458a605b5742028493ae1f09bef6a27072b7bd6caacb6d9d0e211121a22ce7ca

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 15.1MB
Sample260814-ekcklsfa83
SHA256 458a605b5742028493ae1f09bef6a27072b7bd6caacb6d9d0e211121a22ce7ca
MD5 800c9271e7be807d03fe8734bc8cd152
SHA1 acd917e2178a19c76a65621d2cacb55a5f18e454
SHA512 b7e158dd683d103dae3eda6829ece49be0e64e537ca626c5fa82e424927a0022ac104fe76c959b35dd6bae959bbd8587914a7eb074b2d00fbf0528fa355f827e
SSDEEP 98304:1VDVDVDVDVDVDVDVDVzOU/jIEeQfoR/IuOFVjUu5s:DFIF0wuq
TLSH
T175F66C51BBE88C63E0B70232597792960E31BD654B25E18F729C535E5E337C09B33BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
4208	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
5292	svchost_BACCACCABCAABBAABBABCCCAABBCCBACACAACBCCAAAABCABAACBCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCAACBAACBBBBACAAABABCBCACAABCCABACCABBCABCBBCABABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCACCABCAABBAABBABCCCAABBCCBACACAACBCCAAAABCABAACBCAB.exe"	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCCACCAAAACCCABCCBAACABACAACCABACAAABABACACAACACCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe"	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2972	sc.exe
6036	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5228	cmd.exe
1564	cmd.exe
5604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCACCABCAABBAABBABCCCAABBCCBACACAACBCCAAAABCABAACBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
4208	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
4208	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
Token: SeDebugPrivilege	4208	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 5228	3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 5228 wrote to memory of 1032	5228	cmd.exe	93
PID 1184 wrote to memory of 4864	1184	svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe	94
PID 3756 wrote to memory of 1564	3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 1564 wrote to memory of 2972	1564	cmd.exe	97
PID 3756 wrote to memory of 5604	3756	2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 5604 wrote to memory of 6036	5604	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_800c9271e7be807d03fe8734bc8cd152_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBAABBBBACAABBCBAAACBBABCCAABCCBACABCBACCAABCCBCACABCACCCCAABACABCABBCCCACACAAACBAABBBABCACBABAACBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBAABBBBACAABBCBAAACBBABCCAABCCBACABCBACCAABCCBCACABCACCCCAABACABCABBCCCACACAAACBAABBBABCACBABAACBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe" start= auto displayName= "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe" start= auto displayName= "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABCACCBBBCBCCBBAABBCBCAAAACBAACAACCCBCCCABBCBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACCABCAABBAABBABCCCAABBCCBACACAACBCCAAAABCABAACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCACCABCAABBAABBABCCCAABBCCBACACAACBCCAAAABCABAACBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3bc01a15e09fba7cb703fcc83ce17d679f3c52a43a484b109126588d55f724d6
MD5 96d5f1d93a817ee8030516741c2c551a
SHA1 f560d6f049cfe4ff7d72c3811b92d3e7381570e6
SHA512 e34dac636b596f00b5389f66687be2766675b2971294a0b63890d831366dff1ccc011831bdb65228c757c75f35b5391f9aebbf8928e2dcea499190f9c276d9b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.26100.1_neutral__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 ec72dfaaac50eca2da0bba4799189481d3678e04f1e495fa8c1f9277e934516d
MD5 231532754bbaf51e3236f7308f5b1f6e
SHA1 25fe687d61ff4801b74bb18861d6d6f4d5d81393
SHA512 4fdad0acb5a2c9e5b9c0b2fe8a820af0680adace35eaab5f2474c280c175a9f9de8e59b0b2f855f5245f7d202e29d59bfd98a71af84da6d68d3be2f48dd67f4a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.7MB
SHA256 f156f2929d04c8cd75e96cc1a17d3668aede0dbfa3e119cf9867fe82a16eac82
MD5 5518c5ccd88d134fc82292ee76fc28dc
SHA1 e85f733fba789275adc785a6b8e5acd75f85a16e
SHA512 7fa6cf9a45fc4921286281033f4259ca67468c8bd02c058846e7392047f60c8b1f370ef95fd23e6ac909ccb563b4e42e3962907d81329ca12f96b47d76584909
SSDEEP 98304:1VDVDVDVDVDVDVDVDVzOU/jIEeQfoR/IuOFVjUu5LgZ2Hb9t+2xj:DFIF0wutgZ2jj
TLSH
T134F67C51BBE94C63E0B70232597792560E31B9294B25E18F72DC535E6E337C09B33BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 69b57e1a582fe122e38bdc8ac4c487525c101bfc87275b2be34a39c2a792c23a
MD5 18ed690529b099a2de0b5b8588b8a94b
SHA1 29a39b38cdc2ebf534d8d9ad7eddbaca0e5be056
SHA512 51da218b9a8fa2eb2d4987d7283f085dc4f1d05228131ec1ed0d1075d156067faa060b8fac83d6ee64d625e20661ace071047d40a3439c62c0ebaf1ea7a5ef0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\qap`g`v~dtlq
Size 10B
SHA256 9b70ceb6a299430c29627ad8fa9e9f189e6e9106d5f5bea9a00046779cc579cb
MD5 921336efde78806f2e5a9ae88cd5b057
SHA1 31b9e9ce81504e93439009438e905b1021f8f681
SHA512 eb5701bcd0b8ec6e7de336d6260ad003f37dfa94d1fe7c87872e4dda23c810d17f2b5ab65ccf0b852d03190734b42c7e9c574b9f447366868b16f5c9c3e99ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\GameDVR\GameMRU\qap`g`v~dtlq
Size 10B
SHA256 e0d94d15595298de6a4588983e4e57d75554935f80e5d63a617f11ac1c717ad9
MD5 c0c6fc34ff4f1dfd19f7e2a1a4c3a81b
SHA1 29fc7030c2f77586d3c4dde5eaa5590172962abf
SHA512 9bd072be2c4091f0a5f713a9b7d35eebf65e0410d685fbd03f1b0693668bb5eeaa766512baf6e2f4d073f24bcdb3adcc571de8dc3a1ac7f186f1dbcfba05384d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 10dee5dee53d436cad25e7e3241fb7c1b128445b6f3f320231cb3a03b99e2351
MD5 30c6a77ca1937e062818d166b1f885a4
SHA1 e12d50b92730563865bb92f1b02f1ed3defff03d
SHA512 1683fc06f07f23f6625684692d0c8729e20f92dd762af42d968cdb7938d83f4843440004927bded134b9bcc307ccb14f324167793b32bd99f2c0a947a031634e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\qap`g`v~dtlq
Size 10B
SHA256 6c8094bb65bbe4f442be062976e5af6cbd4dfe63fbf4728cd9f59a9fd2f818f1
MD5 2a322ed8c6713aa8ad5ac04c9d221a89
SHA1 ca43cc9f72e509d79b2b9fc98a7580e9143d0595
SHA512 cd8a1feaf315b863b7ecb7b03b62bfcfa3fd07a07878c4bd598dd3befd7c92bad651395aabf3b213f0ab10def4a96b4481949f1258f5ce3342f1fa5bb3f5ac31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a588bda0cf06f789b96778cc588d19827c1d5c59024977fda1f7fb19f48c20e4
MD5 03d8f9ad41c08f4e68743be1189ab88b
SHA1 eae03f6a014c9169c1b9d0b25eb912ff63bb2777
SHA512 90ce5a02bd8c4de72fef91cdbd2e69602d1e0314d9b56ef4dec3cf4aa9f0cb3998fd375a95502f5361bbe92644f4f65826f378970721f4466aae172d017ca953
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd4ee0ec085edde94353ad4a52e5d6984b0207e44fb462c454fd1db2766df356
MD5 a199b7fe861a8c52d526d75a04948fa4
SHA1 ddfe3cba4f1eae53a4a1443e39f5854d6a083284
SHA512 d975a8c7a3ccf5df61fecdb4fdb8e19cb9275ddfe8adf162402eefd50fbec6e4bd1e7d21135b7b6d651ef2377da2cfd4016fa718a65405e7c6f86b8e93ff92ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28c4cada4bfbde219fdca1f28f49189508d161fda2f754222cabfba0ffe021c5
MD5 fef859b55452624ec97ece68e40a382b
SHA1 bd82fd6f7a819632828fc72dcc8e9686d7f258d1
SHA512 99c02167bd9d161cbbc7ca4d67c3653bac439947af6181d95cb83c05830a6149c49d26618fe759a6275ec35e3b5069d663370e35da49d0e5f1b947ac1c4a4967
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fd8698d7558c69ec2d33e363bd7bb69c4e57ed392e5f6a0f3d3dd114205ed5f
MD5 23844750898627bceb9b91b280260716
SHA1 8a9602c07c382d70619bc75ef621db641bfed7ef
SHA512 727a2a7fc96b6df0046d1f05d91d13dacaa155f2c02179c08097c90dee467f7b9f9277fb177bba19f20fa5a7f7f39108d923b52d1c926488766ad4b75563a82a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b0db4e6d223f128d56481779ea88f2c1cb9f78348c70592dff37160900d6731f
MD5 356fa0df4887a11e13e9c97693c600a2
SHA1 1e1b043058a3ff580fb8b43dfb9f421e28c5c6e1
SHA512 95663cefab9641b4c33dec88182fb7ea426d075d7c3bee9b88bd6fc639f3ad50a4b5dead7e50f867cdf8039cd288b9482c82defa7ba5a93229b4052b10740937
MD5 SHA1 SHA512

