89a02b8781a5cabd852a060b62695bb6bd1560019630f738823fc5d3e8e7bb55

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 8.8MB
Sample260815-b5c54axtfs
SHA256 89a02b8781a5cabd852a060b62695bb6bd1560019630f738823fc5d3e8e7bb55
MD5 27c5cc02bf0067cf3f86e006de08c41b
SHA1 4c6f3f1f92608e8e2741a9d19a3046f9e7f8b7a7
SHA512 6113d6b46cdf1c05e6b41d4b689e4cee967e26b313ae5c8c26b2ba3c2fa128e9b5a3a27e7a936dde94b894a480ed4339426d9ebc92c812b6eae8acc55cb0b303
SSDEEP 49152:U+E7+ES+ES+ES+E7+ES+ES+ES+EX+E7+ES+ES+ES+E7+ES+ES+ES+EX+E7+ES+Ep:FOU/jIEeQfoR/IuOFVjUu5f
TLSH
T1BE965C05F98340B1D92B11B04CDFD3BF8A60BB2586228DFBF74DCB1B6A32BA15439655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
2336	svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe
4132	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCAACCAABABACBCBABBABCABBCABCCCBBAAACCAAABBBAAABAACCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe"	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBBCCAABACBAAACABAABBAAACCAAAABACBBCACCBCACBBABABABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe"	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2380	sc.exe
2764	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe
3464	cmd.exe
1404	cmd.exe
1088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5888	schtasks.exe
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
4132	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
4132	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
2336	svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe
2336	svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
Token: SeDebugPrivilege	4132	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
Token: SeDebugPrivilege	2336	svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4784	2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 4784 wrote to memory of 1704	4784	cmd.exe	93
PID 4976 wrote to memory of 2660	4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe	94
PID 2620 wrote to memory of 3464	2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 3464 wrote to memory of 2764	3464	cmd.exe	99
PID 2620 wrote to memory of 1404	2620	2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 1404 wrote to memory of 2380	1404	cmd.exe	102
PID 4976 wrote to memory of 1088	4976	svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe	105
PID 1088 wrote to memory of 5888	1088	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_27c5cc02bf0067cf3f86e006de08c41b_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCABACACAAAACBCBCCCACBBCBABBCCCBBBBBACCCCACCCABBBCAACCACABAACBCBCBCCBBCBBBBCBBABBAAAAABACCCCAABACBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCABACACAAAACBCBCCCACBBCBABBCCCBBBBBACCCCACCCABBBCAACCACABAACBCBCBCCBBCBBBBCBBABBAAAAABACCCCAABACBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe" start= auto displayName= "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe" start= auto