c79fdf4311b1d4304eb296f757ce00d183cf30fad16dc844f2c7c2e5230e44a5

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
Size 3.0MB
Sample260819-nz8e9sam31
SHA256 c79fdf4311b1d4304eb296f757ce00d183cf30fad16dc844f2c7c2e5230e44a5
MD5 2e619da8fa1701c21e95a6b5d2b32ed6
SHA1 4e7b657c5030d5c7a8fbae518d554e675cb0791d
SHA512 f9710a61892cec5abe49f3fb48ef6c9eb3e2d5212103f1a57d05db016c649ee800404da17d0193501217b296fbdd0554627054435ea9caa0952442a4d3a88402
SSDEEP 49152:U+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5d:Slblblbd
TLSH
T18FE56C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
1428	svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
1316	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABACCCBBABBCCACCBCCCCABACBBACBABABBACCAAACCCCCABBBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe"	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABACABBCBCCAACABBACCCACBCBBACCACAABABCACBCCCBAABCBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe"	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1588	sc.exe
3268	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5908	cmd.exe
3468	cmd.exe
908	cmd.exe
5892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1488	schtasks.exe
5648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
1428	svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
1428	svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
1316	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
1316	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
Token: SeDebugPrivilege	1428	svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
Token: SeDebugPrivilege	1316	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 908	2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe	95
PID 908 wrote to memory of 1488	908	cmd.exe	97
PID 4960 wrote to memory of 1752	4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe	99
PID 2004 wrote to memory of 5892	2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe	103
PID 5892 wrote to memory of 1588	5892	cmd.exe	105
PID 2004 wrote to memory of 5908	2004	2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe	106
PID 5908 wrote to memory of 3268	5908	cmd.exe	108
PID 4960 wrote to memory of 3468	4960	svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe	111
PID 3468 wrote to memory of 5648	3468	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2e619da8fa1701c21e95a6b5d2b32ed6_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBCBABBBACAABAACACBAAACCABCCBABCBCCABBACBBBBAAABCBBACACCABCAACCBCAAABBABBCABCAAACBCABBCCBCBACAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBCBABBBACAABAACACBAAACCABCCBABCBCCABBACBBBBAAABCBBACACCABCAACCBCAAABBABBCABCAAACBCABBCCBCBACAABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe" start= auto displayName= "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe" start= auto displayName= "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAACCBBAABCAABABACACBAAABABBBABCBBABCACACBBABBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACACCBAACCAABBCBACCBCBBABBABBCACBBACCCCBBCACCCABCCBBCCBCBCBACAAAAAACCBBBCBBCCABBBABACAABBCAAAAAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACACCBAACCAABBCBACCBCBBABBABBCACBBACCCCBBCACCCABCCBBCCBCBCBACAAAAAACCBBBCBBCCABBBABACAABBCAAAAAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCABCCABAACABCBBBACCBBBCCCACABBAACCBCCACACAABCABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5eaa11133cec3f225ea6472d857393cdb76f75e88e624212e759855120b93f48
