9b354b3fa7e5afc77105619e4d41a00f7dd53a3466407b9cc58a103ae0b3bb72

Analysis

max time kernel
114s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 10.9MB
Sample260814-ezheeavtft
SHA256 9b354b3fa7e5afc77105619e4d41a00f7dd53a3466407b9cc58a103ae0b3bb72
MD5 5c2683ef6888ab535a4f8305726efe2c
SHA1 242aea9a35c44f01fae274d1011082adad6e0700
SHA512 3616d4ef5efa1576e744981134d0dbd08d28b466a74f240ccc51ee3eef8b332e68120dafdb4d6e8a94a2ca1fe999145c05238c770c6f875f9accc8aecbd4e619
SSDEEP 49152:U+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl8iw2J:ykkkkkkkk7OU/jIEeQfoR/IuOFVjUu5K
TLSH
T129B64B05BBDD4461F4B7123149B782669A71B8514F32D6DFB288932E5F33BD0AE31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAABABCAACBAACCBABAACBCCBBBCCBCCBCACCCBBBAACABCACABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe"	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2652	sc.exe
5116	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
5984	cmd.exe
1228	cmd.exe
5704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5560	schtasks.exe
5360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3680	5800	2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	93
PID 3680 wrote to memory of 5560	3680	cmd.exe	95
PID 296 wrote to memory of 3432	296	svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5c2683ef6888ab535a4f8305726efe2c_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABBABBCCABBABCBCABBAABACCCBBACCBCACACAAAABCCAACABCAABBCABCAAAAACACBCCAAAACBCBBACACCBBACABAACBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABBABBCCABBABCBCABBAABACCCBBACCBCACACAAAABCCAACABCAABBCABCAAAAACACBCCAAAACBCBBACACCBBACABAACBBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe" start= auto displayName= "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA"
  2⤵
  - Executes a command shell one-liner
  PID:5984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe" start= auto displayName= "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA"
    3⤵
    - Launches sc.exe
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA"
  2⤵
  - Executes a command shell one-liner
  PID:1228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAACBAABACAAAABCCACACABBCAAACCBBCACBCBCACABBBCBAA"
    3⤵
    - Launches sc.exe
    PID:5116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCABACCCCAABCAABAACCBBBCCAAACAABCCACACCBAACBCCCBABABBABCACCABABACAAABBBBCACCAAABABCAABACCBABBBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCABACCCCAABCAABAACCBBBCCAAACAABCCACACCBAACBCCCBABABBABCACCABABACAAABBBBCACCAAABABCAABACCBABBBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe
1⤵
PID:1104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d03cb66a45072b38caf46453a824fa8d5f12fd01580eb10c1a18ee8664c49e4b
MD5 497d9f8de4f5bae7c3f82798ab2dfeb9
SHA1 92a67fe4787ef9eb37130b7ccb5369e0c960fa57
SHA512 b20ab45086f4ad50bef7f0ec94b98d5ec8b77e97869e56c3a5c7b40f63a8d3dcec5866d879683c8a14c33f2a9dec0a70b82b3a4c8a536c35ee168b6f6b35abeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 89df346325fa4e24fe44a63c047daaca30e9601f34cb556b24e3454ae41d690d
MD5 24a63d6d10cacc8faaa64ae07d3a2b99
SHA1 92162310f82a2004ad665db425d551a4b9571daa
