c1f19a306d1cf2867b0fd56f1d8a073cff713d165a345edc1e13d2e2eb84075d

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 20.9MB
Sample260810-b89cpsyfka
SHA256 c1f19a306d1cf2867b0fd56f1d8a073cff713d165a345edc1e13d2e2eb84075d
MD5 ddfbe7df73ef307d23b4d78a45bd43e5
SHA1 32916e287f5bc6f77f29aed71db2966dc72019d5
SHA512 625ff10d2683e5ea18dd06aaea082f66951689db63a061988da14ba1a716a529304817d11d0f50592f351e1e0aa6019cbab10952db236c97bc77a62d9f48fe91
SSDEEP 196608:vBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5cFIF0wua:A5T5T5T5T5T5T5+a
TLSH
T1AE276B10B7D18035F5B329728ABFD3795938B9614F3986CFA388162E5E306E0E935727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
956	svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
4712	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAABBBACCCCCBAAAABBCBABCBCBCABCCBCBBAAAAACCABBCBCACBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe"	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCACBCAABCBBABBBBBCBACCBAABCABBBABBAABABAABBABBBBBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe"	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4884	sc.exe
2456	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4876	cmd.exe
2692	cmd.exe
1184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
956	svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
956	svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
4712	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
4712	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
Token: SeDebugPrivilege	956	svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
Token: SeDebugPrivilege	4712	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2892	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4876	4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	103
PID 4876 wrote to memory of 3984	4876	cmd.exe	105
PID 4372 wrote to memory of 1700	4372	svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe	110
PID 1700 wrote to memory of 1032	1700	notepad.exe	111
PID 4308 wrote to memory of 2692	4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	115
PID 2692 wrote to memory of 4884	2692	cmd.exe	117
PID 4308 wrote to memory of 1184	4308	2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	118
PID 1184 wrote to memory of 2456	1184	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ddfbe7df73ef307d23b4d78a45bd43e5_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCBABBBBBBBCBBCABACAAABCABCACACCBABCBBAAACCBACACACAABCCCCBACBACACABCBCBBAACCACABBAACBABCBBBBCABBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCBABBBBBBBCBBCABACAAABCABCACACCBABCBBAAACCBACACACAABCCCCBACBACACABCBCBBAACCACABBAACBABCBBBBCABBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe" start= auto displayName= "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe" start= auto displayName= "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBBCCCCCBBCBCBBCABBAABBCAACCBABBABCBABCBACACAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBABACAABBBBCCACCBAAACCCBCBACCBACCAABABCAACBBBACCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 73a62cad7eb78a4e33a8e6a671a4fb936ef81d3e912a626727c9edfc0a8fa2f0
MD5 c5dab7fcddd827078c59cd9b68968c51
SHA1 8e4ac2e03865aa4f5562e8ad62b6147ab551f2d1
SHA512 17cc0b7c6cecf8eb912ec2f56d7b44a4011dd481e7ad95c9e15ad8d1f5ec6e65ee5ad4b72b99a5de02e97793019b8dfa29e546d011ce29fbb9474f150a1f8ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 3606ea2e44b9ceb03fb237157b8365074cb79efbfc16d2c82e7f9753454781ac
