c467a1a406d26e4a43aba15033e25c5420c1e5309fa3c0483bc5439ec3e67648

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 7.7MB
Sample260814-e87ewsvwcx
SHA256 c467a1a406d26e4a43aba15033e25c5420c1e5309fa3c0483bc5439ec3e67648
MD5 44606b11cac6f9e6c920321d0f0a12dc
SHA1 0019f71e1bbf4e17e4b76e091f18c2de21a31de7
SHA512 4b29064a3c481239e2c5d4998f5496bb50aa57f68a483389e1a7725326f024020a7cb7eeafdb673a142e00c4c8c540b1642938a8dd39b2b9c690f36ee7614d44
SSDEEP 49152:U+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw259:ROU/jIEeQfoR/IuOFVjUu59
TLSH
T1BB866C05B6DE4461F5B7613049A7C279D6B1B8618732CADFB288873E1F33AD0AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3572	svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
3956	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAACBBABACCCCCAACABCABCBABCAABCBCCAACBACABCCBCCBACABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe"	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABACABCBACCCCBCAAABBCCACBBCAACACABBABCAAACAACBCABCBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe"	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1168	sc.exe
1772	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
4404	cmd.exe
4432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3572	svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
3572	svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
3956	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
3956	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
Token: SeDebugPrivilege	3572	svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
Token: SeDebugPrivilege	3956	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4264	4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	106
PID 4264 wrote to memory of 2244	4264	cmd.exe	108
PID 3684 wrote to memory of 3820	3684	svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe	109
PID 3820 wrote to memory of 3224	3820	notepad.exe	110
PID 4952 wrote to memory of 4404	4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	117
PID 4404 wrote to memory of 1772	4404	cmd.exe	119
PID 4952 wrote to memory of 4432	4952	2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	120
PID 4432 wrote to memory of 1168	4432	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_44606b11cac6f9e6c920321d0f0a12dc_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBAACBBBABCBABCCBCCAAABCABBBCAAACBCBCBCBBACCCBAACCBBBBBAABBAAAAABBCACCAAAAACACCCAAABBCABABAAABAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABBAACBBBABCBABCCBCCAAABCABBBCAAACBCBCBCBBACCCBAACCBBBBBAABBAAAAABBCACCAAAAACACCCAAABBCABABAAABAABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe" start= auto displayName= "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe" start= auto displayName= "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABBCCCAABABBAACBCBBAAABCBABCACBCBCABAABBCACCBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAABBBAABBCCCBCBACAABBACABBACBCBACBCAABCAACABBABAAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f975a0089d5affb7b02e950e21c5f857e53b40b5b23ead9ca3f99ac3bd09bf54
MD5 1b65aa1dc5b154ea5d8b2e7a133029af
SHA1 885aed99501d8197e4152c4ecd549b8f1eeb8dcd
SHA512 19f81eb0d62756e6f7cde5e028ad4382f325045ee5f45dc9fae73087b4b326907f61466817da8697910155ffa0822a1a3d1e7b3ba32445c9d4eeb4386c4d84a0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.1MB
SHA256 b469c71554b2c889fd33df28b3a2459a61cb3435c15be7a08ab951d2131a747a
MD5 c82567b755f347a6a9c624e18c3b1d70
SHA1 2ae5b4dc3c0abd63a2b2981d1e9f8311cba8b4ba
SHA512 11fa2ab7ebdf728dc0abdf6ecb3dc1cbfef9da58ee85f4430d309d97289f36f01225041995f597a7a3fa7c34e0bb9db976a98b86906f2d1b4fac98dc7f370966
SSDEEP 49152:U+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25s:ROU/jIEeQfoR/IuOFVjUu5apig
TLSH
T183865C05B6DD4471F5B762304DB6C279D6B1B8618B32C6DFB288862E1F33AD0AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.BioEnrollment_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 ea5458c2c5c295bc286fe142558703b18aa27e990577c64278f8f346f5b4e7f3
MD5 652d25780b1e721262173d07e1bc17a8
