5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 17.1MB
Sample260818-dxt5radm8x
SHA256 5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d
MD5 507928d19022d0a8f08d8ddd8a22a43d
SHA1 a135f1321206dcf917b3bf6a411c123b099a2a1a
SHA512 2ce3a422d88b17bfb1bc50ef59d117d29dfcb51e1338dca0f3a82718f585c1dcee2b09d6d9bbe09fd39b317ef5734c2e7f15318c4ac851e36259ec2ff19a9762
SSDEEP 98304:RY0Y0Y0Y0Y0Y0Y0Y8OU/jIEeQfoR/IuOFVjUu5n:pFIF0wuJ
TLSH
T186074C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D875FAA33BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5304	svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
5884	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAAAAAABCBBCABBCBBAACCAABCBAABBAAAABACAAABCACBBBBCACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe"	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBAABCABACCAABAABCBABBABCBBBCCAACBAACBCCABCBAACACABABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe"	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3472	sc.exe
3592	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1992	cmd.exe
5180	cmd.exe
1072	cmd.exe
3648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4376	schtasks.exe
6084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5304	svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
5304	svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
5884	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
5884	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
Token: SeDebugPrivilege	5304	svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
Token: SeDebugPrivilege	5884	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 5180	6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5180 wrote to memory of 4376	5180	cmd.exe	94
PID 5036 wrote to memory of 952	5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe	95
PID 6124 wrote to memory of 1072	6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 1072 wrote to memory of 3472	1072	cmd.exe	100
PID 6124 wrote to memory of 3648	6124	2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 3648 wrote to memory of 3592	3648	cmd.exe	103
PID 5036 wrote to memory of 1992	5036	svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe	106
PID 1992 wrote to memory of 6084	1992	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_507928d19022d0a8f08d8ddd8a22a43d_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCABABCACBCABCBACBBCCCAAACBACCCBBCBCCBBBBBCABBBCACCBBBCCCACBCCCBCBAACAACCABCABABBABCCBCBABAAAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAABCABABCACBCABCBACBBCCCAAACBACCCBBCBCCBBBBBCABBBCACCBBBCCCACBCCCBCBAACAACCABCABABBABCCBCBABAAAAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe" start= auto displayName= "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe" start= auto displayName= "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCACCBCACCABAACAACACCBACBCABCCAAABCCACCBCBACAAACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCACBABABAAABBCBACACABCCCBABAAABACBCABABCBCABCBBCBCACABAAAAABABCBAACCBAAACABCABACAABBBBCBACBACACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCACBABABAAABBCBACACABCCCBABAAABACBCABABCBCABCBBCBCACABAAAAABABCBAACCBAAACABCABACAABBBBCBACBACACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCBCCBBBACBBCABCABCBCCBBCBBABBCCCCABCBAABCCBCCBBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f7016989f9440800a6d1a65e44480307e66d0c9d9fc02addbf1fdeb6727a1001