MD5 7719e3eb7787712bea2fd9b7b8f3e817
SHA1 a6e18515dc688d7605342a416fb47dca754cf967
SHA512 a572fb34323bdba2bb8a57c118e4412ef278f54f30c3c588e3af2c92838930033a6fec107dd0b5b8261e50ce5fdb237346fd7a4ffe95ef676cd248fbec2d3e7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b7446e0bb7bdf3fed2442e052ae2e5b443ec79b88705414af907409cc9b6e511
MD5 1e723b1864763af7b1aa60a5e338a7f7
SHA1 c4cc517cb0c626343d397d137db6e2e46703f1bf
SHA512 131d8abfb941d6f2b02b193bd7b161e3ddc75f5bdc5a481fabc4347a3b6d6a11aedf1e673ecdff2d4823075c834fe35b983fc8971c2a2fecefb46226b7579b98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\USOShared\Logs\User\qap`g`v~dtlq
Size 10B
SHA256 a4bc3a1260544e0911d444a3a79ed4c1bb4692e9762c419dd1ae2d093b217cb0
MD5 8e49de480bc25fba8aaca1b29b6c8845
SHA1 9b5519305014719aab5fc39804e64c36f5776d0b
SHA512 5dcf678a054edca3eba32e56045e6c795c85e84e37521f789193e226b8655936b4fed8d8669fe689fa62eb45b30de44d6a8608c37d88f27d9e1513b9978f8408
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\qap`g`v~dtlq
Size 10B
SHA256 b900d96ea35acd9dceaae8bab454ddc2bf92bb1587bff511f2070127e40b50a3
MD5 610e1c43170f492ac3d87b54a54fbf23
SHA1 6c9de1a2fc2430039a61c9631d6b3939a6651e31
SHA512 0b31137a5b54d6709e8cbdb469baabed163c83055456f73d08b0c93fcb2d8cce9b18dc460cd5bf1143988cfeccf0e2673d6a637a567b4376bbad7156fb0ee309
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 3ec6325981f1822978849a208499d0fda20e3b83ea4cbd5d86169df1e520d6da
MD5 9d7f813947b0f9aec5bdabe6badd0866
SHA1 720fcdd2a7927cbd9994edaf7896de4e052d1f4c
SHA512 ee4504faf8e613ad4af7ea4eea2b34a5da32018f92adc70a67d5650bc0130f428a869a5f7bcb915c3eb81d55c8da22a41735079fce72ad43b74f64fd1d97d9fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 acf68ddea13e51fb51590349e14ef110db05d5909c0b9659c1f6b0c6d7b0df16
MD5 a755e39a9e8602e9506dd626830f475d
SHA1 10feed03b94aaefa1cf74075792ee4148b681754
SHA512 b164f907e910cc3f86096932a95a5cca778e9ae5ea28cfb5c5c8a4c2e70ecdeb8d6e2f101767c46e8b561e9f907260cf8fe2ab6b430c860bf528aec91e691047
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be97ec9d1a90c68552cd6f2b80b385756f874463df45351123448f07849a5436
MD5 0744003c46014d4dd907abb1d8313335
SHA1 561577eb29292b0b6af8984eeb52c700c93e50cb
SHA512 60fc5f3cee63a74538d7a57eab9427aa4124d7b6b0615da07a5167e2f5cb7b6e4f609a61d527e01d22363448893b81d3ff73bd9f9c63779b12b463aef1ccb7e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3001219e38a57a821e60262ea79d1b2d13491aae27baba7ee237f8fc1c8c1466
MD5 09648318483013bf923109f98b17bc2e
SHA1 82e602ef46b7874c69db130b3c23af7155a0af83
SHA512 7d50d4908442dfe1b331927b18350546c2fbe7e764903dab5fd4e60a84cf68e5622b26b3b8b795259e81c91b44ca18c121dbe2e6d2f0c30dab1d767898dce829
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0cc70a7636cea5e24470a6692a1f4f172c987484df6c22aab2abbee94494a1ee
MD5 0586d7f148dfa3875567fbb656eadb0b
SHA1 3d678b38d63e6c6c7f70c157baeac50bb42ea17a
SHA512 e5c589dae68715c71f728872d665f7a0559b485dbc1bec429b86bb50cd3af772fb7eaa77e914c601f8a0d5bd5ad2da719de22b2334309825b172588a29223315
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c0f158fd8562825b19cfb6e5b0ae6b3a89c8f003bf0408a8218cee6022d4c582
MD5 6009781518692ecf8a5b5fb8a1f1b8b8
SHA1 4e4063152830876542ecca8551a0c7a13c8a42c8
