f8940f0085f6e24e574b46317f46860153f79d9dfcd2dce234688209d575ed6f

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 21.3MB
Sample260819-ej7pcsdk8w
SHA256 f8940f0085f6e24e574b46317f46860153f79d9dfcd2dce234688209d575ed6f
MD5 e8e3c5a06633b368faa2c06e621e8161
SHA1 d1a947f50e7d6085ad0e0e57417432f4a042e7cb
SHA512 3dc15ed5fe085461bd2dfe33ce0d8a33c9c813a622448913600d12f52f6e3eab62774f15c2b3d7a79ca22791060d9206c9de94d2cbe6bee9dfa535d48b46a5c4
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ESH:hAAAAAAcOU/jIEeQfoR/IuOFVjUu5V
TLSH
T17A374B09F98740B1E87B51B04DDBD2BF8930BA2587128DEBF64DC71BA933B919834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
3604	svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe
5684	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAAAABAABAACCAACABCCACCCCAACABABCCCBCBCAAABBBABAACABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe"	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCABAABBCBBCABBABBAACCCAAACCBABCBCCBACBCAACBBABCABAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe"	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
676	sc.exe
4976	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3440	cmd.exe
2508	cmd.exe
4572	cmd.exe
1572	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3428	schtasks.exe
4828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
5684	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
5684	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
3604	svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe
3604	svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
Token: SeDebugPrivilege	5684	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
Token: SeDebugPrivilege	3604	svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3440	2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 3440 wrote to memory of 3428	3440	cmd.exe	94
PID 4928 wrote to memory of 916	4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe	95
PID 2884 wrote to memory of 2508	2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 2508 wrote to memory of 676	2508	cmd.exe	100
PID 2884 wrote to memory of 4572	2884	2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4572 wrote to memory of 4976	4572	cmd.exe	103
PID 4928 wrote to memory of 1572	4928	svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe	106
PID 1572 wrote to memory of 4828	1572	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e8e3c5a06633b368faa2c06e621e8161_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCCAABCACAABAAAABBBACACCBCAABBBBABCCBACACBBBACACBABBCCBCABCBBAABCBCCCBCCCACBCAABABBCCAABACBBCCCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACCCAABCACAABAAAABBBACACCBCAABBBBABCCBACACBBBACACBABBCCBCABCBBAABCBCCCBCCCACBCAABABBCCAABACBBCCCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe" start= auto displayName= "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe" start= auto displayName= "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBCCACABBBCBCABACAACBCABAABABCCCCCCAACBCCAACCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACBCCCAAAAABBAABBCBCAABACAACBCCBCBCAACCCBCBAACBAABBACBACCAAABCBAABABCBAACAACABCABCBBABACBBABCBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACBCCCAAAAABBAABBCBCAABACAACBCCBCBCAACCCBCBAACBAABBACBACCAAABCBAABABCBAACAACABCABCBBABACBBABCBACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACCBCAABCABAAACAAACBACBBACCACBACABCBBBAAABBBCAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c80ed16cb7efa191fccf36ccfce618695c3a7cf753a985ea0fd4590915d44cc9
