728d87dc16347d7c8b2a41e1584ae944675e1a140990e53d1c4f00168b3c864d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 28.1MB
Sample260814-fffbdaveja
SHA256 728d87dc16347d7c8b2a41e1584ae944675e1a140990e53d1c4f00168b3c864d
MD5 32fe3324c72b512d73497e513b478666
SHA1 8d15935b4522e34386f3aa556204d7e3b3b42af0
SHA512 2c4f43efd738de75703a3678a407620bddd71addffc6476508edfb192c1a5cab6afe4d11c48d4357ffc7504481bcfec82266429be5011e4524411240e3c4d5e8
SSDEEP 98304:ghhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhN:CFIF0wuT
TLSH
T1FD573B86FA46C5B3D41A0232489B83F75B70B8151F16A79B7388A37D9F337C0A732695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
868	svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
3552	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACABCAACBAACCBBCCCABABABCCAACABABCBAABBCCBCAACAABCBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe"	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACABCBCCCBACCCCCCBBCCABCABBCAACCABABCBCABABCBCCBBCAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe"	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4336	sc.exe
2500	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5364	cmd.exe
4100	cmd.exe
5084	cmd.exe
5812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1452	schtasks.exe
552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
868	svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
868	svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
3552	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
3552	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
Token: SeDebugPrivilege	868	svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
Token: SeDebugPrivilege	3552	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3464	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 4100	5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 4100 wrote to memory of 1452	4100	cmd.exe	102
PID 3684 wrote to memory of 4764	3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe	103
PID 4764 wrote to memory of 180	4764	notepad.exe	104
PID 5856 wrote to memory of 5084	5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	108
PID 5084 wrote to memory of 4336	5084	cmd.exe	110
PID 5856 wrote to memory of 5812	5856	2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	111
PID 5812 wrote to memory of 2500	5812	cmd.exe	113
PID 3684 wrote to memory of 5364	3684	svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe	117
PID 5364 wrote to memory of 552	5364	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_32fe3324c72b512d73497e513b478666_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACABABCBCBACCCCACACABACACABCAAABCACABAACAAABAAAABAAAAACCACABABBCBCACBCACBCABACACBCABCAACBBACCCABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACABABCBCBACCCCACACABACACABCAAABCACABAACAAABAAAABAAAAACCACABABBCBCACBCACBCABACACBCABCAACBBACCCABABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe" start= auto displayName= "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe" start= auto displayName= "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAABCABCABBCBABBAAACBCCACBBBCCCABABCACCBAABAABBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACBCBACABBBBBABCAACCAABBACAAACBBAAABBBCAABBAABCABABCAACBCCBBBCACCABACBBCCBCBAAABCBCABCBACBACBBBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACBCBACABBBBBABCAACCAABBACAAACBBAAABBBCAABBAABCABABCAACBCCBBBCACCABACBBCCBCBAAABCBCABCBACBACBBBCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAAAABCBACAAACCCBACCABBCACAAAACBCCCBACCCCAAACACACCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f8348be550a9e63ecadf9e4a1f46e23d7f53e1562a890d0b738fc13cc0932ea6
MD5 282487e196724d2d5b950d6d5d19889c
SHA1 8347bb23e54a9cdd540d34dd7d27ea29eb0fe81c