SHA512 d5f31be79f082e9fa5d8cad0de7eef1dd0b7dc9e46c42529a938fca5f69f481f86ad2ab203ddedd9672fb92867e7edd8e59a327603e0583408331e2ab17c8334
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b58c1ea8eec70f04b88268423062eb7dbaa414d0b22d96e39b5f298812f0ed1
MD5 e4f423fd3e56668e8ea9ca1224f2e9ee
SHA1 00457d090c75f18c5dacbe4d3038dfa9956f9acf
SHA512 4e59fdea4d555dee2304523815f9a5f5aa3e2a6568c02a116f8351442e384007de6bdceb52961fa980c652569d0c9d936a65b0a0c022d0c27eaff8fdb83729f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a06fe826733f2e414a2017bc0e7c32acb5e9215183dff3f583134ecf2beb25f
MD5 50c0b9310b78b23bf1a9833123a5196f
SHA1 2f0bd52c9aae2ead531e4d30f90dab0961dba92f
SHA512 0d31f89df66ede24da0bc18533d9e7023a3d93c1fcef2a78072863ff8d9b0e0e86a50b1ddc6408b9e92955b17f2bb6e0ec46a8cd8fed2ecac9642aa65bab8a32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Videos\qap`g`v~dtlq
Size 10B
SHA256 90136a8e692961704293c38e575f4dadf0ecf2517c65eda2c950b5f2c5c1f606
MD5 03473eb2473bfd7e6fad3e6cb0b7a04d
SHA1 a0418574861d7f7ec32aa8f997a0071233a2256c
SHA512 84afab1d78c6b1da67e1bb0e0306444c8673ed2bb4b9c887de43f20ca2aa815c4337c685a9fbfa1e2a080c1c3e6519aa1394098dc253794407392114814b5863
MD5 SHA1 SHA512

Submit Download

svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBAAABABBBABBBCACACCACCBAABCABCBBBAACAAABBBACBCBAAA.exe
Size 20.9MB
SHA256 c1f19a306d1cf2867b0fd56f1d8a073cff713d165a345edc1e13d2e2eb84075d
MD5 ddfbe7df73ef307d23b4d78a45bd43e5
SHA1 32916e287f5bc6f77f29aed71db2966dc72019d5
SHA512 625ff10d2683e5ea18dd06aaea082f66951689db63a061988da14ba1a716a529304817d11d0f50592f351e1e0aa6019cbab10952db236c97bc77a62d9f48fe91
SSDEEP 196608:vBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5QBBBBo5cFIF0wua:A5T5T5T5T5T5T5+a
TLSH
T1AE276B10B7D18035F5B329728ABFD3795938B9614F3986CFA388162E5E306E0E935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b1f9f3df5ae00dd1957e0e15bd13f74a6445b734cbfd6be5799923eed849c3ba
MD5 28cb01ca6e6da043142d798fabd00a91
SHA1 a2d0d958a326948028f7228042d80cd6c7a332b9
SHA512 3ca1eeb7266a21674f2d72592448619fe05986cf1797d3b5299f71b427bee2dba73da72c7b006cb789dcd986684f6b9589db7274c7af84ea855cf02c3aeb03c6
TLSH
T17821F954D4E9E493E932298B92199A924CB5754FBC986A04238D831C7BFDC30CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 240d7566c52e2ecde98cbfc532ec601432f59332627ee89f581b019997777be0
MD5 92cfa9b62965fe2d3c9dc42840667f0b
SHA1 c6842778ccbb2c415015e13a657e9c871c5d4982
SHA512 a84fb75be7291acb8bc7e38fe2514749b974bfe6dd000398715bafda89a15426e2d2d3a609e696d6c428ec170ee737decf031a817b2748c0ecfa970f1b14355b
TLSH
T10A11E764D4F9E497F932298B921DAA924CE5768FBC986E04238D831C7BF9C30CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-108-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/1700-78-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/4308-74-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4308-115-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4308-24-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4308-10-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4308-50-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4372-116-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4372-51-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4372-75-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4372-31-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4712-117-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download