cf7bf4c59e56b3131d9a8942f0a64ff409f4f782549c687be8ce723d796a0cd1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 14.9MB
Sample260814-dwf7hatela
SHA256 cf7bf4c59e56b3131d9a8942f0a64ff409f4f782549c687be8ce723d796a0cd1
MD5 bcb52c25be7bd14f536e3b90fe7c26fb
SHA1 07684ad62d7625e33270619594b410cd0679a064
SHA512 63cd49d434b3a84be7479c3c2a327254e8bb7b6cdf160f4cfd2ec870062e6d622ed621217be24c91afc12f96b42770cd798d43e8514cc9fe422c98dc85714dba
SSDEEP 98304:yQ151Q151Q151Q151Q151Q151Q151Q154OU/jIEeQfoR/IuOFVjUu58:D5S5S5S5S5S5S5S54FIF0wuC
TLSH
T13FF63A45FBD94162F477027048ABC2B65E30BD254F22D6EFB248A31D5E33BD0AA35726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
1648	svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe
3432	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCBACAABCCACABACBCCCCCCBACCCCCABAAAACCCCCAACABCACBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe"	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBCBBBBCCCCCBCABBCBCAACACABBCAAABBBAAABABACCCCCACACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe"	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1812	sc.exe
3504	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe
1936	cmd.exe
868	cmd.exe
212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
544	schtasks.exe
1520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
3432	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
3432	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
1648	svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe
1648	svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
Token: SeDebugPrivilege	3432	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
Token: SeDebugPrivilege	1648	svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3460	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4964	1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 4964 wrote to memory of 544	4964	cmd.exe	97
PID 3512 wrote to memory of 3664	3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe	98
PID 3664 wrote to memory of 4452	3664	notepad.exe	99
PID 1088 wrote to memory of 1936	1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	103
PID 1936 wrote to memory of 1812	1936	cmd.exe	105
PID 1088 wrote to memory of 868	1088	2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 868 wrote to memory of 3504	868	cmd.exe	108
PID 3512 wrote to memory of 212	3512	svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe	112
PID 212 wrote to memory of 1520	212	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_bcb52c25be7bd14f536e3b90fe7c26fb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBBAABBCACCCBBBACBBBACBBAAACAAACBCCBCACCBAAABCCCBAAABCAACABAACBBBCACCABBCBCCCCCACBCACBBAACCCAABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBBAABBCACCCBBBACBBBACBBAAACAAACBCCBCACCBAAABCCCBAAABCAACABAACBBBCACCABBCBCCCCCACBCACBBAACCCAABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe" start= auto displayName= "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe" start= auto displayName= "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBABACCBABBABACAAAACCCACBBBBABABACCBBABCACBBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABABABACBAACCABBABAABBCAACACBCCCACABACCBCCCCACBCCBACAABBABBBCAACBCBCCBCCACBBABBBBBAABACAACBCACBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABABABACBAACCABBABAABBCAACACBCCCACABACCBCCCCACBCCBACAABBABBBCAACBCBCCBCCACBBABBBBBAABACAACBCACBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABBBBAABCCAAACCAAAABBCACCCBBAABCCACBBABCBBACABCAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3a7e3c9a0896213e25aa98fbc8df1078636924da86dae31baff31df7403a29ef
MD5 1804cecf18685a2c56509e0f44e3412c
SHA1 c99aeb1a05e57b68335d9eff0d6f449f4415a423
