017b1e9d0a159de9bb1f70cb0227db22cf1716c4dfd3755db7c900b8177d69b2

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Size 16.8MB
Sample260818-c817rsvbmf
SHA256 017b1e9d0a159de9bb1f70cb0227db22cf1716c4dfd3755db7c900b8177d69b2
MD5 e5301a5df49bb3f05d4f39b904edac4a
SHA1 25523f5cc287ad2fda82daf901b2da4714217fbe
SHA512 50db8137c34f167eb3fc99c7d43a02b866aa2934f6a842c0efef78df7b05c4999e293839e9d88683ee7013370d6503ef0e9bf94a08b12daeb252045e7e6ac026
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+ED8obnyMWmddjZ7xlo5tb6LgA97HrsdochZVNhcOgs0F2oF:erU5pA91pH2WpjHrgBFFu416AWvN
TLSH
T10A07266561A760E8D06ED23989668331E6713C130231437FEA7CF61AAF7B6646D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
1536	svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
696	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCBABABBBAACCCBCCCBAACCBBCAABCABBCABAACBBBCBACAACAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe"	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBABCACCBBBBBCCAAACCACAABABABABBAAAABAACAAACBAACCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe"	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2544	sc.exe
2080	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe
5984	cmd.exe
4576	cmd.exe
6048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3512	schtasks.exe
3108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
1536	svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
1536	svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
696	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
696	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
Token: SeDebugPrivilege	1536	svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
Token: SeDebugPrivilege	696	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 6108	4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe	95
PID 6108 wrote to memory of 3512	6108	cmd.exe	97
PID 2872 wrote to memory of 1440	2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe	99
PID 4836 wrote to memory of 5984	4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe	103
PID 5984 wrote to memory of 2080	5984	cmd.exe	105
PID 4836 wrote to memory of 4576	4836	2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe	106
PID 4576 wrote to memory of 2544	4576	cmd.exe	108
PID 2872 wrote to memory of 6048	2872	svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe	111
PID 6048 wrote to memory of 3108	6048	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_e5301a5df49bb3f05d4f39b904edac4a_cobalt-strike_elex_glassworm_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCACCBCABBBCBCBCABCCCCCCBBABABBCBCCBCCBACABABBCBABBABCABAABBCBCABAACBCBAACCACAACBCBABBAABCBCBCACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACCACCBCABBBCBCBCABCCCCCCBBABABBCBCCBCCBACABABBCBABBABCABAABBCBCABAACBCBAACCACAACBCBABBAABCBCBCACCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe" start= auto displayName= "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe" start= auto displayName= "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBBABACBBAAAACAAAAAABBACBACCCCBCABACBBAABBACABBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCABCABACBABBACCBBBBACBCACACCCACBAABCBABABBABBBACBCBBBABCAACBBCACBABACCCBAAACABACBCCBCBCACBACACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACBCABCABACBABBACCBBBBACBCACACCCACBAABCBABABBABBBACBCBBBABCAACBBCACBABACCCBAAACABACBCCBCBCACBACACAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACACBACBABCCBCCCAACBBCBBABBBABCBACAACACCCBAACCAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fbb6886e7c54169a432a67e22821d4b00bc85b533aa3c80ff30f0e40dfb56c77
MD5 1cd131c77f68dd13478fa516074aae06
SHA1 e7425fdc94d6f049134e93cd3129c79fe52b0b0d
SHA512 6a493888652af4285e69df87a911877480f3f39028b3fdfb769f2d5885d8244579821d34e1a50266b846ab3bf626f45b9c5d191192072331f731ed114e6cf24a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 f4c4bfa67fd651079f67ff89136e5e3750ab9dccfc7e9982949f7d616968f768
MD5 e67cdeb5716eaa9f7ace3cb19874e441
SHA1 6b06f1e707509ed4ddf708e3638ccddfe85554cd