MD5 a819aa02a31a3a2d3095b8a493e2f12b
SHA1 5b4ac0fd26cf87a12d84c7ac77ec7be6c2d7ce8e
SHA512 dc9ad30179766a2b6141c9fb0e5698584bb9d47502ffed90e6e5539f6828ed61606e7507ceaba81328adb9db69c0b7081ab5019ff2ad5e57b1b2494c82802788
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 ccc7f776b51968d0338b50966f71b5adaa200ded7a31ee313dc998e3405b341c
MD5 23e86c61f6afbe04eb2ec763e3a7cdd9
SHA1 aa2c009baee104c3fca2b3616896168dff74f47c
SHA512 60d207d06eafe8105e1ac3e8b729f0dd2db5e9d1efaaf5a81d813dfe01ac67b29839b3b5d030a637fa9cb1039d1be58ed15c50d8c2b004a47efd7cc8ffc576e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 cb96e5d8a5cce07dae6ab4b24cd6308b68c7320d7ecf958435c4cf7508c71b3a
MD5 05e3c3c26468291d7d4175d27a4272b8
SHA1 0a773e66035a08174c06881b16055660eda59705
SHA512 6bd82f6b188a933eacc7b92d73d08db6ce7c64486d9f27a43df5c9fb3d5e65dfdf2ddfba865557b5386228808c4e987ce65658ce1e2295bdabeb3df926603425
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 f212164d0a5a5b4473d26e078576f8ae7b0346d907828c0443332c437667aad5
MD5 33c7963fa82a9ce4a60913f330a6f17a
SHA1 9045158e98e3828caf08b35417564b88998d2d2b
SHA512 eb62e5ace0b570f3ed26b468de0cd45194c26c67e3061c9811db07670b4bbe7c6ca8fed0e250a3750d5c2dd3c36fd436a742ba9e46de2eacc8ef163dd98c15b5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b8306778f4dfcc10d282bec142b949de392f1182fe7ce01b6bfa5080c9178494
MD5 d82a97484b2f6d9df7b846d24ef9fcb7
SHA1 b48ec49c99f5f31eed9b7fc748b0c8c3e0cdfe10
SHA512 2cc4503222340307ad15405d3639566e0c4feac64b4f6144f390062b7665a8a0b099398ab92b1b7576d232019be3d9a1e253415eb7766e53d4b45d1535737533
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 f86322613a869b4acf37c9f859ff837f499ca20a607043736dcf8df53efcf47f
MD5 d947d8277755a52b0625cced322d841b
SHA1 fc5b0bf54f0e62c33fbba9585819e41680963996
SHA512 e40e13dca55fabc0be0464ab3fb5a7905082c64581ebe7eee85ed1fe3f9eddc04a2cc5cae91679fb78d5692024b5fa3ef787200c3ee373cb9fe24fa104022460
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\TempState\qap`g`v~dtlq
Size 10B
SHA256 54988d39a6a420e2fc5c02c47796e2bf87370333a140b5bf5f4b495c432b7c0b
MD5 408d0d3c6af15ae8b0700c7fbeda71b0
SHA1 ea0a600801515a7f0cb73b96309923b83b450dc1
SHA512 851cbd12bc2c4c9bf50a14535a5b3577a3d2b7ae3f4a72d16b12abf3b6529f0bb5dbb0004d0e825e38a813e69c6edfd5b68167027b0a70d0e7bd712d99492306
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\qap`g`v~dtlq
Size 10B
SHA256 04a91d53eb953df79c2d59d745cff935fa05c696fbc032a0a6a624a6902edc9f
MD5 a683e09d7a67aa82d4e41ad2f10933f0
SHA1 4efb1231a84bb872b9f5f0a960bbf760acdb3f58
SHA512 157d108f0ab101883867e8489ff4e2be133471a0ea3ac58037556fd908bcfb1c03a9e798b8313918b95b9d47794e137fab2943d6dd4bbff2a2e498632e1b94f6
MD5 SHA1 SHA512

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 9.3MB
SHA256 5b3fad0c32206580ba054284d456f52ec37fcfa84a3f62b982a8919c2ce19eef
MD5 645aa3616440933b4ee12e4fe95b3eba
SHA1 5f5a6e3bba6098376b9e28fe0ad828d727d271b2
SHA512 0dfbdf8cf37166281690d6f429f7f75bea48390066f98336f697f46aee9c26f65778967c2eb9ecc4501e4e6a76da1159d30a8164b20fc123c97ec20f8d58a4a3
SSDEEP 49152:U+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5y+u:SlblblbIlblblbIlblblbdAl
TLSH
T131A67D45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 42.6MB
SHA256 57e79851077de8f40ba85ea7d84f79a1f41611f40f59c5cc8d2f58a0160093b4
MD5 dcc9e779688c8520fb5c46322055e375
SHA1 a866bf21311a6d9e6f13e1a83166fcb549905f5c
SHA512 cba20afde029dbe239fb858dcc9ef0781d2ab8fc996fbb049f7db52f326ed2d6b932d2d78f91ecdb8a4acb5bfdb3dc3c9fd9f38e926a3bfd2e0fb3c4865ff9b7
