a1c541c84e71102df3cfeaa44879fc94530dd8713e6d735b5690b31e5453ccf1

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.1MB
Sample260818-cd3r4stfpg
SHA256 a1c541c84e71102df3cfeaa44879fc94530dd8713e6d735b5690b31e5453ccf1
MD5 a913cb0c2f82f1fac75d4d9842ada144
SHA1 143aa34b174b472ebfafec1b634e87755aeb35f3
SHA512 a7f116023e926b9245cc7b1591aa925a1c79c3100718f8046e707af101d6d9b1bf84361f175e9dc61a33cc325bfb76168da57af43860d31ecb594e2578c87415
SSDEEP 196608:BLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZXFIF0wu9:PXRXRXRXRXRXRXRXP9
TLSH
T1AF077D05F84340B2EA6711B14DDFD27F9674BB2083228DEBF7CDCA1B7A32A915935216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
2288	svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe
3124	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACBACCCACBBAACCABBABCCAAACAACBAAABAAAAACAABBAACCBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe"	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABABCCCACCBBCBCBBACCACCCAAABBBBABABBCBACBACABBBBCAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe"	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2816	sc.exe
924	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1476	cmd.exe
3520	cmd.exe
1984	cmd.exe
4188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3580	schtasks.exe
2916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
3124	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
3124	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
2288	svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe
2288	svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
Token: SeDebugPrivilege	3124	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
Token: SeDebugPrivilege	2288	svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1476	4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 1476 wrote to memory of 3580	1476	cmd.exe	93
PID 4524 wrote to memory of 2192	4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe	94
PID 4856 wrote to memory of 3520	4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 3520 wrote to memory of 2816	3520	cmd.exe	99
PID 4856 wrote to memory of 1984	4856	2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 1984 wrote to memory of 924	1984	cmd.exe	102
PID 4524 wrote to memory of 4188	4524	svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe	105
PID 4188 wrote to memory of 2916	4188	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a913cb0c2f82f1fac75d4d9842ada144_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACACBBCBBBBABAABBCCBBACBBBBAABAACCABCCCCBBBACCACABCBBABCBACBBAACCCCBCCABABBCBCCBACACBBABABAABACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACACBBCBBBBABAABBCCBBACBBBBAABAACCABCCCCBBBACCACABCBBABCBACBBAACCCCBCCABABBCBCCBACACBBABABAABACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe" start= auto displayName= "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe" start= auto displayName= "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACBABBABCAABABAACABABABAAAABACCBCACBBAABACBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACABABBAACCCBAABAABCACCBCBABCCAAABCBBCBACABBBAACCBABCABCBAABAAAAABAAACBBABBCBBBCCACBCCABCBCCBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBCAACABABBAACCCBAABAABCACCBCBABCCAAABCBBCBACABBBAACCBABCABCBAABAAAAABAAACBBABBCBBBCCACBCCABCBCCBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCCABCCBBCBBABBACBCBACBACABABBBABCABBCCAACAAAABBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dabbad9083461a7fe359d7d0265ea616a6642a2b3b1bf2adc9dd9040329769a3