SHA1 4b9d6f932d41ac9dbefbec540c59e733b2651d39
SHA512 beae459d654907816be83d23eceb278e488a2b8906e339e1505b3bd4ae41d2ceeb76b2d49db36ca14e49611c110a2c3e6819bc0bb2f472724bfc2861f144c82c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 14f95192b119c2cff45bf29de265c2e2487952a39bb7b3056828b0b09779a500
MD5 f0bd18a96efc67cf4f46ee6efdf7a0b0
SHA1 ade3878d5dcedd55f3b784d2dbf83eb2f4823140
SHA512 b2b6b35f218b5389959206cacc3582289dc3c0ea3234f8fe332e2b11a6c8be72ecefeebd9164c0272dc3a3da0748d0c62d27b0ddd095b1dde298de14996c97b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\OptimizationHints\qap`g`v~dtlq
Size 10B
SHA256 fdb1c2387e8305a3f56eec71664f2a279a5c1a4d8e84c1e47c94f9efb7b23763
MD5 25613073771b17949124959f249bba32
SHA1 ea53c7691fe1dc02e2c46d8e2d48268e35ac68ea
SHA512 5e79a93527dd47ec6fabca405f514162efa4f9d2a183e5eb8bdef11fc3fe2487c12782715be124b725af9e8f1d222707c6f4fbdf661fb7d4da4fbbfdeb8bddb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatUaCache\Low\qap`g`v~dtlq
Size 10B
SHA256 7e887a2a620e1526e85235122892273e51c1860aa1e8c27b6cfbff870a09f673
MD5 46411d35d1e21574bab6f3a562d8763b
SHA1 bcf4f49e65bec2bb37b2a5eb4bcbcc0c45229b4d
SHA512 af565a44e4cd50ad2c6d767d60290f47f9e2086f711dc7d545b4395b8e12080e919f932936cb8598db63d1bd79406aee05e6b926e3ec0f10839be61dda453b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 e081b82083a9508e8aa4ba32e04e7a46b253f3a04b603d4a2feee64fa2fc4e37
MD5 ddccf85e40c31fc012840156f3b533cb
SHA1 69c98e5a07d43f146b4be7830078f20ec44d5e43
SHA512 aa1d704cab70d445a78c1f3f8040acba0a77edfb07e3e3ae505577350fa8848b0d201404c790a9e17ab079082749192890f2b881f30558709f7cfa71bf6fc9c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5cacdd3d41d22c2e19ccdffa50bc33c6fb28a9c6c5b7117423bb0cd0713bb3ea
MD5 4574f026d3cb92f7f6c70b3cd5479902
SHA1 69af19c31ec400056ac28ef50469b85eb239a155
SHA512 ef484d6700b5927db4eba862f17bf1cbda4d13dce05ea405292cbf81f4186922c304745944c17c20e33f381e03a8aed2fd32d1d68553c9d8fa84296bd79fb36e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d643cfde4aafb03d9a6a23a6368e40ff88f5056863a907f2359b2f10de5138e
MD5 a67cfc40655f3676fa728542b04ca232
SHA1 e69b7276ec1afc2e7de7063e0f2f5a1fd0130526
SHA512 de20f8d25d8456a62826c7bc4cadeeafde890b64cca98395500f263246aeb2ef24200dbedb5a08ef7c9f9a63701efcf0de612f6def98940286ae990138fe289e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 209f47a70711cb658d354136ae2c08921e6e239aa94d81500a217a715144f35b
MD5 ebde9ddb1dc03957e6f8eccb1a32a4c5
SHA1 a7c4663516e49748bb80857b659df27c93e8cf41
SHA512 4abedf89e803e8224f4ed8fd45aebd40d9b378c71e15256f71703233d84a5b2ed9c9c3f155f7dd5fd33eeb829c27166a73e4ae7dc97b02a3e3425599332a9e53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0b1d947aae754f00740ee20b9773e1af2aadccf69b65cd8f7423be27713169f
MD5 6990a2c326dc862356f1ff7c221ef515
SHA1 dcd48d40927c8a985090102931da1ef6e988a07b
SHA512 893a76f5f23d6c0720ca90471e920ad32f685028aef0d9d2605ce79716e34b159219a37ecb6b68d92a161927628f1d54ababfc6588f00bffaae9ae41251c8190
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c1067be4b7ef8843d6a5c166beff9a2715776b4e96b02fbb0fdfae4b845f2104
MD5 f7002264d33cded826070776f5d56b59
SHA1 fbfcfd647a4531bba780c78e1fc52491e3ae6a34
SHA512 9efc6b238ba596476b6a3af43b6a26661d36b2c5b7071faebf9b9a02925f39c481dd8d0428cbdcc7fbe8f460cb8f89515ccc65f6e495fcd3a1c7642365b1ed15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 443ab3e34c53b58262f90fe300ebc246e3896227147a7e92b4b75bb495ed4793
MD5 9fe1470903482ed45dcee0a3eb6f8d94
SHA1 e4e9284f26ddf57e0a8b4f0ba9b020ba67ddca61
SHA512 82ffc9e36a1bd1ecb27aa999a1686384bcfaed390961d07d0970bdbdade62402a4fba4a8016709e4efe084c88b8f9cb843e8cad86308a649221421afea5b8123
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c804b2e068b29ef586c0bc249427f5841ec36608530458236094519fef0050fc
MD5 1d3ccca7597faf421e264d1b7dc95118
SHA1 5f7deb53fbefd179b5525ae8fc85f88e6e3db159
SHA512 acee9c51eff65ef86f1115ceaf5c571ae52d32b41e7c09ec040a42c07356127eba8a57d6d83a2b67772ef11ad6b9dd5efd3a53d1bb3e858c37c50cf7ace6d39d
MD5 SHA1 SHA512

