8fa1b03eb3d3f1a75ffdceb877ab7e182a6f353ba95366f997fe62259e752161

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 12.6MB
Sample260827-134mpsdp31
SHA256 8fa1b03eb3d3f1a75ffdceb877ab7e182a6f353ba95366f997fe62259e752161
MD5 18548d6e348b0a263d8800237efdcb41
SHA1 1a23f0919da7105986ec5cf6668e21daec95d6c3
SHA512 6e90c99b991d1d503f2b773d36fb215c948fde14d51acc3563e677320fdd47ad6384749ecb7bfe2cc63a64aedbdb3034cb77432c1a515ce5c27667fe05136694
SSDEEP 49152:U+EW+EW+EW+EW+EW+EW+EW+E5+EW+EW+EW+EW+EW+EW+EW+E5+EW+EW+EW+EW+EC:iOU/jIEeQfoR/IuOFVjUu5w
TLSH
T1F9D67E05F8875076D82B40B00DCFD2BF8670FE6186118DEBF7CD8A5B5A22FA06639765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2516	svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
2712	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBBCCCCCCCBCCBACCBBABBABCABBBCACACAAAACBCAACCACBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe"	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACABACBBACBAABAABBAABACCACABAACCCABABBCCACCCBBBCBBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe"	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2792	sc.exe
5520	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1100	cmd.exe
4424	cmd.exe
3604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2516	svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
2516	svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
2712	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
2712	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
Token: SeDebugPrivilege	2516	svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
Token: SeDebugPrivilege	2712	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1100	2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 1100 wrote to memory of 1220	1100	cmd.exe	94
PID 2108 wrote to memory of 2932	2108	svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe	95
PID 2840 wrote to memory of 4424	2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 4424 wrote to memory of 2792	4424	cmd.exe	100
PID 2840 wrote to memory of 3604	2840	2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 3604 wrote to memory of 5520	3604	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_18548d6e348b0a263d8800237efdcb41_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBAABAAABABBBCCAAACABAACABCBACBCABABCBCABACCAAAAABACBAABACAACCBCACBCCBBACCCCCBBACCCBABBBACBABBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACBAABAAABABBBCCAAACABAACABCBACBCABABCBCABACCAAAAABACBAABACAACCBCACBCCBBACCCCCBBACCCBABBBACBABBAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe" start= auto displayName= "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe" start= auto displayName= "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCACACABBCBABBBBCABBCAAACCABCBCBACACBAACCACABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACCAACBBBBBAACCAABBAAABAACBAABCBCCAABCCBBCCBCCBCBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bf89feb529c2b24607e7988dd26e670d73f1d965103d15a25f1e24ff11e0b373
MD5 471ef18934c4f5ed920b9965a766f04a
SHA1 47095146550a9057ed1b0dfea00d62f4a03ee910
SHA512 ad8f3ed8242dd50c34ab797e59fce50cb3cdf5791f4ad8c4f07c90e66c36134b42d85717d64d296bea5219e0837a896dd77a92ab1f147632083ffff05a1a0181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\DownloadedScenarios\qap`g`v~dtlq
Size 10B
SHA256 f9b150090b4c51a9503f716e440c3755876d35719311d58074f8cb6b0ea03c0d
MD5 cebe7f257169e5bcb6d3e3339d01ab28
SHA1 02321e7aba6b81d3dab695ee727786566e9d34e3
SHA512 fa29a7cc069e7a09612b8095c4d4f29ee76dff7eef12ea34aff2d0d51c01a06fa39aa0c214d57c8c503c3ee581c13ee9f8d7153bcbcceef7e60d52e040d7c54f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 3c78f752fe5796c1ce5b506df3e7d3caa6eb70d8ae52166ecfdb730968673025
MD5 40d82518b9feb5b065eef2bed817043c
SHA1 75713405195741a9314f9b6dacae818df14653cf
SHA512 a11e9aaf29ddc5658c220f327e4a3470945181e1b6566a0f749092235059e128df7a93536c35aa70dceb9422a50ee226bd8a947fb807bace8ba1204c6ba55f04
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.2MB
SHA256 c0f65810494710b938d335468b999214ffb32b995697ee1c14d39494a0dc6afe
MD5 349725c4c931625ac6bc38fe10130b8c
SHA1 d3fe417cec1472dfa96ad5a20f511878e1efcc50
SHA512 fa1a8f170733d2bac90b8c89074f7f490854a496a7b3578a7d10ad329d7b50e9ba9a81266cfd1d2493f9f8c9298a816b1a25275b89a759a108b9243c34311770
SSDEEP 98304:iOU/jIEeQfoR/IuOFVjUu5vgZ2Hb9t+2xf:iFIF0wuBgZ2jf
TLSH
T1CAD67D05F8875076D92B00B00DCFD27F8670BE6587118DEBF7CD8A6B5A22FA06639365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\qap`g`v~dtlq
Size 10B
SHA256 7b11764c3fa179c32e44eaa036a10e334cbdf6582a284c98efc3d25c5fa6de6a
MD5 77fe6fffac1a334df0b8a3e9193b9d97
SHA1 45694d787444e307aa0d035ffa61786f681dd163
SHA512 17091f4ad05c6ad04f2eaef0bd1a12ac3d99da5a0ce991299b05268831b7e9764dc5b15b23f9833234d6c779254be7fcc131fcf4dbcc995d2bf2ff62cce8b3eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\et\qap`g`v~dtlq
Size 10B
SHA256 08593b9df1d99193665ee4472ac69073ba1f15e693cce240a22649bfce71f9f6
MD5 aeccdca4b2ba0f61e0dce0f944dfa169
SHA1 b7e24d781ae0465d8bb3094dd882638ed03aac9a
SHA512 250567a341beb085351441276e399ce73f786e58b8952e1d13a3fee8a71b3bceaa2bf74e970db2d79ebb73ab20cc41a5bf92577e3518b6250a4e8e6ff56fcac8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 901107170e02c5f29ac07f66d43b9c4d6e13522149fd44e2db3feb26b03ef1bb
MD5 c54fd0d689e4226fca5847d91c18353d
SHA1 c7e73e3bed858ff86932103a2510b88af00707f1
SHA512 811011a56e5eb9af7c40422e40ae494f253ec4068516e3eedd19916b666f085e18bf5fa56890f018b0b35f7885ae4287564e6d43f3bdbc5f50adbfc4e15b0794
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05bb35c3630221d6b8ad211f4404a885b5d36aa3be2f90182d1d97a57e04a0a3
MD5 0bf08e613ca9fd8add5e8e1d6e36b224
SHA1 4ab1578cd1cdbec6284beccf4a77a469789df2b7
SHA512 d711692e73da1111bca2060625b7ee63a15afda5d1564d307a425ce17380f98dd2e5e2d3ec8486b2d86fd3118238f56195b4ead2ebb49dcb6adc0d92f39fcdbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5db19369615706f453f74b9d4e7dcd66e0600c7edc7b773a22484651f5dffb07
MD5 2be5ce6831d7eb515d5370c02973e8c7
SHA1 03845ce0bb7007e21ecd2f9bcdf675c1921177e6
SHA512 9592741530930bbb24c1a238a20b72e7a36cf3b42ccdf02ea5494d7bc49cac62924de235daa2daadedd4d753fa6834b6f209e2a010f6cb0380a552797316c0bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 89015024991ab461a7a7235788335b8ee14e1dc8c82e91a1a85a2ec018e95945
MD5 718aba224164f58b2465514af0d94a01
SHA1 d6beef1c765f06a3cc5b2e4ac62268e56a968f62
SHA512 502b0309a060c2643f29d350c0ee2dd22a518925f8c2c3416f743e05a830967d3afca5e72143f4b03acee56b348934bde805dfa3c4362bb40ebd5736d8efdd25
MD5 SHA1 SHA512

