1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 5.9MB
Sample260816-falafazdpc
SHA256 1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684
MD5 4bbd8d1d8d9f960c32b277539b4fd112
SHA1 3a4787bf2b0c2c5df6d58055a5c6702812813696
SHA512 91a4f9e2b0cafacc628a5af6a427ec11206b175260e736f03535120e79147ef245979e1e05e4493dbbb7edca4dc0079fbcc6ba9e575bd5bd0bce35d7d3f14a25
SSDEEP 49152:U+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+E5:vOU/jIEeQfoR/IuOFVjUu5v
TLSH
T18D563A01FAD94075F4B752705DAAC27A9530BE658B22C9EFF24C834E5B32BD09E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
3356	svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
5924	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABAACBAABBBCBBBACBAABBAAAACBBAACAAACBBAABCCCBABCBACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe"	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBACBCBAACBABCACBBCBACCBAABAABBCCBBCBAAABCCCCCABCCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe"	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3568	sc.exe
1232	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1308	cmd.exe
1152	cmd.exe
268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
3356	svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
3356	svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
5924	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
5924	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
Token: SeDebugPrivilege	3356	svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
Token: SeDebugPrivilege	5924	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 268	3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	91
PID 268 wrote to memory of 624	268	cmd.exe	93
PID 4872 wrote to memory of 2200	4872	svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe	94
PID 3368 wrote to memory of 1308	3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	97
PID 1308 wrote to memory of 3568	1308	cmd.exe	99
PID 3368 wrote to memory of 1152	3368	2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	100
PID 1152 wrote to memory of 1232	1152	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bbd8d1d8d9f960c32b277539b4fd112_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAACAACCABABCCAACABBCBCCBABAAAABACBABCCCACBBCBCBCCBCCCBCBCACCBABCAACCACACAABCCBBBACAACBCBCBABCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBAACAACCABABCCAACABBCBCCBABAAAABACBABCCCACBBCBCBCCBCCCBCBCACCBABCAACCACACAABCCBBBACAACBCBCBABCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe" start= auto displayName= "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe" start= auto displayName= "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACCBCBCACCCCACABCBBBACCACCABBBBBBCBABCABACACBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABAACAACBBBCBBBCAAACAACACCAABCBCCAABCABACABCAACABBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 af8c0fc7ed0ae4ec9ade75761e86c3ceaa2143e6c7d790094af7d467ab154bd8
MD5 0287442be9e1cb19fd2160406970f8d7
SHA1 d237692f52187410b0151be8e1ff81d1162ef49d
SHA512 0307c5df73c03037941802a54c8f38bbc5fa860303e0737e46453ab4589a36cfe5c3e8f976cbf3a7458dc5fe7868afa361888f76a98f4ccf2d78c0295e9a4cd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fa6f03c7c93cb398ff845bebf3af97c834980e1b8bd85ba8e494a616793c6c0b
MD5 5a9c3364abc4072db70f7eb6b42896b0
SHA1 618a40b3b0af6815fb6c6d50f5f1e0f54289b008
SHA512 366e1c5f0a2d9c9a6c10f947b3fc804126e7ede070255dd7bc8621cc71ac1d26ef76bb5b99e14bcd721ec0ecdc2eaa6189e30e7e649293193f4f1818dc6564b6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.5MB
SHA256 6cd7a205d4a436bfbadcccaeaccc9f07876135d52cc2f42dc40665e819c71398
MD5 412072a43fd68edf5b9f8059b12784b8
SHA1 4d865bf97dd49f0740c5d4bba6ba3bc17f05e2fa
SHA512 3fc478a0542cc581464a45bd79156df6fae09ee47a1db655aa866492a7b9ef6d5bb510cd84e0cd7ad358bb65eddab2a75134c92256f51b201ab2de7057fe527e
SSDEEP 98304:vOU/jIEeQfoR/IuOFVjUu5igZ2Hb9t+2xv:vFIF0wuwgZ2jv
TLSH
T177665C01FAD94075F4B702705DBAC27A5930BA658722C9EFF28C974E5B32BD09E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 e691776181afc744f137a92a139123aeb8affbca47c2bc1e0cc10412b177175b
MD5 9b6cb63982f74a10b3473fb697cb7c63
SHA1 3c786b71f9b458a399ea05b64d61559228e77742
SHA512 a0c80fe4d95504ed6cb32b745ad6801a4fa8ce21903cb139c881e21ba447c0a81a52d0b280eac4e3c4b5761708c456ad3d2d03e94e1715ab42dca886c54a5f96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 5f2241447a042cfdd4ff213374b54651dbf9826f8919772d2c30ce1a68ce879f
MD5 539e4f06215a0015309612959a74f48c
SHA1 24b9fe71b6769fba4ff8721899bb9c5dcbb6f04a
SHA512 64055b8cad701a3d10f363eb9ee0b2efb29a1eff6340bad252f4c4cdc0de9d802c5278141b9646a286ccf69f1bf4476f20faf749f3896dead906e7ccb8eb9694
