0ce25555fafff0f87f8e20939e9ade9a25c51d3c6e4aff43c9cb8560660e3925

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 11.1MB
Sample260818-eapr7adp5v
SHA256 0ce25555fafff0f87f8e20939e9ade9a25c51d3c6e4aff43c9cb8560660e3925
MD5 0cef83eb38ccc3df0ae95020ede65e8f
SHA1 3266b194b16ffc8c4d702be0da69d0d608269d34
SHA512 326c3c74b65668f9f8a176917f0ef6bdb7a8d70011d712b96e9cebf8b1a7bcf6557814b2c706a9b47af9de441a6878ba78805ed4a75270b8b8b3a73466e9b371
SSDEEP 98304:fn+n+n+n+n+n+n+n+nMOU/jIEeQfoR/IuOFVjUu5H:EFIF0wuR
TLSH
T186C66D09B6D640B5E577517089A6827A8932B9314731CAEFF2C8C53E9F33BD4A934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
5236	svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe
1584	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCABABAABACCAACBBCAAABBCBAAACCACCACAAABBABBCABAAACAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe"	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBCACBCAAABCCAABAACBCCBCAABCBBAAABCBBBBBCABABAAABAABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe"	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2432	sc.exe
4288	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6072	cmd.exe
4320	cmd.exe
996	cmd.exe
5444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4796	schtasks.exe
6036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
1584	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
1584	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
5236	svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe
5236	svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
Token: SeDebugPrivilege	1584	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
Token: SeDebugPrivilege	5236	svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 6072	4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 6072 wrote to memory of 4796	6072	cmd.exe	94
PID 3848 wrote to memory of 4960	3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe	95
PID 4344 wrote to memory of 4320	4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4320 wrote to memory of 4288	4320	cmd.exe	100
PID 4344 wrote to memory of 996	4344	2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 996 wrote to memory of 2432	996	cmd.exe	103
PID 3848 wrote to memory of 5444	3848	svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe	106
PID 5444 wrote to memory of 6036	5444	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_0cef83eb38ccc3df0ae95020ede65e8f_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAACABCCAAABCABACBCCBBAABCBAACAACBCBBCCBBCCBCBAAACABBBACCACCCCCBCCBACACABAAABBBBBABCCCBBACCCAABBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBAACABCCAAABCABACBCCBBAABCBAACAACBCBBCCBBCCBCBAAACABBBACCACCCCCBCCBACACABAAABBBBBABCCCBBACCCAABBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe" start= auto displayName= "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe" start= auto displayName= "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCBCCBCABBCBBCCAABCBBABCAABBBBBBCBBCCBABCABAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBBCCBABACCBABBABCABABAAABAAACBABAAACACCCCCACBCACBCCBCCBBBCBBBCBAABACBAAAAABBBBAACABBBAABACABCAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCACBBCCBABACCBABBABCABABAAABAAACBABAAACACCCCCACBCACBCCBCCBBBCBBBCBAABACBAAAAABBBBAACABBBAABACABCAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBAABCBCBCBCBBCCCCCBBBCBBBCABCAABBAAACCCCAAACABCCBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3f25ff89f9387bd425a0b581cdf9a044fd7446546ec92e7196a7a1307ecfc82d
MD5 9f6d2c9749e8cc6b17efce7401df59a8
SHA1 784f7ae46eb6ec6df1c2036538a3dae08caf83a3
SHA512 71b929072946325751684c087e51dae8ae857fd81086b66cd5a5daa2dc90af339793c28ffea4b131fca6202531ed658b1f9c778f8230a6306151bde630f5a388
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\qap`g`v~dtlq
Size 10B
SHA256 f2df1428e8f989daf76ea5b77805bd21a8eaf78b4e978ed4426737b29dc59e48
MD5 9c40a5a5c55f40db89f2d8debd5ac68d
SHA1 47887660f5abe1529d8af253f1ac930f354924da
SHA512 7321d88d9356b26e8ffd214c7877b299ef21cd98b59a45bbb1d91b1708dfed46afd85645bf0a5dc8374e8f8bc0629bea3a8919808d55f628cde7989c0aec4273
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 11.7MB
SHA256 7c4e70b6fea8b9b2f407c4a04c13c1aabbbfed2ddc9bd7b47abfe2f095f82b81
MD5 1c00e900eb500fd8080218772a6e4b8a
SHA1 586a1c39d828f9f6c8a9a016efe75a548691e4a9
SHA512 0bc742093182f57a7ea01f8798790d024ecbd9e556dea27307e759033d4b5ce1e38ec7aefd18d7f7abad4b4e9770effb60890bc72616421a8d056b0c92200022
SSDEEP 98304:fn+n+n+n+n+n+n+n+nMOU/jIEeQfoR/IuOFVjUu56gZ2Hb9t+2x9:EFIF0wuwgZ2j9
TLSH
T123C66D09B6D640B5E5B7517089A6827A8932B9314731C9EFF2C8C53E9F33BD4A934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 421b3bbb72dda70141062fb5a72b2d3043a00c55a1c635bc0e107b8b526bbd1b
MD5 2206d32e024ef897478fe7ead9e77ca2
SHA1 1bc3b1b039c13428431322a14b5c54dce0eebb78
