6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 9.2MB
Sample260814-e8wcmavwbx
SHA256 6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7
MD5 4589331b72042d6e17b530b9d251031d
SHA1 787b3ded64d06ee41cf615abe20f8b8378833a38
SHA512 15a53868d5e32174897aa67b293f6b959df0440b59a2f8ba2c43986e8ee3301789c8647c9ec0cd3ab5d8314bfcf92aad117f066884ff87f88eed7f821f43e04e
SSDEEP 98304:8LZ1oy5XLZ1oy5XLZ1oy5z1MbQ9yDAD7KjjqkusjmqMhF:8LZT5XLZT5XLZT5z1tIDewjqkjiqMP
TLSH
T124A66C29ABF485E5FABBD938A8778271FD717A100932934F89D1C60E6F335914D29332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
2740	svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
1924	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBABCBBABBCACBBBBCCCCBBCBBBAACABBABCBBCBABBCBCBACAACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe"	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBBAACCCCAACBBCAABBBACABBABBCABBCACCBAAAABAACABBBBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe"	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
468	sc.exe
516	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4168	cmd.exe
2676	cmd.exe
4876	cmd.exe
3168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2228	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
2740	svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
2740	svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
1924	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
1924	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
Token: SeDebugPrivilege	2740	svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
Token: SeDebugPrivilege	1924	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3688	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4168	4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	96
PID 4168 wrote to memory of 2228	4168	cmd.exe	98
PID 3272 wrote to memory of 4296	3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe	100
PID 4296 wrote to memory of 1676	4296	notepad.exe	101
PID 4884 wrote to memory of 2676	4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	105
PID 2676 wrote to memory of 516	2676	cmd.exe	107
PID 4884 wrote to memory of 4876	4884	2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	108
PID 4876 wrote to memory of 468	4876	cmd.exe	110
PID 3272 wrote to memory of 3168	3272	svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe	113
PID 3168 wrote to memory of 1660	3168	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4589331b72042d6e17b530b9d251031d_amadey_elex_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBBCBAABCCBABAACACCCBCCACACCCABACBCCAABBCAABAACCCBABBAABCCBBACBABCBACCBBCABCAABAAABCACCBCCCAAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCBBCBAABCCBABAACACCCBCCACACCCABACBCCAABBCAABAACCCBABBAABCCBBACBABCBACCBBCABCAABAAABCACCBCCCAAACCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe" start= auto displayName= "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe" start= auto displayName= "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCAACABABBCCCBCCAACCBAABABCBABAACCCAACBBABAABBABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCCACBBBBBACACBACAABABBBBBCCCBCAABABCBCABCCCCABCACAAACABACABCBACABBACBACAAACBCCACBAACCCBCCABCACCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCCACBBBBBACACBACAABABBBBBCCCBCAABABCBCABCCCCABCACAAACABACABCBACABBACBACAAACBCCACBAACCCBCCABCACCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCACCAACCAABAACBBCCAACCABBBBABBABCABABBBABCBACAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dcb9a047f800ba30acc34c4bd93d324b4afa1e5659875bb4425057cd1c22203d