displayName= "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBABCAACAACBBAACCABCBCCBCABBBACBCCCABAACACCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCBBBACCAACACCACACBACCABABACCCAACCBABACBBCBCBCBBBACCBCBABBABCBBCBACCABCCAACCCCCBCBCAAACCAAAACCCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCBBBACCAACACCACACBACCABABACCCAACCBABACBBCBCBCBBBACCBCBABBABCBBCBACCABCCAACCCCCBCBCAAACCAAAACCCBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABCBABAAAAACCCBBBBABBBBCAABABCAAACACBCACBACACAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3127933f836194e34497e439b5a3a4111bd3d59e49c19bbffd21638122dac567
MD5 64494ed4b374dec5ab04e1559fd4a9fc
SHA1 cc2ed924b373c67d477a0c7ac11ed129664a3096
SHA512 5ae69a73a24424ee81d9934ce35cd9f5b07c270383e27228fed283dd8e06af2c404907caf6701ad8856553791610553e5e0f00a836bcd6d11f883e0882bbf185
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\qap`g`v~dtlq
Size 10B
SHA256 3c80de85ed2185583d67467d21611abea5fa5457ba5226ffed834d2a3cd87b38
MD5 ce753f503d0e801245c292067cc36088
SHA1 a2419ad86a8d1f019e29d15e7ac74a48e1516f94
SHA512 00f35b0ddde22cea367e0cb84096ff236dedc662762ec4870346e15e08e328d8e6f43a4d1c30083518c1c7e9fed6c25f99f49bba72b4fe23a8a7745dca92e9c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrccache\downloads\qap`g`v~dtlq
Size 10B
SHA256 87e136fdb74ce65b34ae79afca82d16939d0ab45f2f90a6a70e97c2e4ee2750a
MD5 354e1add0d045c0d3efb426018c7c366
SHA1 936212c5424018c8252713c0ec3d477280414499
SHA512 34606f62e03e49da309b37f2ad39ebd32805b218dbf9e43308007585bf71e314ec8223ef430769a5ea1ff5dd45fcd7cd9d5cecd321c57a84745b31d10160b6a4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 9.4MB
SHA256 c2ab7e5f146c93eece0ea5333050cd630b71e904cf56acc7decb347f95933b32
MD5 6dc3a347bb9214cdb6b05370995a3824
SHA1 8b51ce35d6a83f1cb77ec4aa4af65f9a8d7eb4ce
SHA512 b217dc9fb21d4a814fb06f19184c6c2656c9a5f770608aea1f4b4658c4cceac38b5361ee4f085209fc1fcd4d255a99ec37d218880837376c374d2a6cb2b23f22
SSDEEP 98304:FOU/jIEeQfoR/IuOFVjUu5SgZ2Hb9t+2xu:FFIF0wuwgZ2ju
TLSH
T12AA65C05F98340B1D96B11B14CDFD3BF8A20BB2582228DFBF74DCB1B6A32BA15439655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 3f6d021b27a4a0d4b9d74ca5f5181b9f455e94a9816ca875cfc32c1a111fbf5a
MD5 86c97a677e6d9bd63fee18024e8aa284
SHA1 0b7d0f53409dcdc8f1beba1d1853c0a3c3bf055e
SHA512 2844505959deb3846e157fb6462977cd73fde81d642883c32213b2166629ba9338269fc1d6f6e5bcc6c14815896e0ce5c4a7234b59491e527639368c2b66ef56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 ba788be6acbbbd3264bc0f6a0c63425abc5cf5d5b5d9864886f34be239e5e440
MD5 d08aac6af21dfadcc9730c78686251d2
SHA1 1f19ffea28c8f0761ddcb82d510e4ccb9ec7d156
SHA512 54b3d836d59d21bd62abc15414ddf2904983d9f7faa9cbf7d3b98ba23d1e98a897de890d306738f2bbe5ec10cb9d90b5d03f40d9349f080207b18be75f55cdf6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\af\qap`g`v~dtlq
Size 10B
SHA256 121dd87506ee48b651a07f5030b3ce2fbe051770dbabeb960702044d467f8d8b
MD5 f5e7624f2182bfe01962df64b4c2cd2f
SHA1 3a42e76c731d00f4c93d88c49820dd8c2810fed5
SHA512 4b6cb0cde8facf20d10c1a3147a2dfd5736cb3441b780423622645ddb14a2b76047d4dfd150ea73bdc1897875e4a5096255e81f53a6eaa901af3a329dd083005
