5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.1MB
Sample260818-dxt5radm8x
SHA256 5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d
MD5 507928d19022d0a8f08d8ddd8a22a43d
SHA1 a135f1321206dcf917b3bf6a411c123b099a2a1a
SHA512 2ce3a422d88b17bfb1bc50ef59d117d29dfcb51e1338dca0f3a82718f585c1dcee2b09d6d9bbe09fd39b317ef5734c2e7f15318c4ac851e36259ec2ff19a9762
SSDEEP 98304:RY0Y0Y0Y0Y0Y0Y0Y8OU/jIEeQfoR/IuOFVjUu5n:pFIF0wuJ
TLSH
T186074C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D875FAA33BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
1568	svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
3820	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABABBCABBABBCAABBCACAACABBCAAAABCBCABCCABCCCCABCBCABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe"	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBACCCCCACCBACCACCCBCCBACAACAAABCBCAAAABACCAACCBAABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe"	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4912	sc.exe
3304	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4760	cmd.exe
1684	cmd.exe
3160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
1568	svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
1568	svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
3820	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
3820	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
Token: SeDebugPrivilege	1568	svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
Token: SeDebugPrivilege	3820	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3016	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4760	552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	99
PID 4760 wrote to memory of 364	4760	cmd.exe	101
PID 3228 wrote to memory of 4500	3228	svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe	103
PID 4500 wrote to memory of 2144	4500	notepad.exe	104
PID 552 wrote to memory of 1684	552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	108
PID 1684 wrote to memory of 4912	1684	cmd.exe	110
PID 552 wrote to memory of 3160	552	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	111
PID 3160 wrote to memory of 3304	3160	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCABACBACBACABBBAABBCBACAAACBABACAACABACAAACAABBAACBCACBBCACCBBCCCACBBBCCBAAABCBCCCAABABCBBCBCBACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCABACBACBACABBBAABBCBACAAACBABACAACABACAAACAABBAACBCACBBCACCBBCCCACBBBCCBAAABCBCCCAABABCBBCBCBACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe" start= auto displayName= "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe" start= auto displayName= "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBAABAABABCCACBABBBAAACABAAABBBBCBCBABCBCAAABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBAAABCCCCACCBBCCAACABCAABBAABCCBBBCCABABBCACBBCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 54dd1cbc40897af2e05a1a65743ecfa1c4d103e4b917b8646d6441fd13820c79
MD5 42b2d6f17682dba580f4efd21202f504
SHA1 aba57545cff9542722795adabec86e4d63e19350
SHA512 549198f5983f8bf4f59fdddc6b3f8224d1147f53ed87b608633c1e92d4678ec8a714f1c68d082e79023a5c3ad6a5ae812298a7f8d614f45ba45a5cd959b1bf73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 4547498b4e284de10989e0143b8c7bb791b538247a1e843c59b7f3faafd053d1
MD5 2e2af30964cf08ad0410de2bf0f66a2e
SHA1 57b87ff538595e0907602c2a79e7bc1aa03c04c3
SHA512 7b6a920f2f265c659eba5df1058c5bee82ad8f7004da4070f484add3aebdbb6710944eb77fa57d96db9f1eaa2cd182af674654a46f0cfa5493badfd15511bf3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 1eb84902e5681889530521ce5c3cdf094731e176fa4b5d8f597969c590f4023d
MD5 1fff49583848c9ca07badc770a56a214
SHA1 a522755abc04c7f82060bdd45fe636e2ca0beee2
SHA512 2abad96afc3e3b26cfdf536cd6c11c26c08f0da1834087d67c6fd826c6153a995b7679e610032cb9178ecbd235f6d5392553eee6e7397ad79ee762c9be9abb9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\kn\qap`g`v~dtlq
Size 10B
SHA256 66646107629dba1161fb32b014035df5d964afc1e0f7b1423bef2f7c13df9888
MD5 c02d39b68395e2c4a8f6a7c79e6fa725
SHA1 984433744cc9c0b22b20313a14214bc9b5acbb44
SHA512 4604b9c3e8ea26bc17fc29c4205748534de4de00a835081aa6f97b466de8c5bc0ee4c525752116a17899b4817e54c03869577441a4a17713127a077d1c5d8f8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\doomed\qap`g`v~dtlq
Size 10B
SHA256 79927edd64f62e6ffef8d1292f19444868ef426ae726b4e6c91284573d19fb8b
MD5 5cd66f2433f87333181406cf0702d28d
SHA1 27765c7c6c7ecc59c1746b027307720c47b4e70a
SHA512 9ef1caf016af42d637aa063a2fa4ae6e6c685ea9d18ab0eb6b984150ff4dd395c872c6b9d6092636d52afda65bf0b0c5b796086579e9e621bb99934fc303bf99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCD1F70.tmp\qap`g`v~dtlq
Size 10B
SHA256 a009896f441c2f355d800b4254d133db004da57fbf7ee5570c1d407be952bbf5
MD5 fed23e0b41ac6f2f5c131ddfd657709f
SHA1 58aa675fabe8430589825c739f7a01d714278043
SHA512 e1999d1c4ee5a3a121554d69960bc6d2db41dc2a56c8cfe90a6559c86462f261b00f6dbfbaad967ea4155d866e284402a545228bf9bca9d9affdbb97b5c45c36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fde735e5158f0ff95b05a9139ff36208bc52e0e63fa418a1c65f9d8ffecacadb
MD5 79ed3e9f469770f646a656766986b8e2
SHA1 a0b861d6b8f8d2a25be84f27f6e9338797321b2e
SHA512 185c1203417291aca883f9f6ec39c611f45f0e368276b954929bf8649d372b53959fd3d87bfdc774ff4f5e0d02f1984e915fc4adf0906a2b9d47d705c1e868e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f03a219e37808fef7cef61f0b42e7b7e8d896b7832571c55f784c5f592f8479
MD5 31b8bb960ddfa2aa05f6eb6d059d6c21
SHA1 40594f6886f2c8a74eb15b76fed0ed539a0b00c8
SHA512 b5a46611fc9331766e9f191aa396a9112e8421bd13883fae95321ace65ac1f5fc3e00596b77b28f0c4b11de1dc141aa75e3defa2db3df0c8261e90d4375413a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b4ac1e84a6dcc4c4a3974bfc778b51e05a8c92643a6a1321f56065020a13f36
MD5 96ff7e2a7ea5ccf4921dd515787186ab
SHA1 5332bb8f12c88efc3d8bd5d3d95117cc24ab7a32
SHA512 a1118a681d203d6da5942c903a3d6796d5951bd5b27d4add0abcda7047d6d980d2823e79d1c1f658c38b6d29d59cbbb76c2ee6f873ca9e3cce1a88821a4d7010
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4ab7af6a905b8f3834b018aa43c67e2fcc4f7b663926da49e65c50ecaf2730eb
MD5 55cac1bde263ffa858fa96985f25d73a
SHA1 83d4ab80100497ae0422f8c768896d29e1929cda
SHA512 40cd1cbb80d28fd7c71527f4afa13684bd8f29851d4b5888b7931beb9424d7072f39c784dbfabe8053f689b38073114607251b2f45690993078e2cd3c7f2503d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 43b3cd6e8a895ab5a706fafc8ce26c090f09a710a8f7e218a108f259b9a9d1bc
MD5 203b27720dd72d1a1028fc9a87bd71cb
SHA1 b7f26d2de7fefde4818488047b59fa6db632829b
SHA512 57472b3733da5b7624f4bcda324bf93f695ee6c0812bcad85fb5eab7604e839afb74c1f8f1a6799ec5847ce2a239edaaec6c3b9298558fc4b6c88b107327d0f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 8156615de789c06a17d6f37fd80bba4932c9d65efe13528aafdd237681bcfe45
MD5 f70711cc1c37267992ee3fdeaeb97801
SHA1 438c1886c1e44686c51f01e0a0aef83c5be67075
SHA512 92ce7eb0290dcb372cbd9a07a788120800dede8c3a948071d9f003c7579e6bbb854d862940c021c947261e53448319747a9769fff15beac6ed602795f7f45b50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba0353b0efa13b94136215978189662aaea343637112a4d4aefcdb4f2043fbec
MD5 50bc73e2642ab323b760b9e9765c3144
SHA1 46f786800f443e857695a122ff96667d5277e1cd
SHA512 cb1ab26b05326a25d59b98e7a0a09a806a47ac933a3e86ecc5057bd932711da8fc88e67a25f102451b5a2f4c5dd93d02732993524278ad30175629d52c65a7a5
MD5 SHA1 SHA512