MD5 7ea999b6927818dccb69236b28668643
SHA1 94a8970129dbde67c0840a207cbd3b986415e079
SHA512 e1602379ccd85e930c4910e65d70536c9ecc6e80b1458ba74359d79b7403f0166eca52736fe831d5fbd56c4ddd1aa38237fdc24da193020d6686091b92365457
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 a009896f441c2f355d800b4254d133db004da57fbf7ee5570c1d407be952bbf5
MD5 fed23e0b41ac6f2f5c131ddfd657709f
SHA1 58aa675fabe8430589825c739f7a01d714278043
SHA512 e1999d1c4ee5a3a121554d69960bc6d2db41dc2a56c8cfe90a6559c86462f261b00f6dbfbaad967ea4155d866e284402a545228bf9bca9d9affdbb97b5c45c36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\qap`g`v~dtlq
Size 10B
SHA256 d3d5b3672dfba07def3e40752ae82f1ec21b8a6e0df5b18726e25d8fd3bb97c9
MD5 a675a0b2d8c2461a5185bee9c29515ca
SHA1 0e32cedfb9c5e8fe77a74edccb09bf944def7eab
SHA512 ada52809b81855a4cafe5a90c20689c40d127e0ffd2b95eecb9ce6bb798f7b33fd7144f66dd7de52d7901cad06e714fb11703801025d049d0a004e5c4e4e6bfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{1B690A4C-381A-40D4-BA4A-3F8ACD5CE797}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 1eb84902e5681889530521ce5c3cdf094731e176fa4b5d8f597969c590f4023d
MD5 1fff49583848c9ca07badc770a56a214
SHA1 a522755abc04c7f82060bdd45fe636e2ca0beee2
SHA512 2abad96afc3e3b26cfdf536cd6c11c26c08f0da1834087d67c6fd826c6153a995b7679e610032cb9178ecbd235f6d5392553eee6e7397ad79ee762c9be9abb9a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.7MB
SHA256 cacf35c76e232779d67095200bbc302a8a54edc39efeeacfb09acc9b4a0f6b9e
MD5 91194c9054ca2f0635515212113e518e
SHA1 9806df672fa07a3aa7b71d374ca87444b4e8bb82
SHA512 ffab0070c1691927992a910fcc7cccb072ae07ad736b69ab3dc2b4421a641a8fce8a19ce1ea98c6676ffe8dedca82dd5f9c374481a52b17e22a652b7ae0fdc90
SSDEEP 98304:RY0Y0Y0Y0Y0Y0Y0Y8OU/jIEeQfoR/IuOFVjUu5agZ2Hb9t+2xs:pFIF0wuogZ2js
TLSH
T1C4174C05F94380B2D92B01B14CCBD3BF4A70BA258B128EEBF78D875F6A33BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 54dd1cbc40897af2e05a1a65743ecfa1c4d103e4b917b8646d6441fd13820c79
MD5 42b2d6f17682dba580f4efd21202f504
SHA1 aba57545cff9542722795adabec86e4d63e19350
SHA512 549198f5983f8bf4f59fdddc6b3f8224d1147f53ed87b608633c1e92d4678ec8a714f1c68d082e79023a5c3ad6a5ae812298a7f8d614f45ba45a5cd959b1bf73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 8156615de789c06a17d6f37fd80bba4932c9d65efe13528aafdd237681bcfe45
MD5 f70711cc1c37267992ee3fdeaeb97801
SHA1 438c1886c1e44686c51f01e0a0aef83c5be67075
SHA512 92ce7eb0290dcb372cbd9a07a788120800dede8c3a948071d9f003c7579e6bbb854d862940c021c947261e53448319747a9769fff15beac6ed602795f7f45b50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 15a64f0f26e39d85a02f4ecf13c9fa46bad00a4268173fe473ab0d7ac4b1d43f
MD5 efbd62a61bea7e08e06c64e35fbd8cbc
SHA1 1062d24e90ae9389a5924b79056f10975f506c31
SHA512 a930b1e831caf109fee7cb7bc827791e6fed08fa4df4fe4eeadcd82193c8a1d27aaad54b2b8dbddf93004834b681937629a9304ec596510126af3e9a2975b1e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\cs\qap`g`v~dtlq