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\qap`g`v~dtlq
Size 10B
SHA256 c85e14263fc35efe55c2dd1e949eea854eda705612fe092da203aea0a3f62139
MD5 23eb5104c94323ec004d21c6e9f4e743
SHA1 a9563cdbd9582a56426d3feb3d2267441b3781f8
SHA512 f1a894f69e9daad388a8c34f6df2bf12baa12d548b8e3ee9c14311f11e987d3b5087e393fa193c842d9ededf8e266f9ac03edaf47f9c6c0b4073203937705dc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\qap`g`v~dtlq
Size 10B
SHA256 f04a99b9b12a3950379e2a5f8714edddf34253f3efb420c2cf716ce6a5ceeb22
MD5 e8f838bab191608e81b825904672d8a0
SHA1 e5fe7cc76b93342a00fcf3e071d4c49e211a1365
SHA512 169b70c37b364918824e60cc2aea6e601f8cfea5c3a3b8f08195096692e6c187874190f505b2589140dc45b83a876ca39c9e85e7c0e550ed8cf0f70d0cc4739d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\en-GB\qap`g`v~dtlq
Size 10B
SHA256 e879efde67028d46453d69d7a228a6f07f3100ed32ecba9d6a9b9a2e4fb628e4
MD5 d2ce86a2286a1eceedc449f1f3520bf5
SHA1 4a3816f9a979c654142bb7879f28edfdc7dd8a34
SHA512 ec998daeb4619b8e0cdcd8f856de17c642be216ad5d30475c0a1f4f2d5e75840953aa301fb1e22d7d60c72d17718ab523cc2bb05bd2c67217a5d48d167c69d88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\qap`g`v~dtlq
Size 10B
SHA256 9f305cf2945a515d9b195c313fdf24235dc64e64546c7da1ed5a69b76cc452a4
MD5 00e3f6527633b3a177cb5683de2fcf74
SHA1 41a1c6b2193b4984a0e0e365a59882da9c0c6b18
SHA512 96c440de775ac91df0e99762577d9eecf69cb7f9c92616297efb362c5eb05ddf79d2766cd2e11edbc36a2dfbd6f3816d0cff27cc41b63a13f03d5ed777028e93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9c033f2876964a83c24f498f036d3d62f2b53f849c3113f06b92d0f92cecf50
MD5 8a6e8519f8df2b80fe009d35bc603897
SHA1 560f5c0896fea535399b6e9523c2a61eb0f309c8
SHA512 ede3c83c82783f0cef988430ee4f7d821e28b22d2a240f33422bc77612a83f9d1216b8555d97daa81c8627b3afbee724ff115275965b29ac0fee46506a07dacd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60dec1b4bda3c40426d292d139dbe3d98a26159bd5412b27bf9f0e37de84fde9
MD5 a7d92e38c37000f76e3e515aafe5b671
SHA1 9bb005c744f0cb8a5e7cd9b5b5920142ba7386fc
SHA512 26c264a2cb30b96b516e0aae50bc32242970d712b598c87ad6eaab79fd93ccdd9e5058c12532f334f9dfddb3221c8a7f2cfeaf4521bf80c7a883989f37ba059b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 705fefb9bc608e0a5adf48907a7d0af57f3ae957b1bdde6b8aab925b93e6b980
MD5 91c7f386d4ef58f8b9f13343912de17d
SHA1 0e9d211c0c1f67177fb60eaadcba358e1b54210b
SHA512 4943c447c983710f163877c9f986e5d316397fe47f5fa10c01c65605a6bfb5c258bf2ebd9793b6e2f004b0c4f27edce754314601340dee5baa0ec030ae98d7ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45ac5421576a684e185e8a2f33eb7a5dc2aa7ef311177ee0c6db7b0ceb350725
MD5 4c9682bb9ba0594182e2eb02f0583cdf
SHA1 9d9c501d6ba6a8a40d04b2100b1fd533e55bc0f5
SHA512 1abb78d7ef29ed3f051c8b2653544bb469d9edcec5a90f65cffa865decef4b88ddd510a17dbde0ab05cc87a54ad19c26c74a742fa57375ecdcdcbd29b7f415b6
MD5 SHA1 SHA512

Submit Download

svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAACCAABBCCAABAABCCCBCCABCCABBCBBBBACCCBCBBCAAAAACCC.exe
Size 5.9MB
SHA256 1f7aa51b3fa90222c2f0c9f00e87a99f6286a71d532868c28efa84411f7a1684
MD5 4bbd8d1d8d9f960c32b277539b4fd112
SHA1 3a4787bf2b0c2c5df6d58055a5c6702812813696
SHA512 91a4f9e2b0cafacc628a5af6a427ec11206b175260e736f03535120e79147ef245979e1e05e4493dbbb7edca4dc0079fbcc6ba9e575bd5bd0bce35d7d3f14a25
SSDEEP 49152:U+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+En8+EnK+E5:vOU/jIEeQfoR/IuOFVjUu5v
TLSH
T18D563A01FAD94075F4B752705DAAC27A9530BE658B22C9EFF24C834E5B32BD09E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 29c091ac8879fa8e7f887191fe50ea3e6cf560934a13f415355c3ca1e116f4e1
MD5 b5d265ecc8cc027bba8439d965b5fa0a
SHA1 26a0accbdeb4e6ec809f7183fc119a7a5410e782
SHA512 725042bcfa1942047d3f5abf52cf7ab813894f1eb90bffa029187a3ea75e6be1a121196ffd86ea2111cc718eea9b8c9eb0d715aafff2243e4ce4229240198ef9
TLSH
T182112734A9E5DC63BB332C8B631EDF820CB5339FDC986A9463044519AB85D328D5DCE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 537ae2f9be38fdd0c68de79253b1fd3e2e8d6c1e2b1c140c755b719334ba0f5a
MD5 c17d265e3984e37a372e7d91dde4e374
SHA1 d61a0c56c56d23cf127370db65753085ff50c06c
SHA512 d0db697ffe517289481ee7208069e0c9836d3e11a4a4f17905a143695e43e2d78986b4f0ed8b730a6257b32da1400792520ec2fb6fdbc17c9dcb3a40638dd5e8
TLSH
T1B6212674A8E4DC63BF336CCB631EDF820CB5379FDC986A9423044519AA85D228D4DCE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3356-69-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/3356-2552-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/3368-6-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4872-31-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/5924-1976-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download