4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Size 12.5MB
Sample260903-mefdbage95
SHA256 4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40
MD5 6b30e9ae3218a7e40ab30b0381bed949
SHA1 f4e14971d5277076f6090d9309ec69c93c1c8340
SHA512 3e4d3f5686f8167e066a88e5e273edf0794e6fcb311e8ed002960ec8fa2c31921aaafc3e699c5aaf3464406d1a3ee58f5a0e70c4543895edd11bd4346bb9f499
SSDEEP 49152:U+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+En+En+Ew:y1MbQ9yDAD7KjjqkusjmqMhO
TLSH
T17ED68D28FAE584F1F97B90744CABC27ADA717A214533479BDA99C60F6E337914C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
1040	svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
1056	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBBABAACBBBBBCBBBAAACCBBCACBBBACBCAABABACCBCACCCCCBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe"	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAACABABACBCCCCBCAACACCBACABCBBCACBCBACCAABABBABBBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe"	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4984	sc.exe
556	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3920	cmd.exe
2208	cmd.exe
392	cmd.exe
1704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1228	schtasks.exe
4520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
1040	svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
1040	svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
1056	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
1056	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
Token: SeDebugPrivilege	1040	svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
Token: SeDebugPrivilege	1056	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3396	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3920	992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	98
PID 3920 wrote to memory of 1228	3920	cmd.exe	100
PID 4940 wrote to memory of 4784	4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe	102
PID 4784 wrote to memory of 2132	4784	notepad.exe	103
PID 992 wrote to memory of 2208	992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	108
PID 2208 wrote to memory of 556	2208	cmd.exe	110
PID 992 wrote to memory of 392	992	2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe	111
PID 392 wrote to memory of 4984	392	cmd.exe	113
PID 4940 wrote to memory of 1704	4940	svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe	117
PID 1704 wrote to memory of 4520	1704	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_6b30e9ae3218a7e40ab30b0381bed949_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAABABABBACACAACBACCBCABCBABABCCBACAABBAABCBBAABABCBCBBCBAABBBBCACBABAACABBBBCBCAAABBCAAACCCBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBAAABABABBACACAACBACCBCABCBABABCCBACAABBAABCBBAABABCBCBBCBAABBBBCACBABAACABBBBCBCAAABBCAAACCCBCCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe" start= auto displayName= "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe" start= auto displayName= "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCACBBCBCCCBBABAABCACABACABACAAABCBBCBCCBBCBAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCBACCBABABCCBBBCAAACACACCAACCAACCACBCAABCABACCCAAABCAABBBABBBCBAAABCCBBBCBCAACABCBABBAACBBABAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABCBACCBABABCCBBBCAAACACACCAACCAACCACBCAABCABACCCAAABCAABBBABBBCBAAABCCBBBCBCAACABCBABBAACBBABAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABABBACAAABAABAACACABAABBABABCCCBBBBBBCCCCBBCBCCBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6c976885534070003643b3ca1607fb5ad773ec7fab0f0f7aec78049110305201
MD5 0b22ba1eed469067d65454448dd58c54
SHA1 0aa0ca16196ca23aed18a5e7ab7a3928c70c0e60
SHA512 92740ce5178b4f71b1bbc143f03a235cb6f79b80f26852061c1dbfa4baefac96b8612d75bb25595d7cc22a954f1feced9c35dfb07faeb6600aba4420b131aebb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 66d9f61486aed8ac307f4308d43640459a0a3426497883a80a91814da990d67b
MD5 774592f80b0f85d80af114d85a1ff5fc
SHA1 56993889c64f558fe91d09248d47f16e79e4ce05
SHA512 8d0ab4baac0202b3cfc23bb2b28a24a8f4ace2d5e568171088d864b492b9fed9bdcd2f363b03052796477f26486e208a7322b01bd8f5e0a46a2c83b0365f61cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 ecd9ad51e9574a7c0f2de4a58a1c9e2af6da7d0205c8a6b064bb90af80f41527
MD5 2a68d400dd0b63391c42c01e60aa458d
SHA1 b6de908e4dc9fc316cf031e301f92f644c2688fb
SHA512 86f82e969081d9bc8f33c15f549a5a316fef48c7d5987f5a77e229604ca37f78930af34dcc8c96799ef58f2354094d32315ced64a2fe0c83cc3e970918284841
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\qap`g`v~dtlq
Size 10B
SHA256 8595caf7c3b9075bb3dc81e35c86cb4e998ec779dd2d17002575e0c41bb0f2d7
MD5 10efaf46a67676aa42a15bd4c96436f8
SHA1 993432e92d814827528a62ac0c99487e051819a0
SHA512 afe89283adfce383caa3eeb3ec3cd64e677ff2465332d469701c48eb93cc0d1882af99e3354854b8e1d1209c81e0d64515de9a65d698fbb0e25e0d55d1eae2e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qap`g`v~dtlq
Size 10B
SHA256 bb6c4e4be1aa40b32018c8889e7d592b20f955d89b6a434ccbccf1d72e04c88e
MD5 1ad42e23fc90f9a0a774db711e9fcc10
SHA1 2d7dbe621237aa1a89b06c7e5fc593acd414751c
SHA512 baff4284f65b899ac9f26541ceec1e09a299937b788e70e191ea7fde965d15c0b5789a3748251a243d2efc3116f35b063a42036483f3b1e427c578e1bde8a384
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\qap`g`v~dtlq
Size 10B
SHA256 abee941cdc3cc625dff43ead2ca9e995b454afa68282104cd0bf9507edd56984
MD5 0424300885c4fe418c5da09074a9944e
SHA1 0b7b84aa4bfd5e94919d2f5684fa140c66b343c6
SHA512 d9c38b877be822f3a1d661e6f0c5416a8659590618242d83bda15223cbcbabcabe331f76785caa0943f31a388503178f6468616a2692ae6d0cab62157dfee74d
MD5 SHA1 SHA512