SHA512 b63cd1f32670b6d7347016ad20423e45ff8cbbddc6c8a919b56d64a4ec8354be28cc47de31a1ce7c13756691256d53620f7343dcc877059fdb0ad6a9ce90dc0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\qap`g`v~dtlq
Size 10B
SHA256 2e467e6295fb2ce5001be8fa5f3abea2143730650e8fe05544383b414435bca1
MD5 40ae80bba9df49d868e8ee57b8206702
SHA1 6f970cde5c8732e03102d57def2fc537d86092f0
SHA512 230feb1e15215db4d2c64493baae8ac1fa869bcd22647168bd502a495621a2cb32c7995dab2cc4bc79cd05aefed0ee67bc0aaedd8334fe110ee3dfc0a253eb5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Families\qap`g`v~dtlq
Size 10B
SHA256 79fffb6cae1571a7609c2b65fb8bccd9572238469785b375bce9a01cd6d5724d
MD5 94ae8da9663af06ad7d8c616ffde45ab
SHA1 61928324c21eeec2b0928985dc3995beb99fbda1
SHA512 5c0962a4a34d9714e587d1c98ba76e06b2eee904e2daf0623c5e91ed76394187da1190c7715558197eb9ed43293bd0c074e015904aa7e313895edbc4773795a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 3a79ae2ecaa4af91914d136e7ccfab5eaf1f81d68e3a100b06d96d3cdd9a355d
MD5 d0da11668a1f952ebd0a1875343d8a26
SHA1 513eed36001bfd7541f1c364d11ffc2043f33c00
SHA512 32cad6e5a104c6e7f23c107d2e118978f22f58946f855b1c9f79a58ad9d7bf83027281d5afb98d6425a788f13bcd278322646ad1a0d4340c62975fe73a29099f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\qap`g`v~dtlq
Size 10B
SHA256 57faa1d15fd1a3168a84c44013c8a260f9e7622209e90c0958578b301433051b
MD5 1c82173bd06aa61b8161065f4aa5dd43
SHA1 98c69356df4734ccf9f6abade6441f0050e659aa
SHA512 5524d18046adab5289fd83b94f91ac83cf813da4eea634c83068d955c0531ee32ee1f8fc41bfbac44a2386151b34b3fe543a9b1a49f80370c2058ea79baae18d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 d148d1a5b2b98891a86250ac8a4e4ba0643add5cee1cbb71dc53b8bd93bb3146
MD5 f602be47d08b1e6e3106e9f68771b80f
SHA1 6234cafb152556a923e72e05682c82fa4788b0bf
SHA512 e527ac9de356481fd8d2021dbebc78a3afa766339359664c65501e941ce7c7113647a2ce2f14fc3da667c18544e05c89d0e4ee203515951591e065fd92f08691
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 0dc458aa026567b49fc65d70ccf35fed14c77c2406275801accdaa1b5ce1e3c7
MD5 1ce403e0005c0e1f0f81dbff328192b1
SHA1 088b69917cdaa87c47c43330da2141839e832343
SHA512 fc6690383eeea4ed214abd292a02582cfd3e071e0b33447611b97443da1f75735741fa2633bea9c1f2d2869a32cfd27d804a64c303acd03096c3e1970041e043
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5710d25f4a408a028e449fd7ec88fd9ff0ef0a9182f93feba69f07720d3b9be
MD5 135e648027cf2984fcb2a7fb45791f29
SHA1 6800754d5357a81334d86ee8e4730d299595a0ff
SHA512 8ce5434ad10cc29871e5198feaaab8e83a505a2994a50776233a4c94ab4a0b803402bd1fcd8e1fdfcaf148b2f712238059fe03fa5a6f464b603424f51c272d54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d39c7d3e6de76df9307f931744f29599eded5c07e9fb54c7a54b218e6d96dfe0
MD5 725a11af8b619aff5ddd5813b466d5c0
SHA1 67d8a5ace88d98b0fa5ae5ea63cc4fd84a9d1b7b
SHA512 6f31f8c587ba2ab0a5fe81fb081fe5d018273bcc4c65b2fb10220963be0f0f8b2aa38d4d850bd02687ac3d8298988ae2be62204aac631ab75ed87fee93b4e598
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e25b437cb6f80e47a50cbede55ce51bc1c7882b5dd552fb9795512b07da7ad45
MD5 1edb7000de5e6df9a1bbd6c193ad62a9
SHA1 4d914ac46edcadb5d54a714b423e98d859181b43
