561e05310f8347fb52eab274a4a6b4485e4024204afbfe9747758bc374e197f7

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 16.9MB
Sample260826-kcs6aavfnd
SHA256 561e05310f8347fb52eab274a4a6b4485e4024204afbfe9747758bc374e197f7
MD5 cf773ffabc0d6e52ae2301cdaa53d6b3
SHA1 c5c96bb9b711976cb170b76d0d0a4f2d0b1be782
SHA512 f127e31406639c5b3322853604cb56730297b4b9e1163dbf534b84703f7b002f5066b1fba213fc5d5739838b4201bc712c8332f42276c973e72eb10bc0842ac8
SSDEEP 49152:U+ED+ES+E7+ES+ES+E7+ES+E6+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+E8:ROU/jIEeQfoR/IuOFVjUu5G
TLSH
T160074C09F94340B1D92B51B04CDFD3BF8A60BB2586228DFBFB4DC71B6A23B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
1068	svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
3592	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBCACCACBCCCBACCCABAACBAAACCBCAAACACBBCCABBABAAAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe"	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCAABACAACAACCBBCACCABBABCCCBBACACBBBAACBBCACBBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe"	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4964	sc.exe
4620	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	cmd.exe
5640	cmd.exe
3804	cmd.exe
4312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2616	schtasks.exe
4836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
1068	svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
1068	svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
3592	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
3592	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
Token: SeDebugPrivilege	1068	svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
Token: SeDebugPrivilege	3592	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4312	4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	95
PID 4312 wrote to memory of 2616	4312	cmd.exe	97
PID 5376 wrote to memory of 3532	5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe	99
PID 4652 wrote to memory of 5360	4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	102
PID 5360 wrote to memory of 4964	5360	cmd.exe	104
PID 4652 wrote to memory of 5640	4652	2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	105
PID 5640 wrote to memory of 4620	5640	cmd.exe	107
PID 5376 wrote to memory of 3804	5376	svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe	112
PID 3804 wrote to memory of 4836	3804	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_cf773ffabc0d6e52ae2301cdaa53d6b3_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCBCCABAACCBACCCBCCABBBCCAAACCACACABBCAAAABBAABAAACABACBABCABCCBABBCBACBAAACBCCABBBCACACAAACAABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCBCCABAACCBACCCBCCABBBCCAAACCACACABBCAAAABBAABAAACABACBABCABCCBABBCBACBAAACBCCABBBCACACAAACAABAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe" start= auto displayName= "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe" start= auto displayName= "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCCACBBBCACABCCACCACAACBBAACBCAABCACBCBCACCABCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABAACAAABBBAABACBAAACCCABBCACBBCCBCAAAACCAABCCCABCBBAABCBCCAABAACACBAAABBCCCCAAABBCCBCBCAACACCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABAACAAABBBAABACBAAACCCABBCACBBCCBCAAAACCAABCCCABCBBAABCBCCAABAACACBAAABBCCCCAAABBCCBCBCAACACCABBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABABAABBACBCCCCCCCABAACAAAACBBCBCABBBBCACCBCACABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 06087210813db110e7df864de1d35d2c81886b27824cdde368ffa8df25ae9420
