6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 16.3MB
Sample260813-ebrm6sap4w
SHA256 6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f
MD5 b7fb0831d0db3f67d0bab5c3e26dd0ea
SHA1 fd50b0d330fc7ac36f92ecab5572f29ae7eb9a77
SHA512 4cf19a8321c00b5c2a792b9e03671a65f93d97c279b00ec222b4fd8f1648fcf95bbfb28f40f83b5077cba3a2d16fd5fadb001ba15591727bf81b04820343f64b
SSDEEP 49152:U+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EPL+E2+ES+E0:nOU/jIEeQfoR/IuOFVjUu5P
TLSH
T134075C05F98740B1E87B11B04DDBD2BF8A30BB2587128DFBF64DC71B6932B919934626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
2112	svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe
3732	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACACBCCBBAACCAAACACACAAABCABACABBABCCAACAABCCBCCBCCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe"	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCACAAACBACBBCBACCBBABCACBCBAAACABCCCBACCCAACBBAABBCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe"	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
824	sc.exe
2492	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe
332	cmd.exe
4968	cmd.exe
2276	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4996	schtasks.exe
4528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
3732	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
3732	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
2112	svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe
2112	svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
Token: SeDebugPrivilege	3732	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
Token: SeDebugPrivilege	2112	svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1444	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2276	3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	99
PID 2276 wrote to memory of 4528	2276	cmd.exe	101
PID 2272 wrote to memory of 4952	2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe	103
PID 4952 wrote to memory of 4868	4952	notepad.exe	104
PID 3320 wrote to memory of 4392	3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	108
PID 4392 wrote to memory of 2492	4392	cmd.exe	110
PID 3320 wrote to memory of 332	3320	2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	111
PID 332 wrote to memory of 824	332	cmd.exe	113
PID 2272 wrote to memory of 4968	2272	svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe	116
PID 4968 wrote to memory of 4996	4968	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_b7fb0831d0db3f67d0bab5c3e26dd0ea_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABABABAABCCAAAABCBAAAAABBBBBABAAABCACCBABBCACCBCACACAABACCCCCBBCCCCBCACACBACBCCBABABCABCABBACBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABABABAABCCAAAABCBAAAAABBBBBABAAABCACCBABBCACCBCACACAABACCCCCBBCCCCBCACACBACBCCBABABCABCABBACBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe" start= auto displayName= "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe" start= auto displayName= "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBABCBCBBCBAACBCBCAAABCAABAABBCABBBBABBBBCCBCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACBBBCBABCCCAABBBCBCAACBBCACABCCCACABBAAABCBAABABBCBABBACCAABACBCCBCBABCBCAACBAACABAACABCCAAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCACBBBCBABCCCAABBBCBCAACBBCACABCCCACABBAAABCBAABABBCBABBACCAABACBCCBCBABCBCAACBAACABAACABCCAAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAAAACCACABBCACBCCCCABCABAAABCCBACBCBCCBAABAABAACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f6a052bbde23f534a2eeb7a151b28e381d93db16d892d747d11fc4675f4a8bbe