SHA512 2ec354b0679803dd505e64a4118de27e684a0ff3aac5284b0c316e86f5dd12df091e5e4a3c6e23f171f1f9b3af92789e6599254fbc4c3b97161341781e089fd1
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 15.4MB
SHA256 5efe6f3fa126020477c88e27413240c59532a08d8a2bbf8b29504830b5291971
MD5 aad7a1098674126fb49f8282528fe464
SHA1 c0f328b20832032ba06173a881331181086e36d2
SHA512 d08d42ac2d1cf579dff41d306fe68d1e63fe6bad53f58e95ed8a9790980fb9be2e696654e70ea7b58ae4df7730ffc73dfd69f3ab3f9148c26a04fa4d1ef64367
SSDEEP 98304:yQ151Q151Q151Q151Q151Q151Q151Q154OU/jIEeQfoR/IuOFVjUu5fpi7:D5S5S5S5S5S5S5S54FIF0wuu
TLSH
T1C5F63A45FBD94162F577027048BB82B65E31BD214F22D6EFB248A31D5E32BD0EA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\UserData\qap`g`v~dtlq
Size 10B
SHA256 d5b1600c213143dbe6439c57c781f8ccd8a821acf86a7bce6a7d6d88e2e9c1e9
MD5 e1271c97f4996e08cceb2edc651283b7
SHA1 72d3e4b130e93144ff38538bf718db2238d99647
SHA512 03eb9ff08c3a6d8388260b52d8e23d5550f556c55e505793cd1d3c97291bacf57f3e6f53c2fea44e9c71020f51538590bfa143c7fe60cbe45aadc938b6ed7a8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qap`g`v~dtlq
Size 10B
SHA256 0e06797948c43f33f494449c0e4e0fe6bc03def61918cb9bc084d6439e9aad6a
MD5 103097623e66a2a263405a50fe5c6df3
SHA1 bb8c4bdf57fef0671362b295d174fd9eb4a5c4ec
SHA512 727cda890c0dbc787565d4e53e7559e7532f1b5f870cf04852ba6ba83c4358c3f83bc6e5a8394f2ada2daca17ed6866d9b28a767d3caa33afdb815251a64c5ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 6b61e8095b812cf6123925325b7711d1967883a8b49921901babc03394f0ae67
MD5 7799261b83439b7c08871e45fc74c049
SHA1 74d71521595f47293ec386cfc540d4aca319548d
SHA512 28aabcac6d5c93e5293bb5d5111b384e8a2026734eb55dc09111808027213616c3b6e06b816cf0348aa52bd599f5b8775c78feb270a73cda6624849ad39ed4af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\az-Latn-AZ\qap`g`v~dtlq
Size 10B
SHA256 0f443f9598134a76827c21868290c8d62e3094e5afa6d11d081be16ffd4bf1b2
MD5 940654722c5730d9aa98df29173e21d8
SHA1 0e240510598bbe6cf5f18e8e266ad2b9dd425f7d
SHA512 95b8fd95c07d589723c1b18b8374ad57d96b3a9459ed142dba43a4ad8de582a2b6aefad3806657b7f4d79df7ad70e940379e9c2fc6087716c1966321470e0ffe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 d3bd36c37a64d7e323e6e068c2f875b6baed74e2b1cb5d72d85238cc4266d4dc
MD5 67de866ab6d5fdecab9d7c8b9e2e6cc9
SHA1 743ad43a3d05848456f54121625a43db9004c8e1
SHA512 b893f6c1f99d29a4fceb79aa4dde3b856047455669f36f320b54abd5c3ab408bb4dad4e36e616c8a24fee0088b058950fb7843c2a16381822dbfd28204a794cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 ccd7218d03c21c985025dfd0f5b6d50f87f95e34fe637b006252a6b0f4354b7e
MD5 c54721712ab1ce0a8b1899a1de2f6200
SHA1 f7c97117e21a68f1b3e7392a2b2fb0601a3fd944
SHA512 4782533f6c4c5e5c32d9ea19b205596fd261328c15db7658d7a44e91862e06983c1f56413ba6e2d73cf7006fe277157cbb66dc38710ae4ea91d59813e158261b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3913454835ed0337c206a02806d47185825e718ab53d4ff96c2e2892024c8076
MD5 0731887a0fffda1ab41de6a11b054fea
SHA1 631730f63f751d7fe8f091f1c1c455410ba95314
SHA512 3a3223df3abb6493c4728e0e166c8c7126d4e4d3c37c5ce7c5967c094d6c2870266f90dea8f6542427b9f4588e4a3bb581084fcc735c98fc2e1db4334fe0d3c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d61a215634f3384d1b51fffbadb23734f863aee9ad69de96d8894ab9dc2129ac
MD5 120d3d4fa013805893c24bf154fb27e2
SHA1 6d42d00532c7ad3e9aa4ed26eaf6c48d8f0b2a2a
SHA512 a2a566e3d20c1a55591c899ebfa2335fb59427a5bde56a0e44780eea7d58ac99f4c8e31c2daeac97dc09190240273d0446f508652d048cdccab5b17e7bd1fb4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b408bcad88ab4cfb78d2f9891723d75971e6be5f66590697ef3e8b6ae9b766a4
MD5 73c70699b8c52968ec2d0769ffe66176
SHA1 bdfed0fff94b88b1d129f88d1633fa623d370e95