MD5 84cfdedd3330339ad79b391ba6751592
SHA1 25be69f3ed2e91bc0a2b3998bce5519a0e76e70a
SHA512 e174cacaa92010627f078c0c0311902adea0ffbe9e50696e6a749ec0bffc86ddad182223930efc678ab68c385f08c15afdd43d570df743944ac3f6f81a70da42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a029ebe8093999d09401002623c87829aa11da9c1726a020058e412ffeedd46a
MD5 8aa764e8c61cf5d3b617fa2172bb71dd
SHA1 7887204affc6d1a7fbd529b6265f471d35a9e2c4
SHA512 e22e1ea9617bb08c780d4bc9d8293ddb738b85f6eb1ba159038b388498a9cd938244f6411bbd9e668aad880db7a8c25e2aae731fd62d94434431176ee76ba70e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Adobe\Setup\qap`g`v~dtlq
Size 10B
SHA256 a697b8e6debf6913ee766541c6aebf61d493fcf63c3c3f84ca7bbb1518cac823
MD5 188038ed6cc750b28d338dd958a6dd93
SHA1 a29803022c0da3632efcf16194555234744abe53
SHA512 32601c41b567a75d2e6782e8fbce41ad4eb9548e4a5994c068cff71aafcae732dabca25c50dc297b52956f91b5474cd04e3a8ee71567cd22a06436fb77676fd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 aad97806278b671972ae88add4a4c5e749aa8b20ec36c253673002928d8b92f5
MD5 064cc6b01c0737057056242d4430a87a
SHA1 c607804c4986c7d2bcfa95cf41df58d798e69295
SHA512 89229456c499077d01205c693faf57854d8c9cf5fa5df17060243d239a6449331616436365155f980b43d9aa5c8fff805b527a4818385878a84382854ac87066
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 97d88a48cd8b44923e54afa02c0010392ac17230927878b85c8d339802889d94
MD5 1200cf357bbe58c3edf4dcf78aff663d
SHA1 0c102e27b4449356dcf594f2fa88fea495bd0535
SHA512 c4235bc46ccdbb980418cc7aa3b160ce6f78ce278896d4548005585335f85681d79be5e74f4341a751e4d7f656ce4872bca81769b3ec2ea496bbbb4d56a4aba6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 ef8ea86462867a97baecb6a4f712b1b01bc26ec8a4f1f4ce94101e5a711d4af9
MD5 9c4006e8a71fc15ded00250e4939f095
SHA1 0614a8d6a684ce9370584cdc63af9f87e0f9f66e
SHA512 95d9050b6ed296e1222c7d62ff860fb48c64f302dcb125b375649546893253d5c6cb78709f1182210ce6fb4a1ac18d8ef2a5f8eb6659ec83d0317b28aa1e6f2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b3a86ae09aeb85e31d34225846b26ad7e47fd35e5e28bff08a3b1460e27be83f
MD5 c38582b993583616be3f0987c7a282a7
SHA1 1c176595124e654ad6287f2aab6360d278f45195
SHA512 68879979952bb50df4ee27a0516d4a34d3a06c44adc7e9b4c09aacd18de34777577856d38417c80cae7398a9164f8dcce88111eeb582bac944a70f3808afa196
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\qap`g`v~dtlq
Size 10B
SHA256 d8df993df8a7966ce9db8b419db4fd37ec52fab303665f42dd2ac8a1ad8a34c7
MD5 1181e462a14eb48192ee6e6b2a95d984
SHA1 48dfdf7d1dbbb0fd385562f38436e46ec9250c90
SHA512 6cfa0269f99dde6fd96fc6021a0dac62f82a7e3d33acaf3a142f73883c7a76d9bcfb3b45f091788cffa4a2c19872b17aa437d2ba491fc0da8a676c3c52057288
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\qap`g`v~dtlq
Size 10B
SHA256 05e9aba4d86f2120e5fdbf9c276915f7a67c1e8e06db66f13972e12ad8b5c32d