MD5 ffdc0292ef37ff4e8c6950b39650402f
SHA1 88bf0e8424676bdd02cca24255cece59c8f6f363
SHA512 e1260b4991c3438259adb374782ab0850bf11a8af7669e87f92b6d65c01764edee744cdbba0fc922ae8f8965e2fa5f3c9ba8f337de2446e902676f3e4419c937
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.7MB
SHA256 ce8b01ba87bb6523e7b7f1fbe3503b25f4a5452f2cbab423536ad67f61eca54a
MD5 898456a58e569b74ebe7d2f8942554d9
SHA1 5f3dd0ae782388b692513c73f3addcc947e1fe13
SHA512 ec74a0b2387f95f9a25cae56e1b43a99c509c7a11b9e4dc75088c503a90cf1be953b8e01b86639e799323c2d5f5a6b5ba14b78bb385019356aa7da25734b36a4
SSDEEP 98304:8LZ1oy5XLZ1oy5XLZ1oy5z1MbQ9yDAD7KjjqkusjmqMhCpi1:8LZT5XLZT5XLZT5z1tIDewjqkjiqMv
TLSH
T16BA67D29ABF481E5FAB7D939A9778271FD727A100932934F89D0C50E6F335818D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a50dd5e5f00bf77a813b629cc865e7a1d67cc9942d36d84969d3e11f97d9a17b
MD5 f14db687158b1022626e16340577ebb2
SHA1 30c6f23329fe26f6549c2f9b8248893358085f6e
SHA512 9b4000cfbd924e1e9e67620a86ca244df7b85cf35e969761efd7fd151f1da53054a4ac6f0bd362484e3c6348b2430ba2c35bdd2fc1e7619c944d973f5b542744
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 9c7866b878751c9eb1595225eff59124184991c84ed1b9f0411064cb2ea09b59
MD5 ee9859d2416f40692275ded395ac23eb
SHA1 63d252ef029f9aa60d48965b52ea2d14a0dcfdec
SHA512 6b67b3acb7fdd5f3db3d7e4ea591f6500ed9568acbeb866ee49f01a07868d0031d194093c46eee2590858c0dff71d86fdf6873957e31fb537871d5ac6c543ca5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\qap`g`v~dtlq
Size 10B
SHA256 24633dc9cd5f3a28179c6784f14b5af331fca338c3acd908490ba0d4feffbc6a
MD5 f781a1b63d13ae4c633ed8baafdcbde3
SHA1 3c0d337e9503a77a779fca03db7677e42ebe0806
SHA512 bf4ebeb07ae187a21fc06458f3fddfe7d301c9b60580d948ff92fae7a8596c7d21bda3e1635511c5b3824c3d2dd5a93bf5c5ffbe75d27148e3bd5e85420d40df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\en-SG\qap`g`v~dtlq
Size 10B
SHA256 443ab3e34c53b58262f90fe300ebc246e3896227147a7e92b4b75bb495ed4793
MD5 9fe1470903482ed45dcee0a3eb6f8d94
SHA1 e4e9284f26ddf57e0a8b4f0ba9b020ba67ddca61
SHA512 82ffc9e36a1bd1ecb27aa999a1686384bcfaed390961d07d0970bdbdade62402a4fba4a8016709e4efe084c88b8f9cb843e8cad86308a649221421afea5b8123
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 cc5f56f73b0f707fcdce0d1e44280f1abd65ec2c79f32f4ea0e5db6c55053b75
MD5 966896d9978634f21aedb26a317ff475
SHA1 53d6ef21c446711d283c8be392785fa97c7604a7
SHA512 9bad1ba35abe6b8bf3728ba61e55015817604b7de3bd89be7aa7682682a5eb261818f292ab7197a06f2b186770957cc218cc00b5fc2d846b4099f6ce174debb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bfdd8d374396427612515dfe4dc998a2a26f9987294962a60390cecc11a1c03
MD5 7a78c0844507bd68d4b6a043b36fa53d
SHA1 206f84f9a9b00cf22344a456314df73cde38c4d3
SHA512 7b69e9c610545de5fe40c0dce1832268ad1e554b8cdb167324d76bf27fc9a08370b736823ce6359eb7d218ef7ba6749e21e36f41911dd5480a620ca00873024a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c18e308df1f35796b97f1de527195919f6bad394d58d8505d6839343578865da