SHA512 6c3fe5a58740d8c65271ac5d1d0e6e03c1de7640cf5378f4249b700baf31fe8ccc87ffc413c60121751a06fb168bbc0561a6564965c079e1b63da9a7dc109333
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 cb6dec9f46b49b9a975345858c76e37cd793c6a67dad989941420fd62f5a719b
MD5 92bfcd630f9a141b531555ea234498b9
SHA1 438f1764b438e5a888da066cb1d6db7e8c033e77
SHA512 d007083a372899dca614d1bccdd413c7affda1bfb60b3666a37bffcefe4c38be62f8b7f5609ffb75b81dfd2dace8e2b44454023ca0d2cd505995fd073ecedcfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 6bab99178fcf7cb6404514374778d5a2cbb1b6c42ebeff2644bca43fd1b76e53
MD5 f14b2a00b692fa355428e14fa4ae3e87
SHA1 f29040a97ee1dd85ad42f726d3ce6b1c0254877c
SHA512 cb4d9bfe6dc56db579a8694a1a0f4ffa494f410776948a93f7ddabe379743f0abe0d3a83ee20354808f79a4eb21b54f9f84f510641c2746e162e47c60100c01e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 1f59420094d15ee90cf1e059a1f98374d04e6839086b82262cc57a7ba3f58dd4
MD5 a81218b25759f4b2c6c36afb7e3e2eee
SHA1 4a92c8057c235871c924efa441c0b6aa7cfb0328
SHA512 558f7ed194b9055299a10210583f6413b00f8069b6e4048820631ad86cbd741a15a86aabd978f6d87887cc4abe6c742c516b313539bc4944e2e0cb64c3ec315a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\uk\qap`g`v~dtlq
Size 10B
SHA256 c89c29debb503c4ff38f41b3dbfc80af8dafbc9f2547362a44ea9dc504469116
MD5 65f1e3f824389a9654884a406429eced
SHA1 f1c3af64abdbf5038735fbb958ee46b345fa3aea
SHA512 a028899b38678c3c410a1ce264de26474bcc855c1c76f2df91b33c0604b7aef287246bd49e1a5d9a55b9dbe9b6ab9a95f82aa33fb702aee85601c962c30281cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\qap`g`v~dtlq
Size 10B
SHA256 5d0434fa757f4cba0f2613a6efd22bd0cbadaf02313e34ed90bf45567224b81f
MD5 184f1b84b69f926da739fccba0e67dd8
SHA1 d2d5e309292972efcadfae58c63a22c4f044b9bc
SHA512 71f53d52c92eb1fa0aa9b267cb1463a8542f790ba9341c34d4685a3b96c3d7285a6222a1950623e70f79d62eae21037c92eb4e31ec920a532e6f7539c5ea1faa
MD5 SHA1 SHA512

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 50.7MB
SHA256 35acb1ed640f3bfe00596ef6091b91abe0240697911f6b9fd8b8ec3ed0472680
MD5 4e220f01af9ea2aaa4841da3cbe0e25c
SHA1 5e1f79e312c124f16be9659b1733f8bd684b197b
SHA512 caa13e2cdd759c651f6107ff2691114cf0c8129a14ee0eb10dc0d199ec3b53920dccec0b312886edbfc76847d5fe52d9332d07c70365c7e493bc4ee68a6bfc93
SSDEEP 393216:95pmHN6+Jrv75pmHN6+Jrv75pmHN6+Jrvj:958brT58brT58brb
TLSH
T123C7266561A760E8D06ED23989668331E6713C130231437FEA7CF61AAF7B6646D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 592838e201ec42d906e40eeab00c19ba3b72febb77ef79b2339763f55316d551
MD5 8f03ff53d103ff8dab21924fecba46d0
SHA1 3f37a8ef78a3629c92324ca9f75a8affbacd9be6
SHA512 f28bfa77721cab3d0fdc193ded6bf47ff89470034f6a150625d4bb52a7f38eda9d974128faf31e365cc5ab07867344c0269b305ff12ccae43bef8a4a1fc93259
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6645a317af6c54b5a48cd7d878a6a1d1bafc10cfe581f936839e0d3eea1bd484
MD5 6a5575560bf3cea9440131d6c5fab22c
SHA1 dc17fc2a5316130dd95e902e1a5d3c830f6119aa
SHA512 ec203f443c6a533ffda6bedd456138565bc612e876c349d6957d5f598db863758efb9a47043b924e0cfb16322ce0c7f783fd9816c3a12a60cc8a9f42446bcc24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 705e5ee16a9e137d253ca7180e2d72b841a08ba89a6dabd71a6fe1cc3925f372
MD5 ae2a667d9365ee6a16c9fcdf8f5f6f55
SHA1 bff9878ce8ebeb000a8ad12c9a747d0228dcbe82
SHA512 467afa3a4255bdeccaa8bd02206557ea1559c969b806f98d6a1cc04bfc6d8021f6360a26acc24d8dceaa2b7b74aec509fe468daaebea756e39d5a4ad44b5d3a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48d686a9ecb10a3e83593646f713e24964783aa7e5cb45b181c4c13e162f51a4
MD5 fd289a69261266456a3785256fc4fb31
SHA1 9e260bcd36df03e9eed9abe769075600cd829f38
SHA512 6bd8dcf3f6c05b30e5c59981e30a180ff7c38616c99f7bb5f0c02beed0b0f740376f979fba12c6c0ec3fc2112481d15921c77602e1d944a8f1cb0b7a273886bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2c2b70eda130804530ea52a8c1ac8c69611e33ec9b12d0ec00216c283d4e3f7
MD5 244b170d2e5768d2479e6e0f6c78f873
SHA1 3ef88582bb1b75633d4c510287ab4283212786b5