SHA512 c2508e68e2e01d5f25a298b6d092d0a0e32c373904236f68d158044426616c77256382b4f7600d76a9776657ec584f3f36114cfbce6763c8992b59dc29384818
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 28.5MB
SHA256 6a34fa6458e59ae31a9e92e4299fbbfbe84cea7cfc6b0be764f1d7c76af614ff
MD5 3c6adb19ca5ba0822edc2383a7432062
SHA1 29dc2198ca0a78d800eca7c9f55631ed22c65600
SHA512 f629cef2201d09d00057ca5274d1570c97fcbe848e056271bcf6222207c202ec894d94f03d5cfc6290d398929cc909bc3a8a15a972a217855e2cfcf13fc445e2
SSDEEP 98304:ghhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhL:CFIF0wud
TLSH
T156673B82FA46C5B3D41A0232489B83F75B70B8155F16A79B7388A37D9F337C0A732695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 3948383f8dc96f18cf34053632e4cd2803b561c7fb2fe5b73ace6ba34eb71131
MD5 04d4316673d53949c449852a7d3ea618
SHA1 8fcfaab486493f7f705be96b71688296ee7f1687
SHA512 29148014e8ea8a3e7a4ea1023106a6c5e88a720b92e4ee30ec14e4b88651c91c4ab69f0181b4ab4eb8afa6f68d44f3e07011111b3f894544d0565240a7898eab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 a9b8878e98a61b88d7b2b190291ef17756573ce0d0dd9de6ef67c672cc4adca3
MD5 653fa6c3d5769df2c0f6a09b235d8d7c
SHA1 bddf0f88df4362a19129a78e2de4c1efb3b580e8
SHA512 3df6fa336a580c287aad84d748bed2466327d2648a0ce14d094ca83633eff1df1234252e6f5c4ec0e5346ac2c4a75a3491e03dec9064a76a9eaeb30261855a44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 884d0d9c8308c67c9ba62f9dde0a34b7d2c392c1217098affd86e97e7065ce72
MD5 1db58f04b89d9a22447f1a16de801e58
SHA1 6cad43c22f42d0d1eb84fcff18b03f43dad8d4e9
SHA512 5bc285977bac992b102e8953c550bd878c98259bf17ef755c1fecdf6410483c6c2f542ae9bd35e24a17a6a70f3f746b8c7d82ba9a8601073f227dee1d903fb68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 3138e5513806fb7fc3c30d4066bbd30ba0d72253452bb8b8280e743b930fb461
MD5 7fc242e1162622dcbdbe9d1dc30ef9da
SHA1 2eed001b765c314f702816948c94be26f4a48e4b
SHA512 f604e92fa3f9f55bac1846eff30f2d12f41b5ae7c343c2339b61c6f8d93059e3fc8fa82527c5054692b84ed52c8dfabe4cf907273dc34e2b0b1bb7faa4d40e71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c04e28029f8c2b3d7d4a662fc1685e0e46915c53fc29cfecf0f7d80ff5f7b629
MD5 558a6e5c6444decf1835204ddbec0d23
SHA1 206e5fd3fd94c94c94155f1ddcae5a12c71e7164
SHA512 7265834cbf7da4be862e3d32ca9496d30c6afb284d2c3b28141a34a57d5adcd738a1edf51f729e254764abd18e408af42f2685a578937012592a441509703a22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 6c2df02fa04243ddf65bc63086eb1b0924291d2d66435960f404f52712f3acef
MD5 0053910ceeed709fea34268886842f89
SHA1 e0c594cc55048fab2d1643e0dbfeb67221b64b2e
SHA512 a869e04a1dbe2c94672bfc2d58e1803004f05bdebb7b3cab558c3f111c4c2b02f71e4d169d2beed3ff69cfb829f5cefd623c9c03a9fd9bd6df0cf6d039291cbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\PlayReady\Internet Explorer\InPrivate\qap`g`v~dtlq
Size 10B
SHA256 739d158dc718f6632659dae74f7b477df3e38e32daad6ac179bc6044c473815b
MD5 cddb6ecd08e77a9c8d0e12f23e8305a0
SHA1 f5fcd2b180227a22a47f3754741ebfacd87c6e2b
SHA512 55a4a354eebcc2c6fb70416d0e2875b98366a24771dacac80bee7aa8626152aee5ff415dbcec30c79555b2f930a8e1962c09860ddfec9461f3557e5328f4e729
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 c5f5388f059c999d512450f68625b6cd2f615625800e8dc6e633ed7f2e8b960b
MD5 66b3c7ab0eba52f4b33fb2abe5baeacc
SHA1 b047146f139cb64362f8e67ec76fc90542162508
SHA512 e2aab1721a22ca592c87f0aeadd01ee4d42e0c260bf3b5f466a2b961258f93dde24506f935baca421e70718704e6ca917191776d42de62b1a4572d73537afb03
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9aa7ec8628992810918d14b98d035eaa819ca1975faf14f93795546def9b53f
MD5 ee846d54c96af3407a13f7c3b2e84dda
SHA1 31dd2680abc432c99d0013846877ce9108c6aca8
