24c19f989d38b96599416c0cb4fa1ee736da13d862dac0d464389a7a96ff2677

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 3.0MB
Sample260828-28f92aep4x
SHA256 24c19f989d38b96599416c0cb4fa1ee736da13d862dac0d464389a7a96ff2677
MD5 0483cd3afe09d8ea69da4fc5f6367adb
SHA1 bc7366b2680f572c77ef63e5ade0811fdd2ab9ee
SHA512 51b90b7bdb36e808ade88010315af91b30db7a7455257928317c282914509c0e89af2dff2ab8ca1bfe75f8ba55278fd887582d943ad90a7288b2e776e4df5b8d
SSDEEP 49152:U+E2+E2+E2+E2+E2+E2+E2+E2+EfOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMK:KOU/jIEeQfoR/IuOFVjUu58
TLSH
T1DDE59D11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4268	svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
4036	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCAABCAAAABBABCBBBCCCCBCBBBABBBBAACAABABBCCBAABABAAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe"	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBBBBAAABCCACBAACACCBCCBBABAAABBBCCBCBBCBACCCBAACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe"	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4232	sc.exe
2100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3480	cmd.exe
5052	cmd.exe
984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4268	svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
4268	svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
4036	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
4036	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
Token: SeDebugPrivilege	4268	svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
Token: SeDebugPrivilege	4036	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4612	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 984	1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	96
PID 984 wrote to memory of 4460	984	cmd.exe	98
PID 4376 wrote to memory of 2856	4376	svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe	99
PID 2856 wrote to memory of 616	2856	notepad.exe	100
PID 1540 wrote to memory of 3480	1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	104
PID 3480 wrote to memory of 4232	3480	cmd.exe	106
PID 1540 wrote to memory of 5052	1540	2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	107
PID 5052 wrote to memory of 2100	5052	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0483cd3afe09d8ea69da4fc5f6367adb_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBBCCBBBAABCBCCCBBBCCCCBAAACAACCCBAABABABAABAABAACCACABBABCCBCBCCBCBCBBCCABBCCACCCAABABCBAACBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCBBCCBBBAABCBCCCBBBCCCCBAAACAACCCBAABABABAABAABAACCACABBABCCBCBCCBCBCBBCCABBCCACCCAABABCBAACBACBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe" start= auto displayName= "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe" start= auto displayName= "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBBCACCBCCAAAAACABBCABAACACABCACBBBBCCAAAACCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:616

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAACAAAACAABBCACCABAACCCACAAABAAAABBBACACBCACACAAAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a54ea22400f58fbde11f38656f6581364ab547945627e4225bb95fe7630b2528
MD5 2f201b9f771cc8949b6fca8309ed10e2
SHA1 54ebb26e4b0b33cade82ea4752da9b030488abe5
SHA512 297f1cb89e1c6a06ee363aa1ea7395977b3c644672aaf8b5b7c7b32ac44d4d677c36764b441daf9b103fab170b61a7c3925655fdde35746e5eed3bd5785e7e25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\qap`g`v~dtlq
Size 10B
SHA256 9362cc7b865c7baa07182df0067c4f06cc5fe6f515b4580f8efb473962478d95
MD5 3a97fd5befaa550eae29ad89b4ea8fcd
SHA1 350fff5fe29ae894f60c40c8548d219e58a7f39e
SHA512 0f1ae56aaee0e5da769c4d1675cb1ab782858e3e02e3d758b4c80399718373dd44b21b071b909a56b31b6dd01be59d758ee5476ca25f11d119cacdef73030db6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\en\qap`g`v~dtlq
Size 10B
SHA256 1a21cb9c8050b3d6bb08c438f814fba546e3bbc365328135808cd2bfe4beec77
MD5 5d712c9a96b9ab31736a39d28b475070
SHA1 5ff428ef812c3ce04329c17b036f7fb3edfc6f37
SHA512 b7e79c065ed9b39f8f75152502db6fdd3d3b0f64cca23541d9e6d083e1203367b3047e29b24ee62176bea85c0d7cc28f470d21406ea02c2afd38d9f0ecac3957
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 a916217c5f986d7f6296110d529132a141a4a2529d6d83dfb0442e7130390965
MD5 dcbc6af58eccddba7f2847bf0d31a044
SHA1 489d29e0b5b0ccb4d773e4e8afe71e7b41c81f42
SHA512 981b42b6b0b008f46db317d19750b051e7a93c0a7a0f30004b98fd2d8e14bc165f26993a2296a0f7a08e0d4112dc3205cb875789135d7c8c639ee0c1f71b1eac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca2769d47d9ce2715311adcdb741fd5c10c80386f5de0c5f5c28843d9ac69e84
MD5 44004d416c395b50d62b3d35e78246e6
SHA1 a46dabf2019ba9a8ceb3a6e202d8091ba293895b
SHA512 9001d983c403f0d4694cc628abd1ef8f98d657a74c852aea04e5904fe80e6a389c033ee191bf741b2f7bb38529261b3991d85c054ec783846523ddc15c622312
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7beb7e422fe788bbfe032d0d07ce308dc4a6443b41fa417a7239e12ec10d3c7b
MD5 4eff94aa5626e838b23c9620ac473cf5
SHA1 3a8564970c63595879b5b57b8b94fcae723b8f91
SHA512 05122cbebd5f178ddd0c1b516708a15c5eb1770129094e121f2e439d6e326c05279853b2bdc33c5b9e015039cc12146bbf95cc5c87938f2bb53adc5ec69b829e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa9b127195a3887d5859c9a0d76ac7e7b31c5320bff3d61893639a9a7afa7d28
MD5 260fd8ac33def4debb6488801a66c6a7
SHA1 24e12fb035223ea65476549a1f9f7224bf115939
SHA512 e4c5ed37992ad684b3ec7575f65f710d129871efee4e139fbfbaf1137fa85838d5bebf4156cefc33bf80c473a288e051baade393424999e1ac817c59c233f26b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42eb37a2ce150dda485692e5c877d65ee112f5f269fed6e675c51d687b3f4668
MD5 c7af29d0b36e7e4faa7f28f465035ccf
SHA1 bdc91dccdfeeeb87ec45476a451014fd0f9de046
SHA512 1c0a1ecc080f46388e2218576b5391f23de6613a6e67dbebbbdb6b9148fb170c265173e03a0ebff2e56614b46a6aa0c8094f264632c19c44b9ac1b29db805721
MD5 SHA1 SHA512