MD5 1d25aaf156afb32d1f88cdada0fca4ef
SHA1 799c1e0d04a14bf6d397e7bc3b98afbdfdff3d9c
SHA512 6b6c2acc302fc846396aa6fefd1640df317dcb89329c17b955dfe247bd52790e66bdd680658146edc85b2cb7d239cb9816f4da90fbde42985d0fb3790f935500
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.8MB
SHA256 c0126419e9b214c265011e763d3e846db1cc21ba17a085fb73ad0ed87e79e359
MD5 cf9146c235ef4cb7222166c1866a4ee4
SHA1 e2b6e2a2bdacf8cfa40abd85761940c879e5e84e
SHA512 4eb03724cc229da6acb59359629389666e0b1ea9e6584fe9c676c98e5392a4a5c17957e474aea57566d11bdded9c7ab710ac00d74121fc7c623b4f4d585a357b
SSDEEP 49152:U+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EPL+E2+ES+EI:nOU/jIEeQfoR/IuOFVjUu5UpiB
TLSH
T14A074B05F98740B1E87B11B04DDBD2BF8A30BA2587128DFBF64DC71B6932B919934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 f69817f3b4f70cc325bcec6eff392b961905065f0dadd7982429bf5d33a16c02
MD5 aa2199608099f0d73a624c4dd0827e95
SHA1 ca9bc60fed126f5c55c4a4ac1c92927e5198fc29
SHA512 7e882f7e94ce7b2addd5f3a06499ba1048085666814ac1b2cbd6bb478ff0bfa5fa490ece27f640947e45e470dce1fa14e5df62f595f224e76dbffa474945466d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\qap`g`v~dtlq
Size 10B
SHA256 651675b347faea4d319282c902973b399bc054efbb5b9f4239e8c940131c51cd
MD5 4a680c6d0e590581270ea502e9650d96
SHA1 2a361c6a87faa6c393683bebf9bb7b4956bbbd64
SHA512 50a894c90c1142a617979527640fc0dc5f000f254d77e20c4de752d765cecb433fcfec104ecef61d4c8f53d752303246dc94bfc02974810cfe4d6387cd64772d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 2bea2452b8050ad145f0efd64dee44fb3ffac82dad9ebe5b852fb77a316efbea
MD5 a3844beb3a08358a7ac48089f9f9a986
SHA1 a7cd5a9021f340ba37e6a6b9a5e809e39a7ee6e7
SHA512 c84418434ee97130e775a38b011cd4b714dbaa0c26eb1fc562cbee3affb64df6955eeb27bc122f56a89477c51a74bbf951a362f6b7a391926f35f3fb7b49b6ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 5b3bfb50e89ff86408c9e8c98af5bfb0ee2d69d0b12946d3478b11f963fda338
MD5 4aa8c33a194db12b2811bf940f0c8c60
SHA1 3bc7f377614bf4b5be845bdda2a74ecb3466cf66
SHA512 c0d5cb29fbcff30fdb6a136645455ce7aa35811ba2c99b7d796e60df20b068357e8789ca9fed909a1f32aecd49de4a42e4c9dee4052efb97cae6d9658a456a66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a6b0196d9763820514d54c55788e82bae14903cc281818c25543b9a87f12d18a
MD5 0c6407ed0e2045f5534fcb2851679647
SHA1 2157197a6cdafd5cb4cbaa263b290671f2c7f6f7
SHA512 4d031ef08618f195e8c20f1be51a807f348819ed9ae5439fda727adbe480ac25752899cef7ae131ad4045ec0715a4bb17f2c39c25ed40d31def21d188803988f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AppData\qap`g`v~dtlq
Size 10B
SHA256 f339ebce42b312f711f2228824ca469e893ba2e8842a25e57a5b1bc373db1982
MD5 4c4296f7e483db32a52966f4194dfba1
SHA1 566e38aab1929b947d8b15d9d5dd8a8199c7d1c4
SHA512 79470970daae0a43fdd5b6c214ccb31aef138842000e177695a288f22635b39835b5d84eb038dd87f7a83d796ddd88a23e160b63d6c4d21c0cadf946f424ea39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a0569e54600dfdeed1403c35e0310f5b8327e61f7d10b9c35cc3e3659a962cb
MD5 798fdf3adf26eacfd3db3a5e7a21df85
SHA1 b219718514af1fcc7302a38720b7df124c977218
SHA512 ff7d6e973d493c190db06a1a087b59b788a333f1a3a48c6329417c1ee3edb8a386f2662f10ec53cc4ac0940581aee38464b913576d3a95d794b64d986cd7c897
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 077bb686dfc86b1608d557a091c54f69879a6a2957f57eb5e6b6661ea32f49da