MD5 501aa63401da61b4665a2fb2cdc5dc67
SHA1 74ebc5095befb085417e6c4b09cb678b6301b8c8
SHA512 103d4f48f6e6625a9a12d8658292c25aeb1e67a8888953eefade7cb4d0cb7b479c22d961a9e0539b72670e5487554ddfc021b98ed3ea01f7fe3a54c05afbeb72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 4061f645a96feeef5aaf0f57ebb85e07e884609387ac9a4da20f244ddad679ba
MD5 1cb619e82e6e6bf94ead7dfdeb0cebd6
SHA1 9c88002396e751ee95fb6520fe9e8adec3ede95b
SHA512 493cdc3fb2c4587368e08f623622b9c9b194c39d7e29ab6d7bc075b7dda084c3bebff97df04fe28edf76baa08f55cabce14b783b89e2a91909ea1a067f2929a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 cb4d1bee02515774c19a1e03f4701a60c0742f1b43a1ec18fc4c94277cf4b796
MD5 8b1ba97a58ec44274f2791343a3f9031
SHA1 10b66233001e875eb00f67353f96aee83392ac05
SHA512 a94b9df975b2a4ce75e055ce803edd31be6ccd78fbb5488d22f4298433ec8e9b8202ae383f4a939a7e26e7968108b8e900ecf5fce616cea843d735dd6946823e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\EdgeUpdate\Log\qap`g`v~dtlq
Size 10B
SHA256 a8f556c3021c38260958053c5bddc7f171aabe68028a2aa013e1d12dddf193c1
MD5 87d459029e63701e92e645ad7c37167e
SHA1 4ac4b964aafffe20a82725f6aa9d3c88305f3efd
SHA512 9a56282769ed81b99399385e75e11c3a43e5b8050bb4f39813c79c9b309528d986ff7bcdbcf3ecf53d21484417526a0599866a4041977290d71747b44ccdf90a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\WER\ReportArchive\qap`g`v~dtlq
Size 10B
SHA256 7f50bd40e73f5b505a4704a20e97407328251f2e0535455314d717dc4995b4ea
MD5 cbaf46dff5459ad02a7ddc0b3c09063c
SHA1 06549d39845b736249dfe56e82c7dc49015088d2
SHA512 c5644a07338016346367e140edd8febe6a7d7390f7f7bd2a872c878515137f2d2b61143cc705b5f092349d29d0ad4f8665806d99b18ba303cdcccbc537cb1f7d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 21.9MB
SHA256 bbcc2cc9ce395ab1277ba014253c700242d1d87f15dfde01cbcd3c7ea148625a
MD5 4f85a0c80c1dc176056238a57dc81b69
SHA1 937c6142cada055c56726c159238f956ed8914c0
SHA512 dc549354083873a832cbf351eb1b69fbc2897437cb9d5db0f954694e5369fcdfc329953fcd6e13abda21a8f0ed42ccb054294dc32f2c39bfa7c4241824ca61cd
SSDEEP 98304:hAAAAAAcOU/jIEeQfoR/IuOFVjUu5kgZ2Hb9t+2xp:KFIF0wuGgZ2jp
TLSH
T164374B09F98740B1E87B51B04DDBD2BF8930BA2587128DFBF64DC71BA932B919834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 70b764174c2e90598f0b88f7bb93007870a3b401d30b078ef9751af8e0d42d16
MD5 8642e0a62393db54c1061653a23dd81e
SHA1 018a442eb1920da4900c8d3bdcae3ce2d5eb3fef
SHA512 4ba2748e74601175df5d4c347e1ffd22151b47c1261afb34ea5e879dc8929e14d27017622446cb73653746382aefe3fa4a5851b6e2b66d27f57b783e88b27f8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 92d8de74bde4fcc58fb9461fda2382af2f8d2900eae5be90b4ffcc60fd75b2fd
MD5 594c2187804a3916a2a3d5e663d9a3e1
SHA1 0d734bd80657169876b2546e51faf33c761e2bb3
SHA512 3cc9a6464091a1e2b6057cc552bbd2094b00219a896bbc0f2720dcf99ce596472bb7ce2a78ef26f0fc37eae8a0e57ef9911e1817e647e4ed256368ffbff2b518
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 a9d2aac65bb3d96c31eccbf4564def4164911eb66ac16393cd66dd110fda5b0d
MD5 1225c4b1b94d079064ebd9e624a43e69
SHA1 9b6f7821cd5c263c3dbfe04d5b3d654c3e41617b