Submit Download

svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBBBAAABCBBAAACCAABAAACCCABABACCBABAABAAACCCBCBCBBBC.exe
Size 17.1MB
SHA256 5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d
MD5 507928d19022d0a8f08d8ddd8a22a43d
SHA1 a135f1321206dcf917b3bf6a411c123b099a2a1a
SHA512 2ce3a422d88b17bfb1bc50ef59d117d29dfcb51e1338dca0f3a82718f585c1dcee2b09d6d9bbe09fd39b317ef5734c2e7f15318c4ac851e36259ec2ff19a9762
SSDEEP 98304:RY0Y0Y0Y0Y0Y0Y0Y8OU/jIEeQfoR/IuOFVjUu5n:pFIF0wuJ
TLSH
T186074C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D875FAA33BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d742870ec654f995e3232a73b7c8411b757b53e649e6aa8594ebdf9ba501b929
MD5 7d0b10745929cf315713367ea649cb60
SHA1 6ae4089b03ad6fc0cdb5e4e750191212f29da701
SHA512 2bc35efd271e309a7fdd67886971e31900f92b852d230940811d43bfe6d7ce372d7f95af394cce66724fdd682aaeec27ae44c6f4cd7b90b67ca64a1388b3a88c
TLSH
T14F212C51D4BAD813FD237CDFD22DEA874CA4379BA9586A8823044518EFC9C36CD068E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0a26c344874cc05d84f61a2faac3d403d0a7cfc0fc1c63ceaf82e86f8f6b5baf
MD5 19c40944a2d1ad8814125437bed29b51
SHA1 90fe63af94b0095cf18a5765a2deace092c0252f
SHA512 101b74a2bb2a125e5fa5f36782d339108693403cd04798039a69c6942eac4a4f5aa0fbbdf1b6cd77f7be11e1f0e04cb0279212a8984980a4e7b5baa2d04fcd6c
TLSH
T124110B11E4BAD813F9237CDF923DDA464C94379BAD585A8833048518EFD5C368D178E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/552-0-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/552-24-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/552-74-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/552-50-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/552-451-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/552-11-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/1568-94-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1568-1637-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/3228-70-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3228-49-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3228-75-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/3820-1344-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/4500-76-0x0000000005300000-0x0000000005301000-memory.dmp

Download