MD5 f37196b15278611d75cf5035d657bf5e
SHA1 c1abb6afcadaf1b6fdc192e34803ff442b760ca2
SHA512 9517f00e8c6972a834c10c5776f40d4ebd965be494e61b5fc261da313610b57b23deb05ac381e28bb98e9248c91baa5eecaa99f7080da16b495beda907d2ce74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d88d04ab73d9b1a21fd102a717e5882f38fc803c0bebef82129ebc8312d1a4f9
MD5 404c78c94f0cb678df3ff6065d5ae849
SHA1 c89f93eec238f1f4627f3584b92f3aa188d22916
SHA512 337dc68855c9128bebd75e2962049cd7cf8d9475d82a0cb0cbc8c168695c1868ba626563e44b0e77d1f267e038631f64f7d0e37b624380b4dafdc5a1cc4081b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c7afc446880492bccdc41e0aa3ea7b5250dc11f730c4a665abe6539b530d46ab
MD5 4eabd0e6db6e0bd82dbaff1354a52c69
SHA1 36e9966457178ae63a8a8252238894cd2039c33d
SHA512 43d23a92212355caeb3623b7c3f2e6089b70bad2f59aaa32f11b023cdac15e1df342a5cbdb5a35bd918ec5b112b79fd6d7455e4377511b5b4a6d2d853c4cf08f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 26b991661651a0691ce09d3a277bdf8fa4ca94179477cc9ab0c8f357fa77a70b
MD5 6bf56f1d79bd235e347891c6742a14b3
SHA1 380e45af6bd2a1bd25f98df11bdfe1e75703826d
SHA512 63045bceebe2aedd3325633d4ecfce80e1a6e6641b259c9e52d94e03bbc722e9da57ccd35b273125166d45fba248c28d5401013876a13659cc121e788abea802
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 adcba968455c3182f4122b17d2f3fb9512162c9b9c411397bbd9c9e3d9559fde
MD5 1cbf6f832efed0f658394728bde5b487
SHA1 ecdfd29ca79529e871ae145d9e1a40fa05460889
SHA512 64a39df6109acbef1ec052c38088e445bf9076ee6e9b6e7849ea81d8305a5a01bf20a908508208a79ebcadcfe047bb5c25ef79ace4baf4ed9549cf67136bca5b
MD5 SHA1 SHA512

Submit Download

svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBCAAABBBCBCBBBABCCCCBABBCABBBCACBCCBABCBCBAACCCCCBB.exe
Size 16.3MB
SHA256 6e4e5bc8885b0d16b87103acf98f8ab80c1ebce87c91ba76182acc49f8ccc20f
MD5 b7fb0831d0db3f67d0bab5c3e26dd0ea
SHA1 fd50b0d330fc7ac36f92ecab5572f29ae7eb9a77
SHA512 4cf19a8321c00b5c2a792b9e03671a65f93d97c279b00ec222b4fd8f1648fcf95bbfb28f40f83b5077cba3a2d16fd5fadb001ba15591727bf81b04820343f64b
SSDEEP 49152:U+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EPL+E2+ES+E0:nOU/jIEeQfoR/IuOFVjUu5P
TLSH
T134075C05F98740B1E87B11B04DDBD2BF8A30BB2587128DFBF64DC71B6932B919934626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a2db5a3da9600108db9e17ee8713138a4875651c2210b9b1f0ed46054c945a43
MD5 ba5d2e8ede0a8f5ffbe0c0b1e6c23f67
SHA1 82c100aaa1d72a11adb6fccee1a7af6d5ab0d159
SHA512 131cc3d5a5dba81c4fa33c85127f61d7e056df2832ff64c49b2c7c4db36b5075167f155dc03fb69cd56030fde6ca988274888b977b86d0ac7e42bf4a514eab70
TLSH
T10A21D831B4A4DC57E93378CA652BCBE20CA43BDFA85C6A541309820967D5C73CE258F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b9b7e2cbaf3c9f67695796906f1640183dfe7e8d01a11719746769d887b6a2d7
MD5 a70cc2b9af07fc8e86b33e3a0afa1c4b
SHA1 e3d5918bdd3d0c9999a067920da016c61055c56b
SHA512 6b2909b11621dc1a9634b5fd4e23560ef95b6c75a2cda8d7f7bd8762a7853f548d6e44e75096850daaf316b677b345d6fe6beb65b188a5536ba1189f28017cfd
TLSH
T1A711C861E4E5D857E93378CA623BCBD20CE43BDB645C7A6813094219A795CA38E218F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2112-71-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/2112-2661-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/2272-36-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/3320-6-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3732-2531-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/4952-59-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Download