Submit Download

PingNew.exe

Path C:\Users\Admin\Desktop\PingNew.exe
Size 7.2MB
SHA256 af3c7065e34fe16e8ee0726da94e87c4b3ba76de2813fff63a7b9cd631704db2
MD5 b6189b30d34cdfdeb42043a8d400c86b
SHA1 32884ba6a55b5129572946d11905c6b845bc8cb2
SHA512 dbff7a6a76b63c4ec5ee00ac7bc31b80db0e2ecfae6d7c826204966ef290b03478abeaa207b7cadf2fe93f70f259a6088c3de75150a669d0bd93efe90eb992c5
SSDEEP 49152:U+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+En+En+E3:y1MbQ9N
TLSH
T19F766C05F98304B1D97B50B04DDBD2BFCA70BA2582219EEBEA4ECB4B7D33B905429751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 697d3c4b68624a06cdf7683c112af863a8aaa4c6714dc7475b3083e01f86d1ac
MD5 1cd04ef70f07a8460c1c85ce7e057be5
SHA1 07cd06548ebd63db09b4d5adc5f9024cfe97625a
SHA512 958efc59d7ec67f21a100538e6d6285a06e65bd905c11bd03594de11e4daae669a2e96790687ab5c66cd0a441513fc335eabfba78e73c7719e6e1adecc648624
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f410b85d6a0f222ad58fa5f924b85b3a71bdb40a4414d0262b865756644d9090
MD5 07fd2ce84e1c157d24ed9a36a1666cd0
SHA1 a36d003d2f81bd3e7c1de6c53d4fd807cba47a7a
SHA512 ab2616c60f79072496f1872ae4aca63a89588aa5c5f91815acf67aa7c9e15111ea15839fa2b512d391a32594eda994b818de56d8edff9b2f25fd23d83a2826f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 109a66d8639ecec22e004ea8420e0c51365fe03f2b3678b34cc55b9d4f1b1cf8
MD5 449868c60f2391ad0000de78ac58baf7
SHA1 ee306ee8d764de386db7d1b375aba0d0a6018090
SHA512 5837432f7bc45c0d83d2a14a0400e1266ce30145fd4edad77633a2268ab076b33b186672e40a27c3558f3563a7582537b8e68141d0926b792ef5e5c482326a68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5f0aa8c9e4e525bc86ea8a28a9dcfb7946673af36fdd348d94eeda6bfe84cd8
MD5 474577787195e54b42b01e42557c2bc3
SHA1 eb7ef581c3e7522b59f28fe2f70922db8923ec57
SHA512 7a68e3bed91faf18a791ae3c1eb5d47576665ef7423d20bab8d7c9c17ca69335c58be4938798f61dec1fefc4515985affb76c0da6058e65afbf420877809ac47
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c31a020ff6999daac7ce3ac863468279cc0f3c163ab09b6f1b60c7e1c6437127
MD5 f6dd5ae2af34a866de9b4aa7a874ab21
SHA1 f4c3861f3c739241ddff02049c025e2eade97f4f
SHA512 0d090788c2214819df5f37f6fbacdb8aeffb8e535ab3eff31df841473f5b1a8077c0301454e699db1807486445b3df1bb129daa87c98555d2f32e7b940a0b676
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8b0587651a0ef335baffb98462d0b9f8770ec82812e2cf12c5bad4549c64079
MD5 b9453790fbf9f65ee44b3590875022f0
SHA1 efe98af254b2d3d8f89da3cc150808034b502192
SHA512 785a21032adc18ff8725b5e1d5d79988e9c22283c063f6662fa306e114e26bb406d43b45a00860f3c7618dabe1c2727e6ada0036cdb027792167772153e41f3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c14c0f727bca92be8f0238bc5c4fccd3639e2bd2e40e8ff1cf7d9bc4dcde963a
MD5 0d40c81c991aa06b4efa82762955a5af
SHA1 6729d9b8d06e4416fa9303212d1624a8b847430c
SHA512 5f6650072f214ecc97f82348a1befd4b837504e47950a379dd225ad5a3faceeb3bf25e0fece05f435d1c802d51ebdd8eff26066d4a4733ed53d2bbea7e18bd1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 53d5db4390f0b1eed3af8f252fbdfc51fbc306398929f5e29cb10235a8c961d9
