ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237

Analysis

max time kernel
151s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Size 24.0MB
Sample260826-ptasgsdq5v
SHA256 ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237
MD5 b589d44a4b0aa7d2a3cef0382a91c562
SHA1 6c8d515f7f99b7f346489400c900dc0dc5c45d8d
SHA512 96bf64fd36505107fc5b042d352b2a10d75bcb452a9cdacb135720714e09e15328586112f9a2fe9b8dc48b7688889028e1a5d143e4d7b15668d2e1cf3f60a62d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ET:LBPp7xBPp7B+4jE
TLSH
T174472A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
1576	svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe
3304	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACAABAABACBCAACBAACBBAAAACCCABABABCCBBBBACCBCCBCCACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe"	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBABBCBBABACAACBABBBBBCCCACCBBACCBACBAAABBAAABAACABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe"	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
612	sc.exe
3636	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3192	cmd.exe
5056	cmd.exe
3088	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5424	schtasks.exe
5264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
3304	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
3304	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
1576	svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe
1576	svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
Token: SeDebugPrivilege	464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
Token: SeDebugPrivilege	3304	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
Token: SeDebugPrivilege	1576	svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1136	3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	93
PID 1136 wrote to memory of 5424	1136	cmd.exe	95
PID 464 wrote to memory of 3692	464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe	96
PID 3344 wrote to memory of 3192	3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	99
PID 3192 wrote to memory of 612	3192	cmd.exe	101
PID 3344 wrote to memory of 5056	3344	2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe	102
PID 5056 wrote to memory of 3636	5056	cmd.exe	104
PID 464 wrote to memory of 3088	464	svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe	107
PID 3088 wrote to memory of 5264	3088	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_b589d44a4b0aa7d2a3cef0382a91c562_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBABCABBCBABBABBCBCCBBAABCCBBABABBCCACCBCCBCBBAABACAACACCBACBBABBCAAACCBABCBAABBCBBCACACAACCBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBBBABCABBCBABBABBCBCCBBAABCCBBABABBCCACCBCCBCBBAABACAACACCBACBBABBCAAACCBABCBAABBCBBCACACAACCBCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe" start= auto displayName= "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe" start= auto displayName= "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBBAABBBACACBAABBAAACBBBCBBCACCBCCCCACBABCACBBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3636