MD5 a83bb5c4ee10d3ddd032b369d9e35060
SHA1 b4f8788c4aa59f0d8b8b193725c2abdedff93318
SHA512 f00acfdd743138bb7f88a42086d3ff7802a64702aba345ccf27f93c94e7d40c69c95096f7c103ba18956505bd351bb804c12cc7de87a8860b7fa1a8ffa24fb50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0947d1447dc5badc66b9f9a1f191161a35095d8846adf37a617f4b045362f9a
MD5 ad81b66b77b447f987322ba051d69475
SHA1 aa7b47a7d6e052dc3ebce6051694ae0d559bfad8
SHA512 572436a89dc4f4382b362f9e5b87551005182dd37e8affbf6828641dac278693c5a037857276a16bbbd6255a154ca4507197d2d5342612c5d0f2616268ad4476
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7704f04364c6bd127d9bc403b3e102807e137989cfbc8e21c24547c084daf341
MD5 a40ce775f2d8e9d61c1bd9818aab8896
SHA1 6237e43bddd95319f5fc2e66dda9226bb14eedf7
SHA512 0961c87467fba242c01ad517685bf5e1acc5fc2a3d89fbbe23e613b2d40e367c6640e3b26486f47da52f8e4026df3f5b595518d43502e5795166e1ed8297fc7b
MD5 SHA1 SHA512

Submit Download

svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAAAACBCBBBABCCAABAAABCCACBACBCBCBAABBBBBCCCCCABCCCCC.exe
Size 9.2MB
SHA256 6c3bd71ee7f70ce287206ab1f977f70e0b78dd8402ee6aa55d1278691df476a7
MD5 4589331b72042d6e17b530b9d251031d
SHA1 787b3ded64d06ee41cf615abe20f8b8378833a38
SHA512 15a53868d5e32174897aa67b293f6b959df0440b59a2f8ba2c43986e8ee3301789c8647c9ec0cd3ab5d8314bfcf92aad117f066884ff87f88eed7f821f43e04e
SSDEEP 98304:8LZ1oy5XLZ1oy5XLZ1oy5z1MbQ9yDAD7KjjqkusjmqMhF:8LZT5XLZT5XLZT5z1tIDewjqkjiqMP
TLSH
T124A66C29ABF485E5FABBD938A8778271FD717A100932934F89D1C60E6F335914D29332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 09e84860773a830f36e9713d1c65b818a45e041f87645ed6b3106243cc64926f
MD5 98984aa65c608fd8746327d99e789a0c
SHA1 9d98c2123f2a00a9a760ba336c01d1e054a76afe
SHA512 831370032d4054d6cef94eec7f6405fa93ffa39c6f040619a9749b169074b37a743742edcf836220197b4c2903f94523b1546fce10afd089efa4444743bfd8b3
TLSH
T18F21B971E8E5C8B3F932A88F521EDBD218B8774FED5CAA14130982286FD9D318D558E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 4ddb088c68b2a87cce19b4e04200d675e271a6db9049a286438367f43150e2dd
MD5 70d2607d774f2fc1f948c56edf00b95c
SHA1 5d4a7abcb4ab4add79e2030f7ac45b0082638ef2
SHA512 2bbb7b961a49e8a8f4e9e25ae8d994ffc17a48320250d4c62ffb42d89eb1b898cc9eaf65d5b3daba5a91f2c9bd9ea72a89fe25ebc6a727a483a144cfa10028db
TLSH
T1A411C461D8E5D4B3FD32A84F521EDBC218F8774FAD5CAA14130A822DAF98D304D658A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6a4eb683a7b47af1bac1db7becc9aa71f51662e57a8e5301ef6bd7affac2d18a
MD5 e2d705992568ec7abccb79dc3b50c071
SHA1 6668bab17b96e6ec1ea97115f6bf232493c5100c
SHA512 c9abe238d31ea53a1bd81f380b3c48d25ab5f357d6c130b491df4280f2158459528b5aee2ad5badf5917fd2e229f51644a31a0bf1eecd16b5faf241a93f3c768
TLSH
T10B21D760D8E5C4B3FD32A84F521EDBD218F8774FAD5CAA1413098128AFD9D304D658E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1924-2479-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/2740-77-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/2740-2478-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/3272-36-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/4296-59-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download

memory/4884-6-0x0000000000260000-0x0000000000281000-memory.dmp

Download