SHA512 142c64b21cecd02aa144657bb82610a13de60d504af3c03e14938abec62985af7e39b5d0b146df97b821630877730208af7eb8e9422e2a8b5858fa14e67d770f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d491f71e67048fe768d1b79946e27e095173ab200f1204102a271f7b5e33bfe
MD5 1b5e1a39140398b2970f2a3d99bdf0c9
SHA1 f817cc5514dc2c13131d1b199f427c155730074b
SHA512 9b801efd23b688cdc00fa6ddc0660afc0e7f1758f43e968eebac4591fb280a0c363316e2d8bc2e546cc0fcd069923aab1ad966e8d3e6f10f308637f5c95732f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8066cfb27cd0878b6e26fea174da6f0fc4ea0e951b36b50e47ea2ff90f1732e2
MD5 dfe2c4f5e570a66a3f29d67d3e106eef
SHA1 0d284ee6c0869edc0f5d54d5aef71fb0ef4958c5
SHA512 2c6c14b64b43fb3e9d1f656b763b0a03c5eaacb623282f5a000c1de487eb13f683812db2b61c9b5289362800e588e30467dc0ab7081fe1894704d7b13fd0777a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6751a9ddd46fe84af811df09e8607af5b5e621d7e9a3058cbb26857c5e3e0ce
MD5 5f649b198fc2db2ae76e5a735d1ddb43
SHA1 7c1a55fcf0cf964f7fe3cde6dabc2adbfc8852ce
SHA512 4e62e92517daf3c7524f9a9f38604ddfaa9c78390db1d274bdf96f833f2cb6942d3f9fe5c787d20bed84c6e33ef884b935ccae83ff74551d9597b248bec2dd41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 57a2cb3dade91d2f238d9a574c91d1c234256b773c365539b54baa1f5a790e0f
MD5 28920ced71d2743ba856703b98763b81
SHA1 fc8f2fbbf9710e35d32d32245552406c283540b7
SHA512 64d4f74bef6f6326bc4a34bab76c4fa7701f3fcb8b89972bb5d35de17cb0ec1d4c2f2b21c730a7ebf23ebf013e73f7413fad0227b44524e6cf2dc971a8a6310f
MD5 SHA1 SHA512

Submit Download

svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACABBCCCACBBCBCACCBCABCBABCBCBABCBCBACCCBAAACAAABCBAA.exe
Size 28.1MB
SHA256 728d87dc16347d7c8b2a41e1584ae944675e1a140990e53d1c4f00168b3c864d
MD5 32fe3324c72b512d73497e513b478666
SHA1 8d15935b4522e34386f3aa556204d7e3b3b42af0
SHA512 2c4f43efd738de75703a3678a407620bddd71addffc6476508edfb192c1a5cab6afe4d11c48d4357ffc7504481bcfec82266429be5011e4524411240e3c4d5e8
SSDEEP 98304:ghhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhhhXthhhIhhhN:CFIF0wuT
TLSH
T1FD573B86FA46C5B3D41A0232489B83F75B70B8151F16A79B7388A37D9F337C0A732695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 acfa95b7f260bd4cfea7ad697dbe38be0859aeae51d62e23799a4c0b70a2d918
MD5 58b0ba3d81fc436c1db2b43be15212d9
SHA1 24ead6532e946c61ae2de7ac40b09d053264aab7
SHA512 f3c7b301f6af2ccb9671584f162ecc90496a9293fdca6e82517b0ce177c60da42836e92b4f32d81a4a2a35d8bfc20d003858bb164996398e28886e0dc1008215
TLSH
T15B21A86168E5C833E933ADCB911DDBD21CB0B68FBC985A04138C82286BD9D35CD558D5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 fceec4287d54179130e9031f648c6d034349e2396530e9b9cffe0fd508438341
MD5 f844ba237115afcc8d6c2bcbac81c94b
SHA1 eb0c1ab20befa4bdfe7616e108ff28e0f3a4036c
SHA512 56a44669b569a13e1530e3ca4f455e5ca69e0549edc5ea043e9b692d33e566e23d8a6b190688afd5c987df69d5571c9d1330a5109cb8bf644481db7b35d8456e
TLSH
T19B11B66068E6D433F9336DCB512D9B961CB0B68FBC586A04238C83296B94E35CD51CD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 51a6570617784db75a116a30ccf320529c6428d054fd628ea74515c1ea869a8e
MD5 dadac38fa35fd1c98b561a11ee21b59d
SHA1 f7260b2aae98365bee671424e8af366a7bd0c7da
SHA512 42f812ab5db6f68a3beef3b595011e0b818245dfa0930f7824c4799607a2adc11e3a44ddb0f6396a96ef4292bccba2be83bfc0e0435bdaff3d3741102936f41b
TLSH
T15921D76068E6C833FD33ADCB511D9B921CB0B68FBC586A04238C82296B98E35CD51CD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/868-85-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/3552-1729-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3552-3011-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3684-33-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4764-57-0x00000000059C0000-0x00000000059C1000-memory.dmp

Download

memory/5856-6-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download