MD5 62380d5eda26dba07393013166b9be43
SHA1 3acce99752fae1469095fbcf618201a52c44eb25
SHA512 059a91f4452efff4f601b344273b1351ad38d3f17288a80f071ebbc494cb9935fd81d77f5224dc8354d133a6443e091db993aa93a8ea9314e2a092765549dd17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 40695a45c927f31d7788bc3ed51decae4eda5eecebb02c37f7ec9e4a5cad37b9
MD5 3f4ad793b6eac6b7e53e9c7be8d3462d
SHA1 2083dca709b35551175251d8e9b1793085c4f5ce
SHA512 f0ced3864289b9e3110f9c15aa36c0f2883d3218d595b36c50dae31fc8275231c1566207f7754bb5e048c477edf432305d776f946bb1f9480b0a39854c3c4307
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 544b84a100d935a25749df3eb2c0ac0ce3d690df5ff76441859c4fca6641536e
MD5 12669fab5b2b66816ea1940a06438ca7
SHA1 21dca42c9c26f8df6daa669d278a4d3d0f23ea1e
SHA512 a35c4cd1f63b3580b39710759e23f2d958c8610689ad1157313ae0e17b81368ff69d3f1d829f8b9db1c68440df5c8fcecd863e0f4e838fe8ebe7726cb04cce09
MD5 SHA1 SHA512

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 960KB
SHA256 87b57fe36084d6a757164081c8bc7a278c1fefa4254f97e544720285cf7dabfe
MD5 e96ef7e15df7ba163612315565154677
SHA1 ee547cb49978e17615049b5c4876681809905804
SHA512 691f2eaf1914a946dccdce8452027ad7e2fc63f0612497a2f45f143fe2a7681832e2201c97e86f11f4c4aa4581b09a26912d0e8b0b99f01ef9916f7020462b34
SSDEEP 24576:m9+EM0g29+EM0q9+EM0v9+EM0q9+EM0q9+EM0v9+EM0q9+EMj9+EM0q9+EM0q9+N:U+ED+ES+E7+ES+ES+E7+ES+E6+ES+ES8
TLSH
T195250A09F94340B1D92B51F04DCFE3BF8A60AB25C6128DF7FB4ECB5BA923B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42b740be4cddca254cae255a6eba2b599f24c897240638abcabda1ce6a1e561f
MD5 fc6eb61d721ac93da4890cdbc7a44c0a
SHA1 99f3f8fa775933f8d84c81df6bd9e1d6b9dcf8ad
SHA512 ed6dc5720f66360f42a84dbaff745bb09f0287044b16da5fd31f23b706ad826364649ff4d582865b4003c9fbff1981933b2908e6463a1314caeb8b8288051483
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2642c4ca7f2c7352b936436dbd3f7eebb54fbf3d255108ead2e3d1e211da371b
MD5 ddc43168dc5fe9ce1016dde54bec3bd5
SHA1 9ef283865047e5f616c9f478a012a5514dad45e7
SHA512 063aac674cee6b9bcb701e05f964c2c13a8e882917e4b508e9041a285ff55219f682d60e874475c80d47f2a0e9e89750a14eff9fa15537dc15d976ed0b13033b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aec8d74f09097a12e70ca8a24d25e576546d12b7ec43379ef309fe8b5e1e6ab6
MD5 308f2e439f2492f337ede343936407d4
SHA1 bdf606651efd3ed1f807f695d7669428f267927c
SHA512 30795bb3141994d26b899384a6cfe3f3411fed210ab9c925e04674d9d7e7527838111cecd1b34d0ed2e2927a4daa8bdeaa62f24460f6eb96efd1d1204335c4fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df6417d34278c3a185c50e61bf2a4156ca3b4691d0f595b5a80078ae5bd5f3f3
MD5 c87cfcd82c87d49b55cbe5014ea4b7f5
SHA1 10f9b8adcf11b1afeeb990108c18a59bd74c1c09
SHA512 32dd667cca0372802b11bdccbbae7f97080e518ad3ef370c0140a316c4c279054a21d7fc80d98f5d4330c032dbc4131a1fa64cdd638655dd2ec75d1b93cbe272
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 586df01deb02b36b602206207f112c9ea203aa1fc3d4aa242e44a0d5481f6f9c
MD5 aa6f35dd14469b0c9554d24b16e9ecee
SHA1 7064d2f6537200ade3d1ca6d9084dd0cba8a3dbb
SHA512 66ca9bb322fb105fc0b0d84e3b7b69aac8dec2b09b0bdb474ba7ffaba447723198c361056438dfa386545c332de1e2f5d81b4a74d364ea0303802c9424957977
