e4453376c0fbcbbfd22408226fe21dab0c2767d00110cfc37abb3273a7bce52d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 6.4MB
Sample260815-etwpvaep31
SHA256 e4453376c0fbcbbfd22408226fe21dab0c2767d00110cfc37abb3273a7bce52d
MD5 3152dbcb7765340e31885bb84d5d10fe
SHA1 708dc34d05733e00e711b58532d9f0f1b2adb44e
SHA512 425d9facc992c4a415d23f8da17a4f83cc81737a4a4d5299de9d05043d27a659ceaf5646b9ae8a8059951fab102fd2183514f16299dbee83e3a9dae0a37f3aa1
SSDEEP 49152:U+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqat6:+UUUUUUUjOU/jIEeQfoR/IuOFVjUu5b
TLSH
T1DC665D41FA8584B2E477023148AB82B75B70B9554F2296DFB38C536E5F337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
3548	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
3492	svchost_CBABABACCAAABBBBCBBACCAABABBAACCACBAABCAABABABCBBBCBCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCBBBCBCABCACBCBACBCBBCCABCCAACABCCCACAABABCBACCCABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe"	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBCAACCCBCCCCCBCBBBABCCCCCCACBCCBBCBAABCCCACAABCABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABABACCAAABBBBCBBACCAABABBAACCACBAABCAABABABCBBBCBCBB.exe"	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1508	sc.exe
1132	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3284	cmd.exe
964	cmd.exe
2976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABABACCAAABBBBCBBACCAABABBAACCACBAABCAABABABCBBBCBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
3548	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
3548	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
Token: SeDebugPrivilege	3548	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3284	4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 3284 wrote to memory of 5408	3284	cmd.exe	93
PID 4656 wrote to memory of 1448	4656	svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe	94
PID 4480 wrote to memory of 964	4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 964 wrote to memory of 1508	964	cmd.exe	97
PID 4480 wrote to memory of 2976	4480	2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2976 wrote to memory of 1132	2976	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3152dbcb7765340e31885bb84d5d10fe_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABAAACBAACBCACCAAAACCCBAAAACCCABCBABAACBABACBBABBCCAACBCCACBBABAAACCBABBABBAABBCBAACCAABCCACCAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABAAACBAACBCACCAAAACCCBAAAACCCABCBABAACBABACBBABBCCAACBCCACBBABAAACCBABBABBAABBCBAACCAABCCACCAAABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe" start= auto displayName= "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe" start= auto displayName= "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCABBCBCBABCACBBACBBCCCBBABAACAABBABACCBACCABAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABACCAAABBBBCBBACCAABABBAACCACBAABCAABABABCBBBCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABACCAAABBBBCBBACCAABABBAACCACBAABCAABABABCBBBCBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a89a9ded5977e2aeb1d0049dc2a8126e29c6d5dfed505f075f0d1225b9a523f3
MD5 4029ec273930c9c9e1d931b7e2b4fcc2
SHA1 2829e9d9e08870d65acadef6d693635b98ae4baf
SHA512 dcffd389679caa3a2334916c459b30d138bfe338c9c882315be500eec01a8145489b49355bd4fc07b2f01cf9bde71e508dce54f89a0c453c5abaf1bf48ae47fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM\qap`g`v~dtlq
Size 10B
SHA256 3a4fc278845354c1fd253960e308f2a2b168cf95fd34950db019452b623e4aae
MD5 a5929ed925a73638e4786657a28b49b9
SHA1 6ddbbcb3669114fdf4b804644e620c24fc750a09
SHA512 af91ee13a5b0e1408839cece32451b9b85ebd65b68e4398713458e6da9bb7cef3f3248e7b515abdaee029c1353e056ded214438003cbf2001c95ae681171f7c3
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 7.0MB
SHA256 bc228c9728e8769de160a3f04cc38049b0789f33ba641a491deb40fbce2abf34
MD5 d608826836946a89ed8c1eb141cc3f1c
SHA1 545d1159de10116a65a23501d7bcbd23f6154ccc
SHA512 617721f7e5a12614e0074047b188bc27cca136fbd70765c9e2d65144b961619d30833541fa36b64cb43f9cb2e2e8c87be678ca92c76a35633dc418a272d1cc47
SSDEEP 98304:+UUUUUUUjOU/jIEeQfoR/IuOFVjUu5+gZ2Hb9t+2xB:xFIF0wuQgZ2jB
TLSH
T156766D41FA858472E47702314CAB82B65B70B9554F2296DFB38C936E5F337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 691b4cbe2f13dd261c6726c7a852ee96badf9911dcd5515eb663b7ca8bf226c3