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 68825343c45eccafb2454edad8e402b2d33c1933bc6902ae84d93b9bfb334cff
MD5 6fc7d2f39254ed4bb42ac168f33567aa
SHA1 2bd876cb7607b2a2cdfc484395490ffb06b15356
SHA512 78e24571482ebc4ca83aaf3d5410946c34f5752efaba1bf1cee74793d48a62b249c477130a8a35594cc00c39cc7201224faccae5e85566233d966cad03194f83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.UI.Xaml.2.8_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 a68cf2e9ef298a9b9d7987a2488ff4720b88bfca941061454f3efe4f00deeb9f
MD5 a79464cf2254145f43f97780ff0ccb33
SHA1 c66e2e1f4a4649ecc25cba60b7bcc16d0792daa0
SHA512 d2bc6854550e01ae662c80c658aa72fd2ead409cc2b14c64fe5beef8ede0c3a41c635928d55007036ff83d19670a19fac3b8f984d8fae83c39e16d33e23288a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\qap`g`v~dtlq
Size 10B
SHA256 700b2399e4f03cd89ed97983d5e0ee83e16c8372a21138efe35bc9e971620865
MD5 38ec5e47e91d9264929318d2a8f6f3ae
SHA1 9e2612c1f5eaf4eff2cf39ec88aad9ca93d7cb31
SHA512 a576be5a30eb0927ca1996bcf4b219d8e5fa19dff24b657efa096465c832b7079e55aa2351a069b1f4daa1cfbbf1764060426e99c300f3404b853ad82a3e2559
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e353621a049353013e3b2e7af4e7bfccaa21aecb7ba8f1539d2fdc11718c3713
MD5 c28851c93816329acbef92faa64ea78b
SHA1 2c8696a4167c228314926335df10f6b020c7c7a5
SHA512 cda818867f1c34e6b7109a388ed4720d304a06dd2be9b5b75200bb6ed311b669b3ef2fcf355cab35e2f8da3f6b7660a288bb2bd3d16c07582d3dd3e0fc31654f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c167152828e2f037e152e733ce9ffae6febb7de55a63afa7340ee81f0aff27d
MD5 098f8c57b6f47ae324c1bf15a63cbd5d
SHA1 98b227392f921e177ea1a343ef498f87eb3af14a
SHA512 148048af187fd531f32bc56cbf811bd6c9a0731170d0c1d698df5302c4033036facb750e70b33450244874e95c826def8b6b01bd48456a36660ac45f80ab9ee9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12f6787bd38710c2bd90eb1bb261d4c87a73b1e411b0d47b690bed994b438a3b
MD5 35b23c0c5f9ca006bff6085b50c7d881
SHA1 7b94eac98e9c4f36b19db3de7537f865caa459d6
SHA512 c4ea240f65eaed769d9e0ddf54dfde246b2670fb22cfc0724db7cebc051a0f788e1f997ef504a6c763509f94a08809654a8d7c1a025d96c49aabb8dc140db414
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b91d006782a5de359837d1b1db085a9271b137705fc691c01a63f9a14804d2fb
MD5 2cbb0634a2286c2ab9dd051fa9f3d220
SHA1 a2cb94907b1975a493454571e429147461eb5103
SHA512 975fd34cb1b780541ace5df991a91ce9d9b47be289cd25c8d53b85751291943ae68a88f64b602fd07d7e7fe616dbac810ac9255ae3016d1c090d1a7491faa3c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f757b7a6c46a2d380524ece262526dfe9f8c3fd6a986c2d2de3559f664bbbae
MD5 01d754c0a4331361b4d43faad7e83cec
SHA1 fb31f7eb8f13d1f4307a4f2840e91f707a1577af
SHA512 f9bdffb581761fa0642c5eac48bd00baa36067f39a7e1e32a79078c7aac91619ff0a64b62d1eea0eb9778597018ee399a631a103b7c253bf14d8d28477f41b9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e0714fd329487fe3123b29347f14c822c17b6bcbb52214fe1df3a40117f720c
MD5 609888e8370d7782236a368d69f14554
SHA1 de3b7901a91ea31dfef84913ce7c258c8c5b431e
