179d3
MD5 a2cee10057d9947454cdad553b4a1a07
SHA1 4cbe0ef93a4f349198eaf6446eed90470a581699
SHA512 9bd848998c8cde1507266a2ad0ebb56082b0b4de96254402f2829bccb8f238635cd43c4e6e1db89c7e153af04311455a779b92ac47b55e7220b7afc6b132b2bf
SSDEEP 24576:m9+EM0q9+EM0islZOZI9+EM0q9+EM0v9+EM0q9+EM0q9+EM0v9+EMNExqatgl8bN:U+ES+E3x+ES+E7+ES+ES+E7+EBqatgl+
TLSH
T1FA455B09F94244F2D92B01B148CBD3BF8B70BA158B128EABF74DC71F6E337906929655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 7.0MB
SHA256 4ea31cf941e8a479ad74cb62ee4fd23da850b2b83970b1755ce3f43ddb9dba27
MD5 8ae7125fae829991e6c1b18d3e21f416
SHA1 39bf035a2e40e625bc76e7199b7b9bddddcb56b0
SHA512 ccda339324552b5232a8f819362d047190a8085cd009ed843ee39eb3ed47f0342f75557ac35b02f041f72eb8b0d57a180abfe35499c1bc0b6258d78ebcc40708
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+EG:JOsHOsHOsYZ89
TLSH
T10A766D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 13.8MB
SHA256 0726e3d805cb99992eca287bf79037463d832832390eeb04988ce1331f56aa8b
MD5 d7f77582c2d07c9daaec659f5597dac2
SHA1 3492faa19a8e3d6b13360cb1b0295f7bbf5ca43c
SHA512 b6b6cea8bf851801ea46eba41de10b40fa4e136b4d8497e04684f5bcfa943fc4aa266364b3d1ae90286dff5b136504dab1ec3ff4d10d7d2a923e8c30f4e730cd
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+EP:JOsHOsHOsHOsHOsHOsYZ8k
TLSH
T14CE65D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 16.1MB
SHA256 ba26df681846f874ab39481c8e55bb529f6f2f1c144720ad0d51fa1391a51d06
MD5 6f08dbe9e58e219437ad0b5d4ae64120
SHA1 595faf96e545fa20bdbee93d2beccbd158436dfa
SHA512 b64593331ce1f6487b88a322628b6f33a67a26a57c2b9a210a4ab2bfe66b50e8f12698feb783538a28244f5fd97cff6841da003b65a3682853fc2d6d6d93371a
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+E8:JOsHOsHOsHOsHOsHOsHOsYZ8V
TLSH
T1AE075D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 18.3MB
SHA256 79904e95275fdd5b6cbb37e14407eb767bad0ea232e5892f04f539681539e4f6
MD5 5e3410150134d83d92335dbd5b6889d9
SHA1 1a825fb0f89458bc327400df78fc4dfc73576227
SHA512 288e5970675bf16cb5ae0061a0ea3655321d8a463f2ac94077005b45e4bfc6ef94885c8973f6abc8b53b109571fec72fe76fac5018eaf2c82cd4c997d0480ed8
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+E3:JOsHOsHOsHOsHOsHOsHOsHOsYZ8u
TLSH
T157175D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 20.6MB
SHA256 541feae59ca2b8d9611dd825b13923a2cf900f52910dcd969b7e4937d48ae621
MD5 90a344a432d150c8b3d48cb61c408e2f
SHA1 7a98c2eb1a1413115ac66c5dfe82b1563b389ce8
SHA512 dee6b84238501d175f32c2816e328b11527006149d43f0df70177454cd099680fc78cfa5bf9f2a1b3155eb752273341cb558f9c6f505ca6f431778d6fc741cf4
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+EP:JOsHOsHOsHOsHOsHOsHOsHOsHOsYZ8g
TLSH
T122275D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 448KB
SHA256 fbde9197302654b466f49964d0d886050c1dc925f37cbf126e522c91be07238c
MD5 8ec5aa184978fb213a31e752498caa88
SHA1 e03ebb20b37652defe4b09f1728cf16ab3451660
SHA512 5370d47959ef730b4e020701e19652e4e337c331a435f143ed9fd95442b5f7d27ccd123c0d6dacd72705dec6bd6fddb9bc2d4f1cffad73d01d7ac930d20ff0a6
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAQrCB1igsNBfcsc+ZOnZxqgUY:m9+EM0q9+EM0islZOZI9Y
TLSH
T19CA48D09F59208F1D96B4570898BE27FCBB1BA124611CFAFE35887176F23B61AC2D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8847b41da7cabe8824a565159441b9db23f69087087a53bdeb04d2d55e842859
MD5 8cfe2bdd9f0b5867716fd385c8673ff0
SHA1 8509a8239a29f5189f4bb31c53437cd9e34a955c