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 0bb1ad4499d7d3e913ee5af66f3ed1e5bbef698ce4a77f612a23f642a0dc8a58
MD5 36d41742da2abb08f8522adb81f9bc80
SHA1 b25471b85c8f53713d5183382233a83cd09d8283
SHA512 23f753f3477ca274bffda11893cb08d4c5eedf68784736fe3b29c3f51ab5d99c9c8c1f7e684afa752821f908f4f902a2dafb5c77560a131d0e81a2421acf0537
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a04f5be55a6c02fc078f1cdff6542514c55a3b0675ee37c305cc593d58abad03
MD5 b6619ae9879538eeed1aee28e1e07a6d
SHA1 ec2246ab0ef625ebb28754b72c1e97257252ff0b
SHA512 29b3ea03d2c8f35e3785f8c61fbea4e2ea652720a23d7422eefaca1d31b6e898873cb3d11114733c6e56fef71e673f2a0614780a6aa69a873887e7415486b6c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f3faac936225e6e6761cfaef9a66aa82f4c936f5fb5e3b61b077b1b8626efad
MD5 440d4ad47cfd59179308e2c08d2a50c6
SHA1 83ba576eed2b6984c8db84d0a53f85b0305753a6
SHA512 70c4584af3b96cc6b660a8073f860168e13d45843f0945477dba518efa998501b5d509bd9cbd60a93430899ed0fe84d26fef01fb028d287dae5be30a73ed23a1
MD5 SHA1 SHA512

Submit Download

svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCABBCBBAACCBBBBBCCABCAABCBBBAAAABCABBAABABABCAACCB.exe
Size 16.9MB
SHA256 561e05310f8347fb52eab274a4a6b4485e4024204afbfe9747758bc374e197f7
MD5 cf773ffabc0d6e52ae2301cdaa53d6b3
SHA1 c5c96bb9b711976cb170b76d0d0a4f2d0b1be782
SHA512 f127e31406639c5b3322853604cb56730297b4b9e1163dbf534b84703f7b002f5066b1fba213fc5d5739838b4201bc712c8332f42276c973e72eb10bc0842ac8
SSDEEP 49152:U+ED+ES+E7+ES+ES+E7+ES+E6+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+E8:ROU/jIEeQfoR/IuOFVjUu5G
TLSH
T160074C09F94340B1D92B51B04CDFD3BF8A60BB2586228DFBFB4DC71B6A23B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 92d5898adaa24a9e0fa1460917af0f566374445279f2f02b5592572bcb6c472d
MD5 dc51e8e38cdd714a63950e315db47b60
SHA1 7a044b96ba5b82eb1c39651569173d0513b033d8
SHA512 573eb31d994ef019b431b827eb47ddd7563858af197cc7f3d7f7628738125bac0f3098463778c9db7a0d09aa0832e825b69875f045a84d51ab642da1bd519fbf
TLSH
T15F21047090F4DCA7F632288F9729DDD218A5778BA8DC6F8472054218E7D9C34CD552E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 24ffdb0bb48c753989f1f18da376048357478fdb464e0c5bb02b86bb10fbc4dd
MD5 5eff4cb3ecde1303ebb7cc77cd7b0f07
SHA1 8527df5f3cacd8b9267d9851b3607c045fd99850
SHA512 9b19137f82b22fb924b9ba37919e67b06c5fe31b1b1b3e34d5d6a4daeef98b2003f5bd376639d163b2552ea7a0dffbf63e3fc06350d7c3d611981ea6b52c813e
TLSH
T18F110430A0F5EC5BF632288F97199ED218A5378BE8D86F4432054218E795C34CD552A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-105-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/3592-3976-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3592-607-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/4652-68-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4652-46-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4652-10-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4652-102-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4652-21-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/5376-47-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/5376-69-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/5376-32-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download