SHA512 11c6af1b7d713244000c4083f1e696c4c6ba447f30977d6f6c01cbd6f8fbf408af736dbb5921b4ea6310668432573edcee49379e4485a34c7e030b9d35b049f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1768b83f300ca46b37e66a0336bc649896e6b419f8c8797a80af7ca3cee210b3
MD5 8e5178bbbd21f7a6a675d69c33f8593b
SHA1 b28573b9a9c90a98d129d438a1872260d6630501
SHA512 d8f633633aeea4d4f24af77272ab5e7d5ae09556f94b7ef8aa161fa8caf511e1afc1f24dee9b7c470bc3fde72a035827376425a998a79819b44d431fa806db07
MD5 SHA1 SHA512

Submit Download

svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACCACACABBAABCACCCBCBABCBCABCACBCAACAACBBABBBABACAC.exe
Size 8.8MB
SHA256 89a02b8781a5cabd852a060b62695bb6bd1560019630f738823fc5d3e8e7bb55
MD5 27c5cc02bf0067cf3f86e006de08c41b
SHA1 4c6f3f1f92608e8e2741a9d19a3046f9e7f8b7a7
SHA512 6113d6b46cdf1c05e6b41d4b689e4cee967e26b313ae5c8c26b2ba3c2fa128e9b5a3a27e7a936dde94b894a480ed4339426d9ebc92c812b6eae8acc55cb0b303
SSDEEP 49152:U+E7+ES+ES+ES+E7+ES+ES+ES+EX+E7+ES+ES+ES+E7+ES+ES+ES+EX+E7+ES+Ep:FOU/jIEeQfoR/IuOFVjUu5f
TLSH
T1BE965C05F98340B1D92B11B04CDFD3BF8A60BB2586228DFBF74DCB1B6A32BA15439655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 39ee142f8855086ea0cf375d741e603f98f60675155732459ef7344555978bd3
MD5 71a463e2a5ad398b00e3d274229ac10f
SHA1 2341456061a1f956d02f3b8bbe3ab86e8352f470
SHA512 8919d902591ab966ee6a5eb4c648aa1c219172e981179183582734ce5b2479d1a7d2668d3ee7de2dad0fc0032b5e070b5515fd28205e269a1e1652c359f5c941
TLSH
T1FD119F20A4E5CC67F93328CB9E29EBD25CB83A9F9C9C5E54230E4219A79DC308D194D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 145f8ebef80aafdf9ee55433dc7076468d93d7a8c112e70aa0d8eb5ac6dc96f3
MD5 24c7ea9a947c5e927e05c796291c8ea0
SHA1 b0ec3c90cd186e33043f706eefaf91d0603f2406
SHA512 527bcb76a516bef86d2bbfc5411a0d1dd1c5b28d86bf9bfbdc4c3ebea7b0f0a7eee6d37e20dbcd4879a67d3b3fa87d99e009aff3efaffc95d005658426ea315a
TLSH
T1E121916094E5CC67F9336CCBDE29EBD25CB83A9F9C9C5E54230E4219A79DC308E194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6ce4cad33d77fb93d12e1f4d1f4b4b0c854002a6b47ce8227c8e481506de6e74
MD5 cac1dca4eeb90095335ab6bf5b571350
SHA1 dd7098a1fc2fa66b0a00105f26c168e0d81fbc58
SHA512 5374d3365c32c94299eef514e55398fe5e8df2b9768b90e2e86a356e82f9b883122ee2ebcf4556b2193cb978c315a3d9fe11693c78c89e3b35a9839297044755
TLSH
T1D911946095E5DC57F93328DBDE19EBD25CB43A8B9C5C6E5423090219B78DC308E190A2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 90461cf426cae1e4bd732be878ca1b6c310dabf1945a70d1e5a9aff63d15b63f
MD5 ddad92b19b54a67eb03519309aa3d03a
SHA1 aa35c4fd73a49dc606a4b50a87fdad5efd67b7cf
SHA512 c88c8fb8c52dc6f06d4c9d7d53c89cce3e7e5ef01f9ec75e4ced08e9e14c59c3cd0be688fe29e3d112285335717c5709c38acc1406031a8cdbdd789ce0ec0642
MD5 SHA1 SHA512

Submit Download

memory/2336-70-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2336-4062-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/2620-6-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4132-2374-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4132-4064-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4976-32-0x0000000000600000-0x0000000000621000-memory.dmp

Download