SSDEEP 196608:SRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRdf:f
TLSH
T1A4A76C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 384KB
SHA256 8d6f8e75d07b484e1d0ec4ad1593fb0d8a01a5d2df9061396b71a304e64d1f03
MD5 f32a48e713ad183ab0d37c443a95463c
SHA1 e7979799a4466cb4e1d6578fac6fdc14a230d9a1
SHA512 acfb16c4e63c3fa78ee4424986e09f95e3033a557d0d866eae4f7611d47bef3f69e3d7acd00e8b27f79379df121d67ca1d6e99d34fe704fa9ff7d4005dcc5f0a
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTgONMIRIwo1igg1NBice1sTAQOehTlO+8RTZWV:mgUFgEsnojA9ggONrCB1igsNBfcsc+ZY
TLSH
T13584AE09F1A214F5D96B80708A8FD17AD7B2BA521910CF5FE3A887176F23B61BD2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 18.4MB
SHA256 3cc6adf93b051029d032d0c962bbd7333728d15406c32085602d73989d22ce91
MD5 8822eeecd3a7ff73ff715f3887cd8851
SHA1 72759fbc626f91021a6c7ee919ed18c0e2a5de7c
SHA512 648a60e8d7313d451741a941f38ba4b8a9a83da326aea842e9fa0149d3e86ebf489828ac7d9ac4bc1f798111c910a36b0c0118fe5d7fe970558f98ca7b29fd90
SSDEEP 98304:SlblblbIlblblbIlblblbIlblblbIlblblbIlblblbdAv:SRRRIRRRIRRRIRRRIRRRIRRRdA
TLSH
T15E176C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 128KB
SHA256 a163124a7111cbd3be6a9a81ad9466380b0d90937466834f63e9e082d349c1fe
MD5 b9af2691779a1d07a4da8b5308d71917
SHA1 d03475623e348ed1b0c3094006e597f242650f46
SHA512 dfd6eeda9c04a771f6cec77fa23e81408d27ba9265d174dfba578bba1f2624057aefa5ca060b49f99f5357bd4c5b57603bacf56975097ed7334a0c55f4c860c9
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLy:m+dTTUFgEs3XojAdP+dTT+
TLSH
T11ED31A09F94340B1DD2B50F04DCFE3BF8A60BB21C6124DFBFB4D8A5BA522FA16528655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 24.4MB
SHA256 36528d70dc8d1d79212dfd7738e78914970e38efeeaaadd2f3514ef1a624a8e8
MD5 327b81a6301f776fd95257ca8d8109de
SHA1 693f8741a7e4cbf76a0787da24e790b63d4f7fe9
SHA512 2452b62d2211a02d620e71644d2fd0ffecd44afa9643c1fba74657ff878f2e2af5d3c6706333147a08e6ee4ad1de4090e206ec51315368760e63810ed9754733
SSDEEP 196608:SRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRdV:B
TLSH
T1C5476C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 512KB
SHA256 83f3ba8dfef30fc685fa4467c33fe62db868a6c2a6054542bedf134eb038d691
MD5 1798fb756b797a80bda7de36fa1f71df
SHA1 efb6d10215cd80f1d3b9cff16653d12ef0a0fee8
SHA512 96c114f705ba07bcfa4ddfc64a2cb9a3a941044ff89bcce6bfefdc86b395d2b3e74c7fd695f00bbb73e5564f768a79bb5894347c0ed91e13e0a0455228430e75
SSDEEP 12288:mgUFgEsnojA9ggONrCB1igsNBfcsc+ZOnZxRgUFgEsnojA9G:m9+EM0qNslZOZD9+EM0qG
TLSH
T1FCB48D09F59218F5D96B40B0498BD27ECB71BE224611CFAFE39887176F23B61AD2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 36.5MB
SHA256 1a25afa608c7010d22a45986fc2791351c950379f04d1e8ca54afa77c3b9a3c6
MD5 ff48721b0466cf143f7a9f5228d695c2
SHA1 b54223ac40c11c56d3c9e235cefdbf8722266d02
SHA512 07c8f58cf579a1ab3488ef7198f4fc496f3b6d16eea13ee5568a65f8997d6c8f3088e690c36a8fb38d52c81eadf36b0b247e3d60cf6c19a78869f1bead14afa8
SSDEEP 196608:SRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRIRRRdL:3
TLSH
T141876C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1636cc5146ff998816b2d03ef0d62cc8a0a9cf0440e59bdb11b162d926130947
MD5 403e0cd16eed98d27827cd5d197a1feb
SHA1 7c3948a82fdb37a08ff58d1a92689500f3de0813
SHA512 63edfd9b733b8bbd84ad08c27adee798d3c6e23577909653a94e43b3eda2599c286f12f9f9d0da6618478b08b57f39da761e461045befb91b4566b6c59344b18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32f4a8e4c1fa71842a1bdcc7825ce54aa2ac92a87fa1a7114063f73b37012867