Submit Download

svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCACACABCCAABBAACBBABCABBBABAAAACACBCCBABBAAACAAABC.exe
Size 15.1MB
SHA256 458a605b5742028493ae1f09bef6a27072b7bd6caacb6d9d0e211121a22ce7ca
MD5 800c9271e7be807d03fe8734bc8cd152
SHA1 acd917e2178a19c76a65621d2cacb55a5f18e454
SHA512 b7e158dd683d103dae3eda6829ece49be0e64e537ca626c5fa82e424927a0022ac104fe76c959b35dd6bae959bbd8587914a7eb074b2d00fbf0528fa355f827e
SSDEEP 98304:1VDVDVDVDVDVDVDVDVzOU/jIEeQfoR/IuOFVjUu5s:DFIF0wuq
TLSH
T175F66C51BBE88C63E0B70232597792960E31BD654B25E18F729C535E5E337C09B33BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1f932413e6a7db4ab7088b2c721b3576b7d1af5eb60a8a4edb7966fbda46598d
MD5 0f71fd88ce79ba61f5adc43fe1bd21e1
SHA1 83dadd9190f92ee4745b6afe1adea334318bbda4
SHA512 8ff5e829e619f1d9e5d1741c20ec7673e9d10d079ba75072fad751701c0e65e25e4885ef1d6465954cdbdacf9a73ef12e315e1ae8ac9510620bdd672bcb9343a
TLSH
T1CE11C861F9E9D823F933688AA61DCB430CF4778B6C586B1453018228EAE5D31CD554EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1184-32-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/1184-22-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/3756-6-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4208-70-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/4208-867-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/5292-71-0x00000000007F0000-0x0000000000811000-memory.dmp

Download