MD5 ad2fb3d5cb267b4583ec6fb54b7a27a4
SHA1 29c749cd1a9a691fe525deb8aa21e7b093ac044a
SHA512 471bf19b8f2138c68882fe5b169cf95432eded01b690b7881c314fd76b44b15b2f2b1e0e71ee4916caef7e5c02088aaa1d4fa1bb53c565a7d34ceb9323b860b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\fr-FR\qap`g`v~dtlq
Size 10B
SHA256 1961d7a2911a2dabf39b6d53364f2f6ebe7d971dcd789d90a13a519e9c81f8c6
MD5 e98fabab4f2dbb0a0c08c9fed004e32c
SHA1 c578a4129d4c87726a2a608c079fc2afb556f0a5
SHA512 f1b9b103c58a8bab89ce147eea066e284d0be2be41ca0042cefc07fdbacb59b4b0bb419041949915654c1917016d1d67f3908d20001404f4ed430a8061331b8e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.7MB
SHA256 8127f16ef345b5a56eec4f34ed9dab4624de8f87fbc5f8c38be8ff5d9431e746
MD5 d6b7560585dde5d434acb504d7aa17b8
SHA1 bc83af436f188270f4dc70ce007e15cfc172cf93
SHA512 a6ebf463c1ff081cac641d09733515cd4b3e68b2dcc2033f384ff36b7b735d8de0ad1eeaeccc466e8af3b5c87299756340f0b94cd629f4432490901147cf6bc7
SSDEEP 196608:BLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZXFIF0wusgZ2j3:PXRXRXRXRXRXRXRXPh2b
TLSH
T13D177D05F84340B2EA6711B14DDFD27E9634BB2483228DEBF7CDCA1B7A32AD15935216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 e156b8fa8f94b4a174dcb9304f4b7b4dcd050d5e67432ebfe86c328b051291b1
MD5 3634f01bbf47bab1ee49195bbb4e6ad7
SHA1 88aa99ffb10ef708702a8923145fc4273256e0c6
SHA512 0da9dea94f3d2645496db3e01dd103ab98ba20df5a7553588dac10603ce86bc7a24705d139fd5607dea1b8f1e5c21ecdb472f6889e45245a5e1f782e551345b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 1770dbca0897521bb5229390f4759021e6bfee8ef5c4c33ee22e13fa19050ae5
MD5 7a90a7d22ac15f11a7a245916afaf2f4
SHA1 cd6f75c2f43e53c68b302b051cd9d883be9cf2d0
SHA512 0eb8fd84d05ca42335fde3f617a6697567cae5fcb58259efcea4c67f14391ed39ff81dc1dae039ec709dad8efb7e8bb69ad03bc3395cc9f11390b17f923e7b76
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 6e839757d2a11d34ae8fd265b3e6c4d937fb668abc6f0b7b1e36208539ecb3bb
MD5 d0660b590ade3bf3f2aaf1c2541433a5
SHA1 f3ddad7ffb4331910c85856557d24553fe96fb44
SHA512 4151b1f8e2250b360bd5856b6a4df1d74952a1b0aa6bad2f70aaaef2a39565dc575797e80cba6ced7efe5b7816cf6f83673e3ead88bdc7ae5ccfedc52f667bee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 b10046ed50e10f82ee4cc77c8beabbc62d1584004301763bc2c80215b5aa9a9e
MD5 014888f55250d90d4ddffe39ee11ae8f
SHA1 70b90266fcfe9719d24d8a1460390a2afed55771
SHA512 f474e9890631a8146a24d12d341c9a73d8bb4dfbb13dafbec612f1e9c0002b2d3e501a14c892bac0e187ccbef26a4c95fd87b49f234746975e37885896a89704
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 df3f46e6f7115bb96e23ab2da7d273fb84e0192ac2a915fe35feb649b9da8f42
MD5 457ea85d4a8a2b957fbd8b2469be98a3
SHA1 2c74f73aad314bd7349431c06d65f6ab25038a8d