Size 10B
SHA256 4547498b4e284de10989e0143b8c7bb791b538247a1e843c59b7f3faafd053d1
MD5 2e2af30964cf08ad0410de2bf0f66a2e
SHA1 57b87ff538595e0907602c2a79e7bc1aa03c04c3
SHA512 7b6a920f2f265c659eba5df1058c5bee82ad8f7004da4070f484add3aebdbb6710944eb77fa57d96db9f1eaa2cd182af674654a46f0cfa5493badfd15511bf3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 592ea67fd4f146dffe3360c3c1df66088e154c7b08c019765899e242d3817b6b
MD5 a6ca3b644f2c287a6b97343b770dee6c
SHA1 657db3a66e79b869bf105e7de5f0de8706790876
SHA512 1c08ac851f6f5b49b7f865b95298205b5e0a9914734f8435e01b83a0e240b28549165ebe86f38ac8305c562351f2f51e9010009bc220cd520bcc0b58cd722b2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\prs-AF\qap`g`v~dtlq
Size 10B
SHA256 66646107629dba1161fb32b014035df5d964afc1e0f7b1423bef2f7c13df9888
MD5 c02d39b68395e2c4a8f6a7c79e6fa725
SHA1 984433744cc9c0b22b20313a14214bc9b5acbb44
SHA512 4604b9c3e8ea26bc17fc29c4205748534de4de00a835081aa6f97b466de8c5bc0ee4c525752116a17899b4817e54c03869577441a4a17713127a077d1c5d8f8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\qap`g`v~dtlq
Size 10B
SHA256 79927edd64f62e6ffef8d1292f19444868ef426ae726b4e6c91284573d19fb8b
MD5 5cd66f2433f87333181406cf0702d28d
SHA1 27765c7c6c7ecc59c1746b027307720c47b4e70a
SHA512 9ef1caf016af42d637aa063a2fa4ae6e6c685ea9d18ab0eb6b984150ff4dd395c872c6b9d6092636d52afda65bf0b0c5b796086579e9e621bb99934fc303bf99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 2ed39245cbe58aadfd1d899c5856fc75773709ca2db63d973e944cce69c1526d
MD5 23f48844b9d782a6fbd2f3716280878e
SHA1 eabb6b4801e7ca8a039b061125c200ddc60b2a3c
SHA512 3ce1d8d34799f141815c9d5421b83da063923fb97d74b7cfe5f259e28dc4f5c6775c6675a12c097956b6514c34e0b825b42b0681b25334585776207da8b4c7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c516bfb958b16f78e2abde6314a20fdd28ab0389793baf6d0830c5ae89595063
MD5 35cd21a76f02264ea6836f38ff2c9918
SHA1 f106991f11a6df2fb60d6693946ee52285fd7652
SHA512 a3c1d30818f10f66210ef62dab827d25411ee60f32b48f8bfcef6d9ab4176e92eccd15d72f51abdaf0f9727e1f1e3ba917ceb161691baddbf2c081f891bbcb49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2cd4be1ed74c87c40e96eafe7fe74b49a9e329da402055c5ff5133c789e939a3
MD5 c928f6d6a64b80ecafeebd1376464245
SHA1 0951f41ce5e0d4c870ca1fbfbca5e260a042ab12
SHA512 8ff1e29dd5619474ffeedda9af900f0c8662a672cd808ffccc565190945a0eccfb77740f8bd19adb78311537ef9f6a80ce1b903b72ec4485533b9e196def0db2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 731e51ac332506cea5248310428d88fb93446fb8ed4a9cb5b9e88ab057e66614
MD5 bcf6243959989b8e536a51f5e6e09eaa
SHA1 780ce09d7955b81e0c57a67e1f94a19008605595
SHA512 62f4a083fa01fa6c21e594e569bb0dc5dbabd1a1fe141739f4d89dcb45dc6a83f8b1768cbe0793fe3b9ba496993c8867e69f6492cbcd21951a5c2320b26a8fde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 831a77a8c417270fc3f2e5467c0577089214cd71ad99c8f1b5551678ef838559
MD5 e835a78053839514025045feebcdfba9
SHA1 c228034ca88978020d188d0aede6833d8a92f147
SHA512 ca5ef102c9886fcc902982c9b9ba6e6106799b468bf119c1fdca1042192a3ecfe1f4d9de071ffe4a4614f6045fcfe77fef6d22d92f7478601b203bb1254a0020