SHA512 36fdce77535232fcecdb014a5be86a83195d6b5b0bf47d624fbb9178aa9dacc776fa87b16fc8f908bd5fcd2e83bfef66fb85bdb66accad26201b1573613bf281
MD5 SHA1 SHA512

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 66.3MB
SHA256 cc71536f7cd3699f68ea74241006491181e0a1a191db8d4e93ef61558fb29788
MD5 2bcf925212694938815acba5d2b3452d
SHA1 21207dfa4b834d827a9fa7d030cf8fc5b7c1dea4
SHA512 7162358056891c18f48cbec46ac4e6c14dea97e088c4e601473624d1e4f01c97b1a365b446ab0daa0607364d644d696ed4747d0389b59f5999d28149d7fa2c2e
SSDEEP 196608:AFIF0wujFIF0wujFIF0wujFIF0wujFIF0wujFIF0wuHk2P:qzzzzzHLP
TLSH
T1B4E74B05BBDD4461F4B7123149B782669A71B8514F32D6DFB288932E5F33BD0AE31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ffb520ca6cd60bb3ec146c9a3ec2510bac16f40d1e8634b1cfee292357747565
MD5 146b7bb8653922e8884ae6089c66b545
SHA1 93bf296e00447cdd3758d01c3d20ae533ab83829
SHA512 1fee56f75264f45718d8ca120e48c7aadaa749f0a6ac0c14de5d81ebdf5bc30cb9e2670694672abf78109ebb8961957e68a3846eedb0774d8022b979e5c2d70b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d12893bea263763e9f1cdf41bc1702e2720cded11bcfa9d66d19ccfe1b49835f
MD5 8327425c33af678257b8b2ce472b50c4
SHA1 a4e387d8a64825eb399016ec95bcec98d1a13f52
SHA512 e7195c8c2fc24d78d632431b2303418f5a8018c70f53fdf2a9a8f8c31cdf88b564d796dd90123c7586f64444e88a8d3521e555eada44a8d79543b6e8323436d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38efa1b569e3f6ed34bdb732c2b2023b9f74fd5176539b2ec699d953445f8715
MD5 7c1835935f91b68df9d3271f1de3d2b9
SHA1 61eee145281e4f666aef153685aaf88834ce69de
SHA512 85802e11b984dcec65cf515bcb6b567f146c088e83cc64bfc51acf1d71497440322bfb55cb94307b99947dc0cf47a3f0329750c7ed65f26b39d4c38baa64fbd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2158a223ac8be16a63fa98c476e018c86ab0612e88fba98afbea9d6b818f9172
MD5 515984b3dc45659c6ab560eb535598ea
SHA1 0aa9974e2e7171f99db1ee9c9f124928efc53beb
SHA512 ffb3f443b4afeed8db0ce471d0701415e1778768ba2273ef10a2d33e8d9aa4394dbc473246f1f4ed7bd367059426e61b84918917bda9d2260e73f086eab826b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b90c29f835a72ef33811fecdf5a91fc094a1f41d524fa153ff91f61a37e5292
MD5 397a434dc3b6e49fc84215aafd0af833
SHA1 28b8f2ecb80a025e8deec1829d42a3d0ee68e3dd
SHA512 ba344663a58bedb8e63782b18b90dcadc70015459fbba04bf8df53848fcc438e9f81f95e5ad4eb7ffa2c7c85a5f8751f5e1ff7a6c69ebcc44fb853a69b3d3f2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 dbf12ebb3efdad86988828fb2c844ccbb16e2d46887a03afe57afbb0fa75fe3c
MD5 942801370df2665496cec77910ce54bd
SHA1 b77f9a5f480e5af94de305c00164cb1912016c79
SHA512 21e6dc6d2f0b7aa0c0a7dfefc7b313778a35b18dcf5d75075d6f9aa31f7a8bd306d1dea6aab6fbc14b60ad139aae83f28b84f8c5d0187e688a7bc18ea033c567
MD5 SHA1 SHA512

Submit Download

svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
Size 1.7MB
SHA256 f36005eedd98fdc19f24e7a202259a71bce6a4c8a827afe702f14ae3e0c2197a
MD5 8874383a305db76dffa0802a0ae34386
SHA1 f34acd17eadd4fe846614146f5760210e822f2f9
SHA512 aaa44bae27cfb4ae20b828c6dc3b327b2e95a9f8096d6c1c8624fa3c4b54d4d1cec36590de7b2a74b504ba410beb85fbc6becd2135da84d2d80be3770dc94abb
SSDEEP 49152:U+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl5:ykm
TLSH