SHA512 b0b031a66fab7cedd7ed21bc033df82347fa7af251b7b4a8e8393f4571b34734457d5fc4041998bfd578490c06b49e0aa0a49759ec62b13a10a0f1af063a9e12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\qap`g`v~dtlq
Size 10B
SHA256 a6e05173fe481456bc5d8fefb0c357cef9b9798ba3d31667a542ed56a002a0a7
MD5 ba58b13caff4a0256bc50518e9718aed
SHA1 9419c8892df17cd72360878cec8a215d89a057b7
SHA512 00a77edf7aca68654c51ee437a6f3397b6ee89f6c4d4a48fd6c346fc74953ac3fcfeda4ade8e8f3b22cbb9d0819a938883f1c6a3b723cdda026339769081e5c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 879b82e00d98ae6af9f27b879b1514d8af6b71294016c314396851045ea9a05a
MD5 8119d23e040012d8ecdbe1277b716754
SHA1 445fe15fecc0b1d4de0099428e6dc1663e525c97
SHA512 0e5a08ae335aba691a8f99923f76e05885ce63f99ae69b4b68c1cdb163a59ecbd8c6592e058b861d36b5dcc6e64eca385f4551f2a7b667fb7946a5d7df374539
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\settings\main\ms-language-packs\browser\newtab\qap`g`v~dtlq
Size 10B
SHA256 777ce92943ca9fec8472fa79087c57d733f43f5ece65b76b42675cf9cae4df1e
MD5 a0acea9d9863e21326f4e00fb5b32825
SHA1 1868567f8a9f29ab94b9c0c8c1639a85e98b1951
SHA512 52d59098ff4d91c50ba56ced1159e2c7eaa02ab0251fe1a1e16422210e2e91cc26c0539b4f2c985e40746c6de003e7984c0f53a3deda31d6e5c66c172c09c8d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\crashes\qap`g`v~dtlq
Size 10B
SHA256 9e0cddaa2bca5d5eacbaf82e9a1dc165cfa868747cde9e916ce376ef543b9b3c
MD5 fc225fda1a87c75840f1b13c38b3ec15
SHA1 cf39667b88179110c4f0d5e4dde32feca9436112
SHA512 3d8b4f2fd0188a0195a13b077ab058d5a34d7203995cb447060f43f7e87f533a1dae7d290f799d4e603537d34b8499fd366294d95c007e3946e3a6b79d6f0b49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\qap`g`v~dtlq
Size 10B
SHA256 9ca591caa3a11d4ae100a988201f2bc0651736bd66705686b7f17e201c4911dc
MD5 502aa5e39b72e62237e40f54a1d49c47
SHA1 dde6cbb16c3f4898a92e6e9fb35f3812226c9dee
SHA512 e283455e3f3a62ac9eaaa874a483fe4f514636df400139427fc4dfecd51b26d205f43a801045ff4c29687fe8ed2a57972b49911b57b3486755966495d2e645e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a1f7f3b0d9342d45e431eee4da393532697eb9c15dcd05b65e0c8772b9914ccc
MD5 d078eee61caf01344a1941d7b04bf81a
SHA1 b9d63ed36bb102a1ec347cc37e7dc77addeda64f
SHA512 f6c0071a892fa3405f5fecd961e79f8e92229315d344ee136c58df873443196396f7a8dbfc91ff6fe969e4f835983c79be0bb4924c23dbda14d7ad9676d8a6f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e14c6038117993f669e70c2521125f38561581b648d200e9b3b91cd14bf2d34d
MD5 59181d686e4ea56494635117144d9e31
SHA1 6bb8796f6ae30201dd77994c41054952b866b364
SHA512 299558900324a80ffc3d50a513c63d89af02ce0f5aaefb8804be3f3375e91240f85a83bc56d36bb961e556f67e988baa0a10e5ec5bc11df4ade849cf56adb70e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99301b5997043b504e25addccd695abc948da093e84e875f9611041c5955390a
MD5 69256962994fd2ceacaa66c91c678b26
SHA1 36ea16d9017752dd4c8fbb6bd439ec3abcccb197
SHA512 96b04b62320de00f8a93ff85160ae7be9dba736b5bbf1921149d718a91e56aa1df2b3f31218e15c654750dbfa95ffebc73db8309663e45d608100d5ebc2643ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 834ed3c5351b2f3fa22c8cae7e5cab8ec303f2a3ef4680af50392bf17cb86ee1
MD5 4d159d3e1500dc6cb1d9275b302f9911
SHA1 ba5eeb15f9651f08acb70cb2f0a8e82d41dabfd4