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 832KB
SHA256 0d0ae5d3fed1aa82064394e089fb06e9fe4e1131f7030a00ec1795a5378ee552
MD5 ba6397b651a085b455cabb6d1465dfaa
SHA1 77cd58f6b5051aef6d95aecb137139b4a2e78a36
SHA512 d1223e8691f32931ee00bcb4a117a9d7ae45cade0cf60079f5137a2c9a7975d49ead7d53dc44cb47368a540f4c2baf9026484526c7bb754d1034d6df406b74b6
SSDEEP 24576:m9+EM0K9+EM0K9+EM0K9+EM0K9+EM0K9+EM0K9+EM0K9+EM0K9+EM0DJC:U+E2+E2+E2+E2+E2+E2+E2+E2+EfC
TLSH
T1F0050A19FD8344B1DD2B51B00DCFE3BF8A60BB25C4128E7AFB4ECB5BA932B215418655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 39.1MB
SHA256 425fe34edd373cbfee1fda5477e7676a14f37b7e26eb321f524bb8c6ba8aff46
MD5 bdf5b4932a390bbf6d643a5134dcfc29
SHA1 72ced8875f62a986b05b5ae87f9379e4e03772ca
SHA512 4bdaf38ff516188ac1043b2a0abe56f769ec784f41e1c456a64a2364ac35f596e34beafca9c5a2b2fbd4837d4f4b673d2e0d63541546208948fab23468e0a4cc
SSDEEP 196608:KFIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wut:Mnnnnnnnnnnnn3K4
TLSH
T15E979D11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 18.4MB
SHA256 83909efdf0c35e63c0b509b2876073689a1bd7271c2c420020f103e33794d7f5
MD5 4c411222a35746563ac6ec0f6228702f
SHA1 e53c26c06ba52b83f187cf910d159b0043d2594c
SHA512 c4a0f30fca30a3e8fb8a24db8043aaf96e6f40d30309a7762d6cf61d7d2aad83f65af6101d5138660299c1ddfc79fb916e5e2f2391db6a18dde131a1d08e09b0
SSDEEP 196608:KFIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wuUmtb8c7:Mnnnnn3KA
TLSH
T1BC179E11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 21.4MB
SHA256 9c08026ae78103423754b11bed17c87380176e1d40b9d50a488d20d57cd3eab2
MD5 97c4da128ac1c9ffef5fe1d24289a701
SHA1 5acec1403699f5cb0c5062869cdb039ef8b9f948
SHA512 f0c568ecaa199136909561159547c5293d5bf1becaac043cbd45576d393cd175971bfeef41cdf2387cbf13c42a7b569c9ee862196289d94948872df764455a55
SSDEEP 196608:KFIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wuUmtb8cL:Mnnnnnn3KU
TLSH
T154379E11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 24.3MB
SHA256 252d711b2c030613a276bd74385b170da04a9b99e677c66037b03f22ba897b00
MD5 720b701ba8d9688fc5c90d78d2bf7c65
SHA1 1b1fffcb888affc7b0edb5d63ea792c387d61437
SHA512 f54c7181d997d307c3583161f88154585377e88b7f71647720a5fce6776e009088625449dd009598e4300f28d3876ffc575a41e2bd92bd549fa67826ad9c1de1
SSDEEP 196608:KFIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wuUmtb8cl:Mnnnnnnn3KW
TLSH
T1AB479E11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 30.2MB
SHA256 ed784f1c8b1a408212b624d91bbbd63dbd48b66fd959249cb7f312d246712bab
MD5 82c38b39c094751a7503a3f2b76e4507
SHA1 981f175701f96bc0d59162471d7c422f745a485d
SHA512 d6343957d01203dde2aa411b4a729c86aaece5e318f09a12ca3f8193e601bb965a10dc4747c06bd02e1739289993df1c01c3a36ea2cb4d293fa407ea61c869e8
SSDEEP 196608:KFIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wu/FIF0wuw:Mnnnnnnnnn3KL
TLSH
T137679E11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 eb9c28b8f394d08b2a7eb3e7971ca9cb5bac1f5574696076d9e8ddf0ebd1a44a
MD5 1d33ece57152fd989e8a66002e1fcfc0
SHA1 8ef00dbc8a23a6f44922418dd87f013ff762b6fc
SHA512 c1677547ff0df3d9b9fb02899b9d2f95f7b967d7f4eeaaf0b753c23109502439a4411efef7e7dce8f12ba7fee825d56211885dc89c7f7c5e9273d834cb15de70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 53c4ba3594a159925a8c25c2b6224dc008c4399e15ef25305944cb618c97f3ef
MD5 f90c56c9de05497a600c27c593b68f6e
SHA1 29b9cb06c315a64867c840cc446395b1ec70ebfd
SHA512 bbf037d25a03c4e85de875dfadc0ba6173d0a7f48e48f95c5bc3adcb4e231b73361a0964e3d486c19c2460b75b489fe874261487989ceb37651921ca9ecea7a5
MD5 SHA1 SHA512