SHA512 ea431741bf198ec2539446581242a1b8cc0777d32d302407433939bf5f352f9b0842dbe889d8fc32126a51c05aff266ad720ada496792f214fdd44b8aaaf7d1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 2b9f8393647aaeaa361b4183cd16102b5382549442bf41dcc5af43dcfc13bd4d
MD5 c5c3a79bceda312c230d71dad6017693
SHA1 bcbfe7ba1aff6c700391f32fcf2b25ed778d8b6b
SHA512 d36c02bef95dc78b8d3280f1d7162acfe5646f644ab8a941d9d93af50f8a7ef33c63aade09817f1adf3d864afc2277b7830c62148f20ace1f2a3ab53da10831e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\qap`g`v~dtlq
Size 10B
SHA256 223a054de464bffe19fb7f0010261b96f85a491bd27a17ca7bfcd622c8a4f3f2
MD5 79cbcc8a67f0d8b8a6c0936403665bd0
SHA1 8929d2dc41cc7ef0f7871d5cadebd94263dad22c
SHA512 0665dc46f194fe13e4877188041030d51b7a5ec9ea3a70285f560966818e0d5e758959d76bc1beebc4ae6415395e816f09f1a70c441de7f7f722e7d4f54735ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\hyphen-data\qap`g`v~dtlq
Size 10B
SHA256 f244011f9e795599ee5e67d05779592516c0a7bb34e40a1c576172f9b5244615
MD5 7a60639a1c4288fdb99a9af4d3f97393
SHA1 e11a574b55225048466c6ce5521aba8faee319ce
SHA512 ae6a22df87026a28aa3fdb64c8ad3c5d8defc5c787cd3fa2ebec123cae02dc37c45c875307241e812dd11c48a2bb344c659f7f9005a2d04dcd16ecb9fb205d26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 b7c89d2545ec6d00eef648e2407fc132fbf0f6163c82ab580389167bc7d85c75
MD5 fc8979ed28194d6b9954350ad79fb1c8
SHA1 16a841ea9d3a4045017bb3a82c7172932eb1b0d9
SHA512 a1af409e53e426d5cda08a60e178ce00bc32b37024f000bba4e9be44161088ebca31d929ff30b6feeb1fda3ef834f012f40f62e8cd782cf2f018619d7ae8b762
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 b205c4fa43cfbb247d19cdde1b5bafe3eafd81ada0ba8bc0572b9d43e27b56f1
MD5 5b16a6a81289b0abf197fd0550d7f89d
SHA1 fd7934ce6b5b949dfdc987886b75177567c27178
SHA512 0e49b5adc91d29e798c5fecc4ba8b8bb9d922f395f87ec29d1eebdf34d371fa9c2ae204d07e0a31d72582e1f6035cce12fdb08de7d7c8527862bc8c976074715
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\qap`g`v~dtlq
Size 10B
SHA256 d24ebbf9e245dd9eeaf9f86c3ad4cc3fe73a688e1174f938cf416d612f2422ee
MD5 ace1702c6ec23dbaa4e558af2acc7c45
SHA1 3a24e40289b3819faddda5ba42d38d04f184900e
SHA512 92520f594039877b91e310a59dbbfb6cd794675c0a8e1510fefc1c48a123f2be362da7ab082a9d1e4105a527cf49ea8f53432a560202e4d399b5339b35130c52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 345b5c5b8fe5685504010f43420b35b1a0b3f5751925b5860014068f8f94140f
MD5 6fec5bbad1216e73b82c6b55ac67e401
SHA1 624d5f461a380ec96cca817c6564705ac4dbf62c
SHA512 50452f7dc9082daf6aaa06d3b06138b371b62e0875a4ba7c5327e10d13e9fe32b3fbe813e5c99b62f4e8089c5ffef9d49c00dec5b1bb444d15dc4892d34066c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12473da6157ae4791bca81f030e52888cdbe5f35d7e3f0c44b010465c220229f
MD5 20415a5409c03295391d9d40ea9f1ce0
SHA1 2c90208cbc2cabeba9efe321b90dac8246422d08
SHA512 65900eeec691b4203d2c0422327a419aeda4b1c84f73f9cadbd7cf2f867646d4d9d179d952420fcc21a4d99c71cf0fb6f9fb396e5797b5c4e9a3f4b0e08ca822
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 562aa6fbedf6a8e24bb32d3c9cf889b1c9c7eb416b3ea78c17cce4b4484ab042
MD5 f1dde99894965e764e7db2d1616baa19
SHA1 e5bc86c95b43efe915655fa9de61eedc6773982b
SHA512 0bcd681b09a3a9fa538a05f6ea8770d5e35a63fd5f8e4ef62e9cb355664076e308af40d8313942f2912b48e88a6e381bf9449cd628b7583acf92f149dd503cfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edb2136f467df3ff2c9489d4c8745ea3d08354b253a2d8f08410642b9ab8ad95