SHA512 1b0035a37fe35e3091b5cabad2aa4e059769802bca671e6cb78c19155d5504883243730a701405e49f7f153a37207ea2baf6e8e8876afb99aa904d2c80154a3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 30a9adc654f82a83aab29e50dc96a342a62f6078288cee3aa09dc86f13f7e1ac
MD5 ba8b362d6305084edc28ac54d1b84b35
SHA1 dc549bcfeb0075b230f55af5546e3bb19c87dc1f
SHA512 066a07592b92342933738a3ac357655dd88eb5c87008ef7cd80eef2a3cd6b037caf825635bb15007c79ee1b7f077c848966fea3b35b65fdae5107a9672f378a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 80a53c024104287d6e90efec456752223518f4e36d1deb89cc09edad5c7ee9df
MD5 998d1c53195e92908b64cfbe6b55cdfe
SHA1 c41a12c942b46cba6cea1e65de001368ebd8617e
SHA512 8c815960f7d1fe93f14d9e6bdabdcdaa66e174caa63933822d13c4c3bd1340045f24c48645dcb554f4a2d5618b7fad5ff5767471254204bfadc4735308df54e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 ccf596150b89dbc7de2f26d854ddf9198ea7f985e05589c996230390827caa42
MD5 d0028cdc3715e9417118649a9d020eca
SHA1 36a3da3a3dba80c7e42baac12a992e09c9142649
SHA512 9e8987f3933df8d65d10183396e4b9fddb94bee9f9217ee7de04583a035ea95903eeff332d0770c3d21cfe07a153c07ffcec3512cf2dde76c36c408ce02dbc0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VisualCompanion\qap`g`v~dtlq
Size 10B
SHA256 f90b84e6d091083ef8083e8598e8bc4e1c6565670fe6f73ea66c000fe1052cc8
MD5 e7884daca394873b9821525574433fed
SHA1 e232096cbe5432f6c8ddb8a6be7d4d6e1a9a22b9
SHA512 bf28c0a4873909c6f725b5b91b37ae692cfa99908c64548c79f1feb148067c8d9235d47d73157434df5e1ad499398f853a16b09ec1a6e37d850ff5da62c44b39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\qap`g`v~dtlq
Size 10B
SHA256 35dc2d46fcf83cf4d8a311961380e3a84840a08545927b7f6ceda7ab54fd8d69
MD5 5a992f6841f2816cebb4fd44d508f11a
SHA1 04aee5ea14560ce8bc25d4eae56a9ad174ac8c85
SHA512 094a7962eb8704bf1403537049f84cdc6146f49825ff5d06f6a44076b227db9f1a820b003ed1c79e3a2dcf610f24539ffd013649f162bf9661fe302776321769
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\qap`g`v~dtlq
Size 10B
SHA256 e8892bb3643c9be8f11acdd695a197a94444918e5ff00853143f2fd41ed3d46b
MD5 8a6a463da493741db84e015441f7c6d8
SHA1 83a27bbe41604ce846dbab87e6aa6cda440a849b
SHA512 12b5ee08256ea01118376d7e27fe1e1a9f0c61dcefe313702ea33999b2068ddafb1ae5de9daeaf8393d3b4eb1439de1587121be9c0d787f597ff8ceef8458990
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\LocalState\qap`g`v~dtlq
Size 10B
SHA256 d3be9af7ef8e91d2c9df025c9dae005e2cae8dfd0cbb724d669ede502daf60be
MD5 294c47e750cb2eda714fd5f661773b36
SHA1 696baafc1301d7d1ca95b50399cee16d139b302e
SHA512 2b51e7024d8cefaa586b0811be0a7d3e15077d1f500d6d1cc2b0f0608576284ac9d2d4a4d09398797466cc4aa4d3325bac5908db23ab39aa7820863be377a05e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 895aea9c6de81600e0913020e64860ee87b766ba7ece616f268511b0718a9a94
MD5 ce082cb73dcf847bec1ac9d3fd269e5f
SHA1 ca2cb54538029710ccbefeeb0c8fa99ed0b3fa9b
SHA512 71bb9d65409107a2e6ef40dc00552b84c3958d5902cf6523440094e73d3ae81d604f9c5cea95893567de4487ae550b0ea7c8a4fb04838c13a575776134a447ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d990fb296acd8e5e527b1fced71d292c5fa0f210e8be150a14ca694568967f28
MD5 dc8852c1ee646af95b481357987daf30
SHA1 671eba7ee352d813371f2d5871db5e0af762dcea
SHA512 2ffc329d016840fedc5a074f091e23bdadcd06efb4343f25ab3de308da35fbbf9ed57e7f4ce1d8400b54f5c41f5c7bfc5bb7cbb449afcb2abc05af43551758d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da6cac017592b1615048efe735ab9d92cf7c61e968d1c3e85c99567ee9ffbcce
MD5 4ec950d3298af051e83e8ec5edbd90bb
SHA1 ae8194ee0e194e02789031c6273d75282d5cf588
SHA512 b74d09239e3d31d8cdc072bc8517d62b2728abc6cea584a68df12caac2820e1ccab9c8610fc3f6821a7aa5e130a4152c138ff9c06d02de90d6b02b1467642a09
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dab52b6b73a3b73e77d62dbbc51cdc9dc7e92829af6c676aa4bc57902e67d71d
MD5 ee0cd0df1e0e211998763f2020f1eabc
SHA1 950a03079a14be49c37d0d7a75773da4540fafa0
SHA512 c827c1f40aaa1c804045832241b4f266b57f025b1035d2c352a18b6300a421218f54c9a416f3d48cd199c6484b9ff87fa238067b0ef5a35403e9d7b64738b136
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 445adb7374a34131fa4db39f1f525437703830003098ce8620c817aa7c03499b
MD5 5fe6ca3488ffbb9ff31ff775968be9d2
SHA1 aaf0d0dc4dc4c57e8f031cab7a24be6b14ee53e8
SHA512 40366fbaf6c241a00ac0cd172c132d763f915a645dd1da787d0babe8d8243282e6115a62a8e3ea833d11a8bfdd88707abbb0cf6056dc1be7b146ce02741cbfd6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4c1944cafe250816371e4651a5699910b902620e67917939c6ceec65255adc39
MD5 0bdfcfc41a1c4e1ff646111a5d19d963
SHA1 89457f031af82bc4f1e633ff7f272293169f4945
SHA512 7cb72ea91ca9a272158e671107afe162167c7a9c8a9f2ba6085f5b9f9a7329aa864399271c711460ff682d16867d5806c92355b23bd20453b4c9c2a5595b3607
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4d7d5c057646d0e46a760582d5689f46f4b6579e9540704cd32cd4aab189f686
MD5 1211f3c3252b207b700542c3164df2d5
SHA1 8da7d04f425b3b89ce24bdbab04725fd449758f5
SHA512 8dc5bc021b7057a5596c3b7c4cb0a908e52a567cde63e82e8288163c040ca4417b3f0873f40222c49f4398a5a206e94036a8295c43093c66cf310ff81bc0a764
MD5 SHA1 SHA512