MD5 83f05f1210f2c4bccd5911ac9a47a4e4
SHA1 cecbea3222b980377db873dd707082a1195a145d
SHA512 26cea7eface463b838e53130b3da1d4b5d66192279a6871e5578e56ab09cd6c41bf66f47faef3935ec31df62c50752dc80cb54679649dfc43fb641a6173805c7
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBACCCCCBBBCCAABBAACBAACBACCBBABAAABCCABCCACABCBACCC.exe
Size 12.5MB
SHA256 4ebb16b55bedc1b73ed996c175a10381e6c403bccc89a75e9824bdcf4f1aba40
MD5 6b30e9ae3218a7e40ab30b0381bed949
SHA1 f4e14971d5277076f6090d9309ec69c93c1c8340
SHA512 3e4d3f5686f8167e066a88e5e273edf0794e6fcb311e8ed002960ec8fa2c31921aaafc3e699c5aaf3464406d1a3ee58f5a0e70c4543895edd11bd4346bb9f499
SSDEEP 49152:U+En+En+En+En+En+Ez+En+En+En+En+En+En+En+En+En+En+Ez+En+En+En+Ew:y1MbQ9yDAD7KjjqkusjmqMhO
TLSH
T17ED68D28FAE584F1F97B90744CABC27ADA717A214533479BDA99C60F6E337914C28331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cb88ea79440202cf5fcdd8c99d49e1c1b93df9f07d8ae475decd8ec1fbe9c091
MD5 bb7f221be1ff8dbec5c3ced5c468829c
SHA1 54d4fd7dc9fcfdbdf92131a60553a73505ff5749
SHA512 7912fbedfcd8131280de8d4bf3139e585b46d97d69314f7addac9f8b0bd98fba45d0cfe71c038a8346320c2393d46fef79af38e99b989778ff5a4c8ec715c31d
TLSH
T1A921F690F0B5C453E13164C7B636CB9B2DD83B4B68BCABA463158218A769C36CF154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 38030719731ad2f4e090ca206cf2ccab87b84af952fc715fb61ef351ae00a104
MD5 ca87f494f0ab6342a87b5a16438548bd
SHA1 5b06100d01841695e3905d660a8577041da047f7
SHA512 70c811ec1f10a6606087090a347fa46fcee3ae09791a44e20e95f023a487eadbf4ecfbe54b67dcb1b132868dd8a60e8784c7dcb42c53be0b08eaecf83124bf8b
TLSH
T1A521EAA0F065C863E13168C7B636DB972DE43B9F5CBC9B9453158308A7A9C36CE194F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 8f40400007511904512563dd230facdbc92d18544a6f42addd8a27b54d2dea7c
MD5 673644c441e8d889cb8ef375ea40b927
SHA1 9f49ce1ed0ad9ac172b4cf2c2f79ba88880027c4
SHA512 a85665433fc919446ded0dfac62521f05547d32cb02cd77fee20a9b7a613d19ef73c8e9b36199329e86363c261d3265caf163f8522244c1e796b2aa975acf181
TLSH
T1E8110491F075D453E03164C3A736CB8B2DD83B8B28BCABA4531582086755C36CF154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/992-74-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/992-115-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/992-10-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/992-50-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/992-23-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/1040-99-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1056-2565-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/1056-3045-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4784-77-0x0000000002C30000-0x0000000002C31000-memory.dmp

Download

memory/4940-73-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4940-49-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download

memory/4940-111-0x00000000009F0000-0x0000000000A11000-memory.dmp

Download