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62e434215626af86cdf9eb5e758a7231b6d0850a3acfc50430c3b71e361b774e
MD5 95fd08f7e6bd76fa467f0db24ef5af4c
SHA1 4af90d99081da140360c117a57eea2d481bb1bc3
SHA512 01bd11847e1f50cbad8a317116c042a102a7ae7c15321cc259a67081d0fafe50ffc4e97ea6448fdf2d1f01a633cf8fa6a1534b7972a4e777eaea4b9075779a0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35b9b74e1d1066c96161c289b1724ec72697cfade81f7e75db1586e243bc2d7e
MD5 3bfb33a924d458fc771e89cea729cd8a
SHA1 a91979436c0a912a685f9e92dad71c5ee3a773e8
SHA512 87b15e0c0c6bff1f7aea1d2d960b4720f21d50a0e9df1fbbacc7661b98bda00d0c94dda35884224fb3bd7b0a773abb9449755b0cceec7f4c9ebc3f16d2ce8fe2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 584654d0f3cae8515b78c482c946ff11e04af1688f1ad1c0f75627e13b573427
MD5 6e1cb7241dfe7cf9e3d614263bcfab27
SHA1 7678f34be846fc0156cb9d367e22bc6443445148
SHA512 32bb0f1f2b3ec2d3e58095fc77d1000fa6de4c2f1dda208e42bd885430bef13f850834a04cf4a3eaf8e180ae72c75966021a4b534091fc7493c4540d8e737ba6
MD5 SHA1 SHA512

Submit Download

svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBCBCBCCBBBCABCBBCAAAABBBACBABABCBAACCACBCABAABABBB.exe
Size 17.1MB
SHA256 5247a97dcaabe78af8a5cfe60e4cc34f7812fd042341ae31382083b96d338e8d
MD5 507928d19022d0a8f08d8ddd8a22a43d
SHA1 a135f1321206dcf917b3bf6a411c123b099a2a1a
SHA512 2ce3a422d88b17bfb1bc50ef59d117d29dfcb51e1338dca0f3a82718f585c1dcee2b09d6d9bbe09fd39b317ef5734c2e7f15318c4ac851e36259ec2ff19a9762
SSDEEP 98304:RY0Y0Y0Y0Y0Y0Y0Y8OU/jIEeQfoR/IuOFVjUu5n:pFIF0wuJ
TLSH
T186074C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D875FAA33BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0df88fc1e586c7c8768c61cd0714450e14168f2c6ca950961c6c1e321d212386
MD5 b53e1b041601c85fc1882cacfd8770ad
SHA1 5c366265a250287ca26233249e1b4d421588c277
SHA512 84dbe54415f7bceb33d72ac8f75e13fb69da3f738ead254029b7d342d9e2e7eec6f87513bd53d9d9e500990b8740a7bdfd07218a97c246316175b77ae677feeb
TLSH
T1BE213E52F4BACC57F832A8CB8739CAD24C94339B9C5C5A84230D4518AB88C36CD168F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fa23e2b5bf543a6a364f55abf1a6265faaa1fefeb0c7d5c0e1bc9d65cc22a46d
MD5 d8c837559d06edd5a05ef3ace7be0611
SHA1 65413dd1aa405990c0d8aa17bb9dbd59ea993c39
SHA512 ce0647e4f1df78bd90eb26c2b7c3a94b19a60781f1d40e94be73238ac1c9e31ac53f227e4100da46a9be328111224d61471396b7992c1b3b08c5399e9d41b48d
TLSH
T1A411E351F8BBDC17F832B9CB473ACAC64CD427A7AC1C6A98230C5519AB49C364D138E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 84256f51b92a6367ed35d79d45542d81605b1bdda64caa9574fad3b5dd4e8f56
MD5 c9d9f7db5d5d33ad27c6538b66eacee3
SHA1 d4b19753b2991457498aa70a289ef76ffb34a1c3
SHA512 8401c865ea509f1f3e77953bcd9f17d2a96f3eeef0072d98ca7e2c972e2b324d15ec56a2178bb991ca8ac502792d71f9a55bc571c81b156c6b52aa04637611b9
TLSH
T155210852F4BBCC17F832A9CB4739CAD24CD43797AC1C6A98230D5519AB49C368D16CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5036-33-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5304-76-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/5884-914-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/6124-6-0x0000000000950000-0x0000000000971000-memory.dmp

Download