Submit Download

svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCCBACCCCBBABAAAACCCBABCCBCBBBACBBBCABBCBCCCBCBCAAB.exe
Size 11.1MB
SHA256 0ce25555fafff0f87f8e20939e9ade9a25c51d3c6e4aff43c9cb8560660e3925
MD5 0cef83eb38ccc3df0ae95020ede65e8f
SHA1 3266b194b16ffc8c4d702be0da69d0d608269d34
SHA512 326c3c74b65668f9f8a176917f0ef6bdb7a8d70011d712b96e9cebf8b1a7bcf6557814b2c706a9b47af9de441a6878ba78805ed4a75270b8b8b3a73466e9b371
SSDEEP 98304:fn+n+n+n+n+n+n+n+nMOU/jIEeQfoR/IuOFVjUu5H:EFIF0wuR
TLSH
T186C66D09B6D640B5E577517089A6827A8932B9314731CAEFF2C8C53E9F33BD4A934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a4db3bb759f09f3f38efdb879aff4c7e0e66e2e44c2c47bfc82d422e7bc5bfdc
MD5 9351176a2e9bdb9bfbd5102da92a95cb
SHA1 0f34a344fc16d956c922d862545f7c208648419c
SHA512 df267c1e1649726513b0910d0e2959d1ff9826a7e0ef6f9e93613075a6e0fdfb7842224cc23108b84de6ed8923734aeac1c38f8ef0fefbbdbf2fca63bd330df8
TLSH
T1D211D560E4F6C857F93368DFD639CEE20C94239BAD986E88221D421CAB95C378D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d28d8130e140c2ee6b69575e91e547d24da59004d5a52224b72a1ba5e8942021
MD5 982e840609ec4da448887f093126bbe4
SHA1 ac0102e4b96a3b0abc455bcaec1b40e3fc4ece1a
SHA512 dc5eeed6397b81683f15445a51bf3bf37a7851e46d2c8c8eda7911d112175f62d60a3dffce7f716bd924d4113aa259a3031ddb644128ebb7aa7a16512a8a4416
TLSH
T13921F660E4F6CC57F93368DFD229CEE20CA4379BAD986D88221D421CAB95C378D094E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 18a7c2fcb9fc7b86908aec6e868b27e8b57137ff64128d96cc20dc9895bf6f7b
MD5 46cef591e31c384e1c107e17eccfe707
SHA1 3b4f1a06e043de24d9b95cb598f1aedecc096df9
SHA512 5afb372fcf5e558f3857c1f7a89eec6b042e3cd8375c54eb342fee76b7bea0f1405062c18c8c30b1563389a1da5c7de6d8183f1e667e8d406e06da4d9a8d5b1f
TLSH
T1A2110A54D4F6D817FC336CDF9239CEE30CD4275BAD986E982218011DAB95C278D194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-999-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3848-33-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4344-6-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/5236-69-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download

memory/5236-3967-0x0000000000AA0000-0x0000000000AC1000-memory.dmp

Download