MD5 142bb3af17ef2561a96536c86548fddc
SHA1 b106a350de2f873b48a556405d164a612279ce7e
SHA512 7cefe3b9bb10296ffee5ae2ef28bd889ff0e21f309cf086e3f4644bc8f2014f779aa533d1cd908c5ada7a2fcaf1426ffa94e81fc3bef350769edce1a523c74f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 234219f62fbd3d58befdaf0df390ef4c630875bd265b10cae5eda3daf484e771
MD5 be93fb4a51d041b2daf29b48533852bf
SHA1 f659c72c882306cd76dbcca7514cb783f607f2d7
SHA512 4b16a41b1c14cd5559601c694f36ba382145ed797a4663d6067aa46ee18d73acad6afdcfad950b95bfcc3cf87d54d22120138aae70fae6a944d43f18baf26a43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 36c0cb8afbc4c6f7f7f865ab93a7dbaa1cc7b86493db547db3ecc7ec3c419b04
MD5 8dc79e8c3997a41a4f46dcf8fec1b873
SHA1 c23498b183cbe2903e7596b008b58a0d33e6dd40
SHA512 db0e08f5cf1917078ea6eaa4731fadebddb8f68b4630b36bf65d6483c2e576c3fc0578b4def312f75f04faa96f1e4b092ccb3fb6e4a70fb2085fe66169d26f44
MD5 SHA1 SHA512

Submit Download

svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABCBCBCCCBBCAACCACBBBBABAAAABACBCACBCCCCCAAACCCCBAAB.exe
Size 21.3MB
SHA256 f8940f0085f6e24e574b46317f46860153f79d9dfcd2dce234688209d575ed6f
MD5 e8e3c5a06633b368faa2c06e621e8161
SHA1 d1a947f50e7d6085ad0e0e57417432f4a042e7cb
SHA512 3dc15ed5fe085461bd2dfe33ce0d8a33c9c813a622448913600d12f52f6e3eab62774f15c2b3d7a79ca22791060d9206c9de94d2cbe6bee9dfa535d48b46a5c4
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ES+EP/+ES+Ek+ES+ES+E2+ESH:hAAAAAAcOU/jIEeQfoR/IuOFVjUu5V
TLSH
T17A374B09F98740B1E87B51B04DDBD2BF8930BA2587128DEBF64DC71BA933B919834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fc93d6e874b67b2b7c50f2c79653e093b689f677348aebd0e7135c63236f6dac
MD5 951a827b68f82c79cef2ecc8da86da40
SHA1 9cb58141b5d870469acdaa6ad48f6e1fc2bf5d6a
SHA512 1ca02e33206ac919e91b25f9bb066c2231ebdae137252dc516686b7a2d7680d07fa8d1181cc0befe95a9ffb9bcdd863ff8e9746bc9e3015a506e7cbd42b63353
TLSH
T15321A46195F6D86BF9332CCB922D9B438CA4368F986CAE1423086218E7D9C71CD1D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9cb5eb3d8e8289e10a2bf0df7417ac09e73fc60c7483047568b66d5c1e543981
MD5 8e53d60efdda4352d08034b15745936c
SHA1 8e80767f53faf5f28786ca5f051b21e91a054ef4
SHA512 4365b796883c18915b5941073938999475a6c0642f70ac1d0c2c1507e382470c6b907e10f03c3b7868c587b171e033de0a4f254b298d11cfd9dc3d1835304fac
TLSH
T1A521B761A5F5DC6BF9332CCB922D9B938CA4368F985C9A00230C9218E7D9C71CD1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c4739011ebfed0d94b5035b741340922751a876abc752659ef9342a3c7b58c65
MD5 df51dc2ece7866134af65dc72427423b
SHA1 c64e80052764e344c17d325f8806eb9bb8a99349
SHA512 783deb49a0f3fa3feb3b46dc42125b9c78d8f30e503b0d5c55f01bb0329b61d024bbaf179587fc4009fc2b6d11d2061c9bdb5f725d038ac4efb7cb0609baf0b5
TLSH
T14511C15195F6D82BF9332CCB923D9B538CE4368F986CAE1423086218E7D9C71CD1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2884-6-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/3604-63-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/3604-3934-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4928-32-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/5684-1624-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/5684-4070-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download