SHA512 487675514e11799d3a9111ee03d6b727bc380d4a3aacfd1360be0e9f24884260fe93573d3a3f3c7f858483608b1cd1d9a585bbfef480c9d9d6d9e643e88b8d88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0f26a3fbc1a0b374d8af447d35543782fcfef8449c44524345b9b28168cf91b
MD5 ee76bc30e9fbec4347a85d9a072bcea1
SHA1 3cc6f968082d447f3bd8fdb0a3eb5256e19c9ae1
SHA512 fb8eace70f333a685831699743e7c3cef5086d05ef6f723d27f851635cbd50cd67715ac109b47a1abab49daf3d5cd606f0750aacce3e293069c541b3cf5c28aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22c07567a1284c0e80d2952a427105f9f019d0985831d0c282d1e136dc114835
MD5 86cfbd401312a0d749749ff2123df2e8
SHA1 883078dd408fd2371d97b756615f04f34347b7fd
SHA512 e5ac4e685d587f98e1dde01664be2fcf5d778cefa2332e2a9604f84eff4612a3dbe7163f3866b4e0a6244339034fc5bb21b8989116b2e5d244b35d50b137c022
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e3b11260e31fc1bf356ba584792ac16a9851aafea0b26f886c182850bccc0d40
MD5 a5d607e2bc6c4ac0fd1d88b08960d210
SHA1 61813148038bd432bde67ed16efc3f56b317996b
SHA512 590a2f1421c9f9b2b80507c92bd03941a9d05f2022d00a83e46c354545a5aad59a67210d5120aeca35306a697e56e57f1a47d003eb3b162778a3b76b1dd876a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 40ff4b95d2f87f95c38ee6381558ea0b9eea0af8a218c79aa67a2001ffebdf38
MD5 2857d8ddad3564433f681f3a35455862
SHA1 2aecd04ee17c6fa99fd5714f5d04bab5cf32482b
SHA512 b0682037fc611c544f8e81640dcf20c367530cfb7c0c6d99091c486dcfa0d64491e4a93ff1eadfd9a3970c184cc2545a3fbbfa8cdf0a48a61118525eb4b85297
MD5 SHA1 SHA512

Submit Download

svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAAABBCCAAAABBABBAACABBACABBACACBBCBBBBBBBAABBAACABA.exe
Size 16.8MB
SHA256 017b1e9d0a159de9bb1f70cb0227db22cf1716c4dfd3755db7c900b8177d69b2
MD5 e5301a5df49bb3f05d4f39b904edac4a
SHA1 25523f5cc287ad2fda82daf901b2da4714217fbe
SHA512 50db8137c34f167eb3fc99c7d43a02b866aa2934f6a842c0efef78df7b05c4999e293839e9d88683ee7013370d6503ef0e9bf94a08b12daeb252045e7e6ac026
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+ED8obnyMWmddjZ7xlo5tb6LgA97HrsdochZVNhcOgs0F2oF:erU5pA91pH2WpjHrgBFFu416AWvN
TLSH
T10A07266561A760E8D06ED23989668331E6713C130231437FEA7CF61AAF7B6646D3C732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 754f93cd3dd6cf9f4b7e5df9f5e0c25cef5afc2b5eb3234dd1d806140e6e8aa4
MD5 44962f7021462c056763b470ccfa83dc
SHA1 5f3e75b6e4dd7e43c2972507a54da7e774d0f008
SHA512 57bf28c5902b9db36f0e4f68e508bb3a30893a858e4c993b16985272de05658988f70a69f12a4d94a2e1f743761efa196843f8dc9580377fffb63e78fe40c26b
TLSH
T13E21F952E4E7CC63AC3229CB9719AFC24DEC358B989C7A9053098118BFDD8318E1D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ec88f5f5b357396c921eaf8aa1657579a4dd44819038f152b0a746d2f909b5d0
MD5 2016a50d0471058a9dca231e6c4a6be0
SHA1 5adc039e95dd6901ebc00b2d8d1544a33a321525
SHA512 5085cd70e7c14ec9905f0f045d3d3d75b72b4b7ddf6bcc92671a1013bd43e1857e31b85a4b6d6a9fa910ca4c492e0c0a6d08c06ea0241c6b9cca021064ab0311
TLSH
T1D721E752E4E7CC63E83229CB9B19AFC24DAC369B9C9C7980530D8118BFDD8318E1D4E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fac666599cbcbba9a60b9a63b5761281d877465487ffe832b6e34551fbfc8150
MD5 5b4c7a82b86386b4e578794c45296e20
SHA1 30e9b59e95c2a1e34c96e4fe84d19f66817b93d8
SHA512 1a9fa73294bef9795906cb5130304026977754ce5d3a02c0725ab440f89758f974eabe682a10ea965c216c7ccb52a4a3561620c2cd8cf1b714ae7ec81d34e6ba
TLSH
T1FC11C851E4E7DC63EC3228DB9719AFC24DE8354B9C9C7A941309811CABD98318E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-111-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/1536-97-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/2872-105-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/2872-69-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/2872-47-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4836-10-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4836-104-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4836-68-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4836-46-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4836-21-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download