Submit Download

svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABBBACCABCCCBABBCCCCBBACAABAACABABCCBBBCAACBAAACAB.exe
Size 3.0MB
SHA256 24c19f989d38b96599416c0cb4fa1ee736da13d862dac0d464389a7a96ff2677
MD5 0483cd3afe09d8ea69da4fc5f6367adb
SHA1 bc7366b2680f572c77ef63e5ade0811fdd2ab9ee
SHA512 51b90b7bdb36e808ade88010315af91b30db7a7455257928317c282914509c0e89af2dff2ab8ca1bfe75f8ba55278fd887582d943ad90a7288b2e776e4df5b8d
SSDEEP 49152:U+E2+E2+E2+E2+E2+E2+E2+E2+EfOU/zXNUfEeXAxhF2rl/IuOryOvKODjj3POMK:KOU/jIEeQfoR/IuOFVjUu58
TLSH
T1DDE59D11F9C68072E57312714CEAC37E4670B965863289EFF78C871F5F31A918A36B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 8bbbea9e589249e7f7f701dff0bfc73318a0e1e654c6a1f99fe251ec76e0abcc
MD5 8f7b092a2187329ef836c5bc1096f590
SHA1 8c8a28ef69bb4ec549727d4e261f2fbc3b363dde
SHA512 97574f690c7a35c496f036ed495d4012114573e3f65b8764585a4c3dd781511e0b2bc4d42ddc485fdc34e531751c66cdc36d95b2e230d41ca4ed7c8cc51759e3
TLSH
T15311C87290F5DC13F52368D79A29EF839CE0358FA8E86A14120453187BD4C76CF4D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 699cc3c0c7fb03880c865d1c86f10ee36fe32ea1702ea0893bf8a980bca4ac14
MD5 abba547075ea962edff7921bf43e07dd
SHA1 5904e82e93ed42a6b1470b066e1d6c90e745c826
SHA512 10b7b064c8cd6e0f469b23d693818bf52ab7f9ba7a39b91b8716efa3134368cc3bb193a3cd2c3f4e56c16dd0ad8f04dea16e6d36699f9ef94fa66e88384036de
TLSH
T14921C57290F5CC13F52368C79A29EF839CA0368FA8EC6A14120563187B94C62CF4D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-62-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1540-10-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1540-93-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1540-36-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1540-23-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2856-76-0x0000000002D20000-0x0000000002D21000-memory.dmp

Download

memory/4036-3003-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4036-116-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4268-1835-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4268-100-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4376-74-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4376-35-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4376-115-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/4376-50-0x0000000000320000-0x0000000000341000-memory.dmp

Download