SHA512 bb12d88af6fa306250de611df421ef9a27c595c58ba47d43c8b9ea0ac8a4b825d2077c839a5b3fb0732ff4d3a89e078495221e175b0631e00a17be74d2ee4a3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4417eff0563a5d59c15ae9fb9c1b75c634cb47529ab3761ad16ee9b5f669b9ef
MD5 3724c102503e5613aa59cf038f18d3ba
SHA1 5738368989de7634e67ff7e28c70bb6918ed87c8
SHA512 b46b3c1f4c87dcf8fc31f1833400825d474476069ae948110a1b7a43aecd5690631f7edb8c6813582dc03aede033f3acd59cc553774ec4cbf04b621fddccfd59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 449378164310280348087a26baccd822443c1570c0bfab7501ae350c02abffeb
MD5 26df8bf14a580e1b8d1c6729400f54a1
SHA1 6f01186355e2d4a1dadf5195355be09e36396363
SHA512 d02e426a9ac7d58f8b123516feed4a9d58a584649568967518eb79ceba0d1d77bc8e92800f9c26ff58fa182fbbfef4b2fdda9853766f39ed47b83da21048de15
MD5 SHA1 SHA512

Submit Download

svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBABBACABCAACBBBCACCCBCCCBBCCCCCBAABABAACCACCCBABABCC.exe
Size 17.1MB
SHA256 a1c541c84e71102df3cfeaa44879fc94530dd8713e6d735b5690b31e5453ccf1
MD5 a913cb0c2f82f1fac75d4d9842ada144
SHA1 143aa34b174b472ebfafec1b634e87755aeb35f3
SHA512 a7f116023e926b9245cc7b1591aa925a1c79c3100718f8046e707af101d6d9b1bf84361f175e9dc61a33cc325bfb76168da57af43860d31ecb594e2578c87415
SSDEEP 196608:BLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZLLZpLZXFIF0wu9:PXRXRXRXRXRXRXRXP9
TLSH
T1AF077D05F84340B2EA6711B14DDFD27F9674BB2083228DEBF7CDCA1B7A32A915935216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 87e8004fdecbd60164480fc71fc5a14f668df695774f33f7b15340bea683a829
MD5 2f4e39c46ff9088db13721f37d9d63c2
SHA1 7dfbc74a9b0d8c733ecc74e88d53be4fd58f5043
SHA512 75b2a1fbc746c54bcde1da274151df8f1308b469d0cb0970b6f578a857218399915b3f83b44f1789d6c12001c38e23c367745a94ea84c1e298c3fa378590f558
TLSH
T1BF11AA31E4E6CC63A93168DF463DEA834C94275B9D5C6940534E8218ABA9C35DD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e783ee097ef7585ac7b0de134c840f9b3c28086061e523d700c985f0783d3258
MD5 9e7e02685142df98ddbf3a4d13707b69
SHA1 d2705988457b8b9fbf87898484b077c49ad8fede
SHA512 07d433fa19b6f0c33b154a40a1e6d7100bf4a9083d4eb73e5f8c3b5614e65016b4625d54ee386d7a76c527fb6eeb670e82e890ac90431d291161ed67c0969ea6
TLSH
T14421B631E4E7CC63A83268DB463DEAC34CA4279B9D5C7A40530E8218BB99C36DD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 54a1217a96342c034178d59fcedf88db84ba6952460d4aa194352e0aa431192a
MD5 865b5c420161e5b3745ab535384a4d53
SHA1 b03e33154a51533cb60278d83611ccdbb3e4e1f3
SHA512 5d2fe8e7af69d5ada251b2144e4d997bef5133fc7681d7780bec4e9d7518b4d28b2fb00aed84580dfb3393e72d0dbb37d9accb471d7a3aa7f94ea1fd38a12573
TLSH
T185112B20D4F7CC53E83264DF463EEE834CA4375B9D5C7E40130A8218AB99C369D190E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2288-69-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/2288-4074-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3124-1044-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/3124-4076-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4524-32-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4856-6-0x00000000004A0000-0x00000000004C1000-memory.dmp

Download