T162853A45FBCD44A1E477523148AB82BA9A71BC114F22D6DFB344932E5E33BD0AE31726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCAAABABBBABBAAABCABBCBACCCCBBCCAAAABAABCABBABBAABCA.exe
Size 10.9MB
SHA256 9b354b3fa7e5afc77105619e4d41a00f7dd53a3466407b9cc58a103ae0b3bb72
MD5 5c2683ef6888ab535a4f8305726efe2c
SHA1 242aea9a35c44f01fae274d1011082adad6e0700
SHA512 3616d4ef5efa1576e744981134d0dbd08d28b466a74f240ccc51ee3eef8b332e68120dafdb4d6e8a94a2ca1fe999145c05238c770c6f875f9accc8aecbd4e619
SSDEEP 49152:U+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl8iw2J:ykkkkkkkk7OU/jIEeQfoR/IuOFVjUu5K
TLSH
T129B64B05BBDD4461F4B7123149B782669A71B8514F32D6DFB288932E5F33BD0AE31B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCACCACCBBABAAABAACBABABCBACBACBBBCBABCCABACBCBCCBAAAC.exe
Size 2.7MB
SHA256 f0b0a47804d55f1d8fb5fb20c251c0a4f80ae05a4af527dc03b5748c3bfe93f6
MD5 7d4a2d6117094562dae3e0933bbc3fc8
SHA1 0987521b5b300c52a5ffad6edcf41d42bcef01bd
SHA512 bbebc36d907b569e1846ec678ad3e017cddfbb4f1031f0c5b490d2da290d95ab09955851144f4f322b111298d2450e36dbe92ae14bf6657bb6f28fbdcb9e61b5
SSDEEP 49152:U+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatgl8iw2J+E9B+ES+E9oqatglN:ykk+
TLSH
T111D53B45FBDD44A1F477523049AB82BA9A71BC114F22D6DFB244932E5E33BD0AE31722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 30d4e1f2aa53ebaaee651b383e0953a11adf9db2a54f11810d3aedbfbc1cae42
MD5 e44e40559d9a18328bbd65244ab04311
SHA1 23467f62935b2f9d9711898e414e64d61263737a
SHA512 1855a0e09a14b99dd38a03895169979986a8f7bf8649366e8c9bc5e543396d85658fbcf974dbfb14802fe5fac710549fa3be2ecf3a6d7f3891a47afd4852c86f
TLSH
T1C421FF61E8E5DC73AC3268CF871EDBC20CB4768B585C6A94630A8028EBD9D31CD594E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 57cf53a60bfd6229660d52b38df06c2db347d6d28b2fad6a8b4aa0efa1b189d2
MD5 ee4256399b34a05eba6c9a3d2d5a5e1c
SHA1 fafc32cb1276960d2f4e0817651c08578d01cdf9
SHA512 ef4d3071374f62c6dd866ba6ed87312fec0825defd54d3bb65296460e4de88cf7ffbcbc77cf2528215f023531064e7e188afd727ed16905e47b9f842410ebfca
TLSH
T140210C31E8E0DC73AD32A8CB861DEB820CB4779F5C5C6A80630E8128EBD9D31CD594E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 713bad280fda22d023e5e9b2a38ba50be6ebe194b6c8b137075b1aa2a5adc390
MD5 23677f8195f172bdec96046bd89aa09e
SHA1 821638e6c946014a5051d44a045aa4032671432f
SHA512 9ae9747cf83f9f595e68e8a5b4d14326245fecb72835d649254e4123f3ff43d96bff94249ecc3cb60cd09b82ea03ab4b0817a0bfe2f9bace790609cedb6d900a
TLSH
T194112E61E8F5EC73FC3274CF821E9B820CF0768B5C1C6A84630E812CAAD9D318D994E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/296-69-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/296-106-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/296-47-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1104-107-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/1488-1510-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/5800-10-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5800-46-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5800-21-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5800-105-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/5800-68-0x0000000000950000-0x0000000000971000-memory.dmp

Download