SHA512 77b6d50a8baa96b2ce82ee8a59845e5e894a0258ba4522f165e6b30c7846d38aff3772d4893d7d806cb9e99724e19ed2f24806a813b28ee54c5eb60f97274dee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1ad4709999d3c94c6a71b1c1107f1e6a1fdd39a6382a3f77c6826cce89334049
MD5 bcbca5874352f79602a144b48cece6ab
SHA1 83cc6fa55cee285560710bd3d509b442c4bf45bc
SHA512 d025ad40b53575280f85d839fb6adc627aac71004f26e1dd6079293dfb49d3a9cc83eebd1c830f6e57b7ca2d3c0c575154a0c9bf46bc9d7cd10cbc3377414587
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ec95da5cdd9e6af95ae445bd38064a693eb2791e60cee14d7ae65c0919b01bef
MD5 9752aad00f00c254dd4384ff015767b8
SHA1 c0e59c5127340756cea4b50f77c60eade4bf41aa
SHA512 e68d8f281cc5a0092c140adfb09d38cf8ff692e1e6bf7a16f948580863c2b48f9bc64077b37864cbdad322772cdbbec7f106a8f44ee886c655738e5d5c6233fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bbaf8bb71e6243437db1c0c5e51a4fa32fac8b63e4b2778ae4b3c36c3c1c86a5
MD5 2d5fe96fc3e00c5e6ed5f9b10557d9a8
SHA1 bbba63f5d57b66cb5f587dc6d817b19cc935a2a5
SHA512 1c49fa825dab83663b0a5a10ff92cec3315efa339419bba1de69e4028b60c360ce73c1d109dee7c2e1aa8448e7272ee91c54a3826b80617fac5b6b689deb70de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8b91139bff083cd84531ab1cb5a511298bf54f4e56b6dc297e39d66258b86bfa
MD5 e554905b60fc1f745f5daf4cbd2e8f18
SHA1 d0aaed8dfb4bb2ddff6f434e077f319987f65a66
SHA512 2dd7899b1691c78ea46d580806e792df92cad2ad445f247f0faea29895df144cc7b984b86b273f686c3cab9a260051f6725d143064d28b116f8d96ee4f7d9d2f
MD5 SHA1 SHA512

Submit Download

svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAABBABABCBACBACCCBACCBCCABCAACAAACAACBBACACCBCBCBACB.exe
Size 14.9MB
SHA256 cf7bf4c59e56b3131d9a8942f0a64ff409f4f782549c687be8ce723d796a0cd1
MD5 bcb52c25be7bd14f536e3b90fe7c26fb
SHA1 07684ad62d7625e33270619594b410cd0679a064
SHA512 63cd49d434b3a84be7479c3c2a327254e8bb7b6cdf160f4cfd2ec870062e6d622ed621217be24c91afc12f96b42770cd798d43e8514cc9fe422c98dc85714dba
SSDEEP 98304:yQ151Q151Q151Q151Q151Q151Q151Q154OU/jIEeQfoR/IuOFVjUu58:D5S5S5S5S5S5S5S54FIF0wuC
TLSH
T13FF63A45FBD94162F477027048ABC2B65E30BD254F22D6EFB248A31D5E33BD0AA35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 696a4e5b0a60e36c8f4f20cd5ef28013fe72f3f9672edc59657a65297de9daba
MD5 adbafe88f2ab94e76f0ad16675482ad5
SHA1 eebaf5633080b8d83d0475ff2dbfc96a15b0f00f
SHA512 9d98687ba55e77a61a806a174bf2f05fdd0cc255252968c81afaa0346a9dcd5cf8dec09fc255363c378e0500938da5cf964ebed1c29b5a0a4c7694aba92ef482
TLSH
T12411E950E4E5F823B93328DB522EEB820CB4764FAC589AA5238C42287FC5C768E458D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7039d7bba8e6f01d8e7f13e665b7aa52d30c2d0b39d92dca6398fb7e7cdb2528
MD5 894b93b4c8378c844d3c0e1021fd259a
SHA1 208b80d8f6c1a044a334c7d8b3997315489ec9dd
SHA512 7916179e3911f19b0873f581e754005d61d35695b37bfd7c1d2d47aa62cdb9c91aab2fe897b7e89047bfa7f8976b73a1f39eed3656031c1b760c891c8011c318
TLSH
T11921B911E4D5E853B93318DA521EEB820CB8779F9C5C9595138D8218BFC5C76CD498D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 8e0ef7db59ff0e390f1c53b7fe4e43f48fc6b9c6f1282933527a05a705cc3465
MD5 50c0ba142b09e2a6cd2d400c8fa328d9
SHA1 1ce99b97c1128d3e74fe44fe6dec7f1f2d4ce11c
SHA512 242b5e9de2d393604b052ca2821f68f2cc18ae1aff76ee1a543641e338f425c0912afcc7f557a9468b94ba968a592f9faf890d0fdba0afbac84ce54f39d9a307
TLSH
T11811EE50E4D5F813F93328DB522EEB820CF4764F6C589A95234D42287FD5C76CD558D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-6-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1648-75-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/1648-2869-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/3432-1135-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/3432-2870-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/3512-36-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/3664-59-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download