MD5 73a452edb7fabf0b0555c9d3a8d909ca
SHA1 2ed510ea58fa3c7e8b1c89e53972f3e2ea83c585
SHA512 6ea6bf97a050cfa6a06c6aff48badaab0ad207742061d606bad2b9e2c5d11f20dee66e778757500f481d9b066c1f9614c2436749f3f74e2e585d1a9851b7a6e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\qap`g`v~dtlq
Size 10B
SHA256 d46cbe4ac53f078f79c3c842293ca4793809311bc8861c3925d0c978b171795f
MD5 ea12883581d89e8615b7f123c2df832b
SHA1 f01ac84a13de316dcf8946aaf4a62dfdd4201f5d
SHA512 f0ea6ccf9b1972ee5a43ffbdfa6783add63105d607dda4c535614e7e78de8645933e113b6af2c04d93adcb89365f9cb269c05b3022512c3630bc0f29e97216ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca-Es-VALENCIA\qap`g`v~dtlq
Size 10B
SHA256 2483f084ff8ff2df53deb9684fc29e200d064f317759eed80fe1f68137f3914e
MD5 f052b6f734a1b1a2ae13ce0d50f274af
SHA1 41fcee7ccc8f4719a709c8e33504bb70539880ef
SHA512 9ea5c61a413048ca9a60356fe9a1a23e7a951bc97775ceecc010446d65b0ca9407edb1d0a2343d6e8dc62ea65ee8ce1941e65f4c19fbf54cbe8b5e3f9b0a8c18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53e1bfd4616f69be181e32d67192387abcd86bdeba26eb2df1fbf4c7321e480f
MD5 2c8f226c417d50cb0a7663ec96c4d5bb
SHA1 b90ddbc4b453f0be77effcfe20fb56aa1013b6ee
SHA512 51d6baf0a44bd4d9e82f43ac564b33469752e3b310b8b58ca02f775a597165703f12b40321828023192753622caf06b99fed7fa399e26ccfda8a87cb6a420abf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f937c18033f6976a49ff051178c473890a14af36e367458e7855b96fb07b689c
MD5 3dedf1a784925f6a3e57856e6486e9fe
SHA1 cf8cc95dfab9780ea6783f6c050b79a7358fb9d1
SHA512 4a637ef5a17bf3a2cede46c752e4facbcae96c0e1bd169ade1316c3a2a02fa1a066cae2662b2622d19f1c48d97a04ee90d59e29288229453223a0b509d1eed50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee00bcef6ae6ad2ac85a9fab5fc8c084b76966c5c697c4a5de05c05891b15a15
MD5 2094cb48b869b1512fd37b09782a4855
SHA1 f10af5bd2b73e4d7a0ec3c52feaacfc3b517bae6
SHA512 61506fe9e1142659e24450d139a386aae84572cd4969e0f6db9e1ce870b7c191e6a90b3835512c18a73fcc020ce2e75278fb380686c3c6659b6befcf25cb0b74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9009c387629a241206ddf48402b279da218f2e50ba9939dab5f42045c0760302
MD5 58e5672382fba365ff98c39097905446
SHA1 b4e2075ae925759fc0eec1b495c2f290c9bf3291
SHA512 29ae1eb70ff9bc39cc8871cc3c4fc6b19bb5755a9706dcecc51b66474850da84662b48984de7a69f81199e9c77efe5e47c29db699bc90147b7e883dbbad08d9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73940d55f6d0afa70d59486c25e1b0b9aca947bce2cefb59b0db88d7e4a37dad
MD5 b77fa5fd1f2620a0f1c932c86a91584f
SHA1 c6e87bf7206d9c2a4c0ad811ec02c19de06b91c5
SHA512 366509646b19dc7229e0476994fe42c6d7d8ac1ea804cad58fbb39bf1245e772644d27a58f0dd1f19e4e314c6d3cbde996686765ca0efee96a656a6825194dfc
MD5 SHA1 SHA512

Submit Download

svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCACBCBBABACABACCCCCBCBABAABABBBBAAACACBAACACBACABB.exe
Size 6.4MB
SHA256 e4453376c0fbcbbfd22408226fe21dab0c2767d00110cfc37abb3273a7bce52d
MD5 3152dbcb7765340e31885bb84d5d10fe
SHA1 708dc34d05733e00e711b58532d9f0f1b2adb44e
SHA512 425d9facc992c4a415d23f8da17a4f83cc81737a4a4d5299de9d05043d27a659ceaf5646b9ae8a8059951fab102fd2183514f16299dbee83e3a9dae0a37f3aa1
SSDEEP 49152:U+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqatglR+ES+E9oqat6:+UUUUUUUjOU/jIEeQfoR/IuOFVjUu5b
TLSH
T1DC665D41FA8584B2E477023148AB82B75B70B9554F2296DFB38C536E5F337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4735267dce6c091e21699b69cd0008cf216a11a9fcadc017d84d6bdf63c040cb
MD5 55e114c221cd6f7090d0d3ec251389ab
SHA1 69710f191e539970f5fc49754c395162683a9d8b
SHA512 467e4bd7ab6a090bc4b75f13f1c9f3619c5ec3e48f03495c149f079837828da9bea026d0f676580bfcebf6ff0acc2434e15643d63b6bc98effab71531bef9bf6
TLSH
T1D711EB62D8E5D853F83228D7EE199BC209B8399B986C6E143246421C77D9D32CE554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3492-71-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3548-66-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/3548-865-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4480-6-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4656-32-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/4656-22-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download