Submit Download

svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBBBCBABBBABCBABABBABAACABAAABBABBCAACCABABBAABBABC.exe
Size 12.6MB
SHA256 8fa1b03eb3d3f1a75ffdceb877ab7e182a6f353ba95366f997fe62259e752161
MD5 18548d6e348b0a263d8800237efdcb41
SHA1 1a23f0919da7105986ec5cf6668e21daec95d6c3
SHA512 6e90c99b991d1d503f2b773d36fb215c948fde14d51acc3563e677320fdd47ad6384749ecb7bfe2cc63a64aedbdb3034cb77432c1a515ce5c27667fe05136694
SSDEEP 49152:U+EW+EW+EW+EW+EW+EW+EW+E5+EW+EW+EW+EW+EW+EW+EW+E5+EW+EW+EW+EW+EC:iOU/jIEeQfoR/IuOFVjUu5w
TLSH
T1F9D67E05F8875076D82B40B00DCFD2BF8670FE6186118DEBF7CD8A5B5A22FA06639765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2f0eab2be1943e63672036ea31b72a4f1ba1fc87eca719b144e502f4243d055f
MD5 214f43e7d62eed5b08554ea8b8f8b1b9
SHA1 f11cd89482e8cc9266fd6178cca1ff3e8a2010d4
SHA512 1979558d926670c312771c70e94c164e24e147eb6dc5c6d79b9262361ed129919f55e278d61b06aacb5bf745919967a39878cc9beec88722c0e9570d0a2bb239
TLSH
T1E3119864E0F6D867B83228CE5625E98218EC278E99386E58520D431CA7E5C395F594F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6a023a1aea72888ab80593deb50ef2d5346a2e711525971e63772922172b6028
MD5 6b092b625522f665330b060e191677cd
SHA1 8832a014a6d7fc8ec85a3734325b51e831207a2d
SHA512 bb81989488ee52288e7fa92cb8bd0818299bf07de75628c5d96892dcbf146cf8499f114d08ce90d6b30320bbfb315701abaf8de5052ad0dd10096dedb30895ea
TLSH
T19821CC64E0F6C863B83228CE5625E9C218EC378E993C5E58530D421DA7E9C399F594B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2108-31-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2516-78-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/2712-637-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2840-0-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/2840-7-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download