MD5 b8e06ff75597e018c614ce2c857722eb
SHA1 7df14907327001991eb5b1db34b42a827c38ec46
SHA512 fa330ae81c785edbf77e0cb3f8c864697a47ce1b2c8fef680328809136a64887c664ae8911d3a2e04d6080167cef4c91973b3e60326e3c0567e1dbdd1b295ebc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7ac83572f2ceb9f3ed876d29b2cd91a00ba50db25f2adaddb175d0b8e10c7b2
MD5 5c49c0f14b271a73e58602c0e1608a10
SHA1 3c375bfb36fe14d58b73e91dae13e0243bf80dc0
SHA512 91de5872b6827056a69e205b272bd8062d407f69c19aa771ebc14ba234ce1dbd32428f5c412e11777dfb1d4dbd7ed72bd18ce7ff5f7f1bc07709b48ca9d5d350
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 dcb49497be2556730decd86040a6ea7d9fe1766eb75cdf172d2541ec3e4f0b5a
MD5 999abe83fd7f05e5975796e53dcbe502
SHA1 baecceb2213efc9f32d1cbdf1a9c2c59839c3a23
SHA512 a3fbf7eed3349f9980c3a35b531fdeba500a009c20cb2b94172cb5aac36e7efe16245a249e381f858d832e6aee8f758ad0d9fa4f3aed01b9ad4ddf0f5fe10b0c
MD5 SHA1 SHA512

Submit Download

svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCBCCABBCCBCCCCCACCABBACCCCCBBBACAABABBBAABACAAACC.exe
Size 3.0MB
SHA256 c79fdf4311b1d4304eb296f757ce00d183cf30fad16dc844f2c7c2e5230e44a5
MD5 2e619da8fa1701c21e95a6b5d2b32ed6
SHA1 4e7b657c5030d5c7a8fbae518d554e675cb0791d
SHA512 f9710a61892cec5abe49f3fb48ef6c9eb3e2d5212103f1a57d05db016c649ee800404da17d0193501217b296fbdd0554627054435ea9caa0952442a4d3a88402
SSDEEP 49152:U+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5w+ES+E7+EBqatglK+E5d:Slblblbd
TLSH
T18FE56C45F98284F2D81B0171488BD2BBDB71B9124F119B9FE398836F6F337D0AA29754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3b9f49762b33bdf9f89a6158dfe471e836ccde885f4acc25fc7e51cc26c07f02
MD5 ddfff7ee1c4a77ae3ea4120e0173c855
SHA1 251560e9595d1a3f5d562bc4b74efcf510543abf
SHA512 f58d0eafc5e2437d395d609690af5df051b4687ee6cadc23754bf8fe26c4a4c6aee506f7863a9273e553e2e39f10a384c0692dd53181bf2ea4bc01aad156d527
TLSH
T16321DBA2E4A5CC1BFC6228CFA67DEB96CCA437ABDC9C6A5D2308411C7B59C21CD150D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7ecb8cbb04b855a21d8430edba262b466d8343f05825d466c32e793665aecca8
MD5 e495efa9686bbc9c449f6e9431e62f02
SHA1 8d5340805034f7c6bff583e38354409ab63fbdfe
SHA512 74b9ef056fa877ce7b6a95e7c550d313b5faff4bcbf99e4ca6dea2adc5f637ae925da128ea9acb0ea4e3efb7f6b2aca9281a104a2795913f00d7a1871ccbd174
TLSH
T18421A8A2E4A5CC17FD6368CFA63DEBD2CCA437AB9C9C5A496308411C7B99C22CD154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 bb3cb75fde88f3a06f12ef67ca2c3f03c31a45c3f2cff7cfd54583c5c6871d41
MD5 f875ac3c2c78cad6a70435064f152a31
SHA1 a54ef27c99e3ddb6362c34d2a683c4a46e0a03e7
SHA512 dfb03643e55b07d848cc6a2a534c945a8d04d0dd41c953d286689dfad2e738df343c88e2441c91b74d7d0a71435d62fb0342ab1f7670df9a6895150dce7d324e
TLSH
T17C11CA92E4A5DC17FC6228CF967DEB46CCE437AB9C9C6A5D2308411D7759C31CD110E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1316-2420-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/1428-105-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/2004-68-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/2004-46-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/2004-21-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/2004-103-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/2004-10-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/4960-69-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4960-47-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4960-104-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download