Submit Download

svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAAACBBACCCBBBBACCCCACCAABCCAACCBBBBABAACCABABCABABCBA.exe
Size 7.7MB
SHA256 c467a1a406d26e4a43aba15033e25c5420c1e5309fa3c0483bc5439ec3e67648
MD5 44606b11cac6f9e6c920321d0f0a12dc
SHA1 0019f71e1bbf4e17e4b76e091f18c2de21a31de7
SHA512 4b29064a3c481239e2c5d4998f5496bb50aa57f68a483389e1a7725326f024020a7cb7eeafdb673a142e00c4c8c540b1642938a8dd39b2b9c690f36ee7614d44
SSDEEP 49152:U+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw25+EO+Ef+EPiw259:ROU/jIEeQfoR/IuOFVjUu59
TLSH
T1BB866C05B6DE4461F5B7613049A7C279D6B1B8618732CADFB288873E1F33AD0AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 df0467afb8123d89d502e75f3b465ce3a77a84d79e825c910a21de8178c956a2
MD5 be93cdee60763bb0835f0e6a6f6eabef
SHA1 167525dc8b04714840f9612e4de178952e72cb16
SHA512 41c97fc24b2163547414e7d88323bf694471656b98b148c65ae9c8019fbd50a144dd9ea20063b7327f04356ec5ddc7ca384e6979ba359f84395f0233a5ffb2b3
TLSH
T117112B51D8D6DC33FA327C8BA61ADB8308F0A6CBAC5C9A146308412DFFC9D308D454E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e866b1b7e12749f379ec5a5535d8ae124c1c3850106ff1fd52aee8acc4732b11
MD5 80df03390e8b21bee6fdbfaa7e58c8c0
SHA1 52365f9a8476f3ffb52d01c05a7193040f72bc13
SHA512 40daf406ccb8e3081d02c2d683687406c268484bf366e5f241e25465dc8bfb6fd6a6afab71047c597bcd45108503bede3e89988ebc132b04c36c72b7127915a9
TLSH
T15B210B51DCD5C833FA326C8BA51ADB8708F0B6CBAC5CAA5463094129FFCDD308D494E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3572-1371-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/3572-73-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/3684-36-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3820-60-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/3820-62-0x00007FFF6AA50000-0x00007FFF6AC45000-memory.dmp

Download

memory/3956-2831-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4952-0-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/4952-7-0x0000000000540000-0x0000000000561000-memory.dmp

Download