SHA512 290b3230e0677433e3dbfef479c5a6041631973247a728c1d496a4aa66d1a41ca999e4665da2d991be08c3b24da9a269fe327731c78005414510307a7e81f78e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ccba170d08eeeda1421d32bc975660a8ffa18e68a7cb5046c6e0dc3da8419c1
MD5 a12691586bd11882fd4487d02d299d93
SHA1 3cf337545dd13535c76e5faf84c927520b467ce7
SHA512 e239f0e754eb3af27103f6c974d3f2a4d76fd8cd6a8f3f72811758d10f97af35ad9bfc614f2897a7357946c0847689d6b385bccdf63fbee39bd139198cec8ea4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b4bc1249babe19b9876405c75e16fbd84589493390065647588ec08db8bd3d7
MD5 60a0fbdf3c712b4bb98eab8434344f24
SHA1 cb1896210e23a95a51775e0f491abc66bc6f6bee
SHA512 307099f77184830cdcf23135e45c2af852e2f32b47effe2ef112211f6f62a119d1356d9c423221af0048f1fb833086304c10cb0aa010da89e20ecc5a22f2d15c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eca97d0e1da27c8c4917dfda05cb90050beaed7f76a688a99817e7728293a5c2
MD5 cb2e307ab4fe8ab0c57b7a6a914095e4
SHA1 c8156438d48580b611d77bbf9a86d152e00c1656
SHA512 06c270498d37b255857be3160c2131430b1ffcddbcfdb9183294d40cc8583182361057f70b4671bb431fb3a7b4da015c6cf3f2cfac2d59a4e0a66180526bb3d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac59b0afb8c36f57f101a3d58e3f22ace26a0eaaccf6944e6e792b43575cfa95
MD5 c7e5b61c1d2312e75ca6bc392276d396
SHA1 60b58a6cf5369cdb219c14ac2c5d7c5e5d18a8ca
SHA512 dc5808d3235d2f1177b5f112cd26280c0f34c8f57d310e5fbffcbe1aad89e559e92e5bc0738b21f95ed18e5cea62f9c718edf5fef156ccaa3589574945d9b1de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad7d762e2caa7425a1c05ade27d318e495f7fc000723f9d7580d498ca1a8b160
MD5 92449100f7e5991f934f2025627adef6
SHA1 f9d1f15793fdb522760c8c94bf48e68e4085d05b
SHA512 127e428398140d519ab3b7852cb7bc013d36ce4ce112a333d0fa214fc032f3119acb007431544a2dafbb34ac67c82b8612a70d0556d422fe90c66f2b3f3358c4
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCACACABBBBACCABBACCCBBCCAACCAAACBABBACBBCCACABBAACA.exe
Size 2.3MB
SHA256 94f8838241be5c47009e359950244efb7cd413fc2f29b5f0de87462f30ffe738
MD5 0a6800735b2ef9315e8499883a188c88
SHA1 2dc5ae01b53611b4d4f27f0dffb84bd7394453a2
SHA512 90758a67c54b50ca56285f955a26a795f3bd36f44ce071d83a577cf1cb6bba9faa6889dbf3f150d1ee34a3bbf914b708e0a9c8aac155ba8f642a2d9249853ac9
SSDEEP 49152:U+ES+E3x+ES+E7+ES+ES+E7+EBqatglK+ESn+ES+ES+E3p+E7+ES+ES+E7+ES+Eg:JOs
TLSH
T130B55D09F94344F1D92B41B04CCBD3BF8A70BA1586128EEBF74DC75F6A33BA16829255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cb3f2716e52c99f2c3f5b4e34730bc4334037677046a67b59c3e2c3b33bd2fae
MD5 779eb26f3338dae8911ed8f9936bf415
SHA1 9c7dbd72565229a051b8dad600e170d6d08d999f
SHA512 2250f2e36d0788f77803eeb05d5eeeefb6f1996393b766aa08698d185e9f9ab4b46d7b1f7e95075ee9e45ca0b286bf3a93edbeb13d784dba5be5b5df0d49f318
TLSH
T157115451B0F99823F03228576A29EBE708A53BCFDC98AF581A8C5219B755C7DCD290D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2372-87-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2836-32-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2836-50-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2836-71-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2836-110-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3984-95-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/4148-82-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4148-33-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4148-10-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4148-59-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/4148-21-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download