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABACCCCCABAAACCAABBAACCABCCBAABCBBCCBCCCCCBBABBBCCCBCCACCACCBCABBBBBAAAACABBBCAACBACBBCABAABBCCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABACCCCCABAAACCAABBAACCABCCBAABCBBCCBCCCCCBBABBBCCCBCCACCACCBCABBBBBAAAACABBBCAACBACBBCABAABBCCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBBBBAABBCACACBBCBCCCAABAABCBABABCCBBACCCCACAACBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dad08e5d51739f740891fcec9eb04bceebdab7e3b32c1e69d01c5476f7340b0b
MD5 030b1d61850dc4b82eda75692c7635ee
SHA1 559e69606b5d8236fb12ebf7eec0c75c025b5c67
SHA512 0385a0327f51e7c00ad72e1702aeaab4864110da01030c94a35710ce52448bc03555c54aa4bdff3313a6bb43c9de461f73c6760953d713b0849d5e9f3ed34a5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f92a33440df7f263901322a11c9d58fa0173a99c2dd6c4d47c00c89a6b7f5963
MD5 1c8a084308fd7e61d70f40aac7d4ae2d
SHA1 7ab129156ea18e02e3d6cfbc20a97099b3b7a6a7
SHA512 abcd3411d525d34721ccaad3ad4eb6ff1f95459021af7c778617ce3465d42e092786e784a07284e2b95729f86980f095a8bf957c2eb95351c0a0d65ca80c79c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\qap`g`v~dtlq
Size 10B
SHA256 8cc42138052953b9cbe467a31d1e2880f144a58f83f6da50c80a068b74eec5dd
MD5 8b3e986af1f433dd07546acb988f263d
SHA1 0b4b675609716d0ce64a670aa8565bf7df9581b5
SHA512 cdb0b2e03385ea0a66218d8d2a08878c04906a70c09adc2adbbf24f783ef4a690b24ea6df7bb531a728e3a9fb6ca72eab0fbfe498ae967e0917064e3f1038854
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 24.6MB
SHA256 279a145f961f990d641390a5e9b9ca45163d780e710d7d89fb4fcac117a1298a
MD5 2821ec96ed8b8ccb543c2e86a883bf57
SHA1 ac9f2420af5e7fff7edb4eac20b2ba73bb61188b
SHA512 1983602a66eb77671074b60ddd5b44d045475b6aafa8e2bb87a5b16ec8196e83b2337896eca15a5447518ebc38ab43e56a35da08d9e396246b9537bf333ff2f2
SSDEEP 49152:U+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+EN:LBPp7xBPp7B+4jjgZ2Hb9t+2x4
TLSH
T1B7472A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 1348c203ac4256d7106c046f76c31b550cb7aa81f563729d839f316fdfd4d50e
MD5 6d1cb3360a88a63fe1a303a8b7c95fed
SHA1 31dc9ee72311d38f9b154889fce8cd871922b28b
SHA512 2b9735134ad0cf540725fd335d076d5f4ba6bdf0638cfcb970d983ecb2e752070f55b4fb5971c1451ef7bdca9f602c9c0b1d8e42507ce5a3585446a16941cc4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 747bf6f77310e6603362352646bfad5328170de74253b252dd628bb0ef75f43d
MD5 a7de6f1704c0487523fdde128826b22a
SHA1 b4fcf33943d1cc560820c8e624dd9d516adeba25
SHA512 01a57d1bdfd2eff84a2ea67280fe48404bb19eb8f0c5cd50b6151fa73c2100abbc0e8f23076f05103e73ece80425213bd139ca7b25e7f56455e3829cfabc121f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 44449b2bf2ba167cf32cc01f05af485f7ecdaad02572e1c365d9e606a1e215f1
MD5 89caf8bb13a604411a0af0b1b7a2ec86
SHA1 2dbede71d403b9365449e32c0bdeb0688443658d
SHA512 69dae8bc5c270e62c6315b6da2ce45a3c1ddad8e7499d9d086fe8d554d6d944c0ad247eececfa8eb4ec8658a95216d60011026f8f569d5cbd4edefbd8889e0d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\hu\qap`g`v~dtlq
Size 10B
SHA256 9d723e55e6e474bcd767348220187d8fc396aecaa78e470ef9c568c3aa9c1f5b
MD5 a98414cea10cc692b3802283661b4fd4
SHA1 30663f0b31dc3af40539eff40024437d3b749732
SHA512 39ffe2d0467462d19425c7be5f91825da22599f5567785ec073323e8a667b0f6a2d67f98d64f42f0ace5d9f22589ab3b12e33140cc5ee989f7d1ef6df6c6618c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\qap`g`v~dtlq
Size 10B
SHA256 045cf925090f7e29f741526d749bd9f64d6d1425ee212651b997848611887bed
MD5 5bb6a90a12a737fe1a23cebb637d3c0a
SHA1 c2d1995136f252d33442a92cacb2a31dcaa6aea4
SHA512 40fa0bb3d889ee53cafc8e02f5fb1083878524040b65a2da6f183f19ef68e3c7f6798cf56b1ab55296aa472c23233979817736e438860c6e6b73f7b967c0a63f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 155bdab974cb2a068f80d6f80f44bff00e1dec4cacde989aa3b79616fcaddc21
MD5 03861d87627ee4dbd15499948f32dc84
SHA1 cbcdaacd3828847afa80ef375e5f928fb9bb9e02
SHA512 4738919322a413190754e22b5692a427e156d72998a3a0c4e353ef64be5f6b4c1d529964ca7852a6d1979289735a1967a75e0a872d24323c6abd57fe09a94809
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92ded70b6a494ad1c97dd56a326d5a0bec91f5f966fcfdccf7f4e0ae6a55c480
MD5 8144ac9d57908f735de3c54f23f7d67f
SHA1 6aa405de270ba8117762fbe1101d55c68d6533c7
SHA512 01811c7f05b1ac45f1ffaecbce2d53389aa407f0fbc1ffb9fc2302762398f446f300857d5120e0d6f81b96117f89134a8807238128a9ded850f3766a88578f51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84269b308c863f2c92b3ba07f1a51b4a2c0ad65e77e7dd41146ab412b0869157
MD5 7c3b379f82ea6f579385a6b37d427d75
SHA1 60126746f537d774fdfff005992097123218b74f
SHA512 47b832ec32c900782009cc258769d5a8a4751f3c3427833c8dfa8c5e9dba4293245b9ad67e6fad6ee7d52b778d2b91f1fe0286ce7aaefdb2a05119a74e2f6242
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6481c8125a80b3dd1fc9fe4c86e8d220a45c838feeb03b760c0854b653c5e49e
MD5 6416444e7e9b36c547d78e90f000ab43
SHA1 9cc11ad904fd1808e3b088482c9adca372b00807
SHA512 b53e54e49adbbc0a007ac845679a002d8a3ee1e1a975daed6e2fde0e27d86a509a38c821a2b5622257abb50e9f59f01b74973af43cde52ffd2c880aaa0289d1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c4c8f2e9e90399f89a0d13070f8435b801fac38b1d55d12d0f65dc2bd2d5b8d
MD5 d8dcb86062acc21698741d1fc439c88c
SHA1 b3d1360cdd0a01fa6b1301d56fb97e1108b184a5
SHA512 9224f3cfbde9912bdb45e82fbb548892d85d87edd9a1d3cdbe4aac6922919cc6e5332a170a536ed51bbe1590f937f15e4d017052ec071b837fd5c680caf32b44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fcbd55429522c8a1c497a1623e3a59c6f91da6822c59b36fb5a2573f73977be3
MD5 c27503381e429d0e6bd48ddd138fdc96
SHA1 ac437a296cee49dc702244123079eb0174184ae2
SHA512 096432c5781b77beaf7b0ab44556733ab1f5b0e77e88ae7a6d51b27c3e07bfce6a5b57001b9f1a46d8479e1336146c1308aa13277434e86f7e79acd1cbf66f4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
Size 10B
SHA256 8bf28bba2962560289ad035f82fcef80335436560224e0c6e393b1b988b06184
MD5 55cffd68fdc6e898cc5e2934217a6d4d
SHA1 b46e5cd6fe34a994c9a6a7c22d1aebfdf83db26e
SHA512 575ec79e1adad10ede1d7a4058f01b617b1a87db39c4427d2bb4000c05548ef3a51f779e0b60f8ec4b5f8753fbabfa10b428fdd784ad9a80771c3c2cd9c038a9
MD5 SHA1 SHA512

Submit Download

svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCBBBBABBABACCBCAAAACCCBCABBBCACCBBAABCBCCCABBBABABCB.exe
Size 24.0MB
SHA256 ef43b4efbb9a766ff37042d92a037b47d7c131c9a669ef916dc1dd931653f237
MD5 b589d44a4b0aa7d2a3cef0382a91c562
SHA1 6c8d515f7f99b7f346489400c900dc0dc5c45d8d
SHA512 96bf64fd36505107fc5b042d352b2a10d75bcb452a9cdacb135720714e09e15328586112f9a2fe9b8dc48b7688889028e1a5d143e4d7b15668d2e1cf3f60a62d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ES+ES+E7+ES+ES+E7+ES+Eg+ES+E7+ET:LBPp7xBPp7B+4jE
TLSH
T174472A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4DCB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ba63b78a45b50a8adcac658ba76afb68b6d711b1b250a59b28d1bd72144e4060
MD5 129915d7e9db03103bc66e4a5385be30
SHA1 374e7769bbd26e0a8849c9bd2d4ca1f73758fabc
SHA512 c78b46e6a93f242a43399bdf27c7daa4e41ecf857a7724c52e1c7b5a31bb87e050ab75258ff2ee6d1328afeedb8b173eef1ad75259ca4aefa5e5dd690edc3de8
TLSH
T1ED215B60E0F4CC67FD3368CB5329DED228D537BAA89CBA581205441AB7C9C348D991F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 318b313bb653a8c8138edd4cb2ef748e1df341f5bc6e9543d1b2e24c46662436
MD5 871790c655c85fb4232740f7a739e33b
SHA1 e9fb9585f0fb6cd7e70b61de122d7d5a29824fd1
SHA512 3b0208c78d63dc2d072597eb15a9e3697625c9bd60c07230e3e255b81dd7542d17c728b6daa03929c8b866df83c0fac7294cccc0f7fc2e170d1287b6bd3e0b30
TLSH
T1B8213870E0F4CC67F933A8CB532DDED2189933BAAC9CBA4812094419B7C9C358D991F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0eb81fa21774db2682074b6b2aa1e1f6970c8aa38a547ad22d7529e47e6d2c3d
MD5 6213466da2fcc9a0c2bcdac14ea9854f
SHA1 c8ce96f07caa2597747df489bb979b9a866c0399
SHA512 94f51882066ce10d77998a93a4f0aaea4e80c35579f7a9742169ae71cfb9b5902a33d01545646d68766711229062a43845a5d4acd96cf9390141b588d373a83c
TLSH
T154113A60E0F5C863E93368CB5329DDD268D533BAA89CBA581205441AB7C9C348D991F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-33-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/1576-63-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1576-2424-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3304-86-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3344-6-0x00000000005F0000-0x0000000000611000-memory.dmp

Download