99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 10.7MB
Sample260828-bm6ppascmg
SHA256 99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804
MD5 f68adfcb5d7f36546e04a33cd76cfe73
SHA1 53070d4415d5b4c5d4197e6cf4e72f16bf34e7bc
SHA512 cf130bd3d54c5ffa4d4791699c1918d57865f3c40a7f230688c6763659dbd0566dd88be505413584d69699da782fe69ac78ce67410e293b2d61b9815ca0b4d5d
SSDEEP 49152:U+ES+ES+ES+Ex+ES+ES+ES+ES+ES+ES+EA+ES+ES+ES+Ex+ES+ES+ES+ES+ES+EA:bOU/jIEeQfoR/IuOFVjUu5B
TLSH
T146B64B09F94340B1D92B51B04DCBD3BF8A60BA2583224DFBFB4DCB5B6A23BE15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1408	svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
776	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACCCACBACBCACABAACBCABCABAABAACBBCBACCACBABCBACCCBCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe"	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBBACBCCCBACCCCABABAAAAACBCCACABBBACBBBABBAAABCBCCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe"	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3080	sc.exe
5900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
1108	cmd.exe
4092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1408	svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
1408	svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
776	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
776	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
Token: SeDebugPrivilege	1408	svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
Token: SeDebugPrivilege	776	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2700	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 4092	5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	110
PID 4092 wrote to memory of 5392	4092	cmd.exe	112
PID 1712 wrote to memory of 3960	1712	svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe	113
PID 3960 wrote to memory of 4620	3960	notepad.exe	114
PID 5724 wrote to memory of 4952	5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	120
PID 4952 wrote to memory of 3080	4952	cmd.exe	122
PID 5724 wrote to memory of 1108	5724	2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	123
PID 1108 wrote to memory of 5900	1108	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f68adfcb5d7f36546e04a33cd76cfe73_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACACCBABBABCCAACCBBCBBACAAACABBCBACCAAAAABBABCACCBCACCBABACABBBACACBCCCAACBAABCBBCAABBBAAABCABCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACACCBABBABCCAACCBBCBBACAAACABBCBACCAAAAABBABCACCBCACCBABACABBBACACBCCCAACBAABCBBCAABBBAAABCABCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe" start= auto displayName= "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe" start= auto displayName= "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCACBCAAACACBABCBABCCBBBACBAACABBAABCBABCCBBBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4620

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACABAACCACCAABCABCBABABACBABBACCCBBBCCBABACBBACAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 78558821d4f79b3541d28ae8e7d316b0dedbe1d49ce87aed0f3e30fbc9b43ad7
MD5 93e77dd119454dfe73f48e90c6cb2446
SHA1 66645557e282665196e53c755767e4738ac61c4a
SHA512 fe30aac0701c7c2af8b4621176b131972563c69e4b3bfc1dc3b8a3a388ed383574d3f88d52e8413bf8f04755700b73a95e78679637a4bbcf66990337b2407eb6
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.2MB
SHA256 fe9b78c5244a68fcaf0d38f0823726f75ec3f113e2d8446445701f5fbcf412a1
MD5 5d80f9c17ee4c47531074778d14ce579
SHA1 079d26311d9ad80fa8379d6b97e1b1b30f306e17
SHA512 1eea204e390e8e2ec9c03a783e014b25762ceb867d7ffca04536fde6a758216b05a1f9e7261e2674d9cecef8bae318d88a40c51d77ea98d89a09923b0097f38a
SSDEEP 49152:U+ES+ES+ES+Ex+ES+ES+ES+ES+ES+ES+EA+ES+ES+ES+Ex+ES+ES+ES+ES+ES+EA:bOU/jIEeQfoR/IuOFVjUu5+pih
TLSH
T1F6C64B09F98340B1D97B11B04DDBD3BF8A20BA2587228DFBF74DCB1B6A32B915438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a45eac3f016eb167cd41533bc02be590a8200f6b7d0bd1135d39042b2da85625
MD5 ac456cff73ad6c57a60c7c895f46b089
SHA1 e8d3ed8e87b84729f36a149a04467b0b108d37ad
SHA512 954af5149d915fdc97c886106c7d225729f0054ecac324531627c295346610e71945fdbc9700421ba33a8532144d456bbc4260d54c3c64ef73475d3872f2222a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 aef60c16ff36d3efdf875eacd5a9bfc74ad811541730798ce126c6e9ab726e64
MD5 ee72cca1824100444dbf3c2fbd06f06d
SHA1 e711b0f62dd79714d653234b02d2b826f9cba9c9
SHA512 49f90528fad2d7044601098dd3b1f002248eefe8388aadbf602596ef0abfb984dd6644eedb1702caf18d466d048978e2045e9b0e33f1d62bc13acb1353cb415a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\qap`g`v~dtlq
Size 10B
SHA256 14ceb49fa3fda6e73ee5f0f0f7cb2aef4fe5e515383a9a9584ffce1d709456bf
MD5 e1f5a1be5aa5a33e6b945841fc50495f
SHA1 4b4c8ec667563fb5f59f58078e2b894ef54ccee8
SHA512 a2a8417da13ebd20b1fd3e02d2db6fded0a8e8b370f13d1705e603d92559f81c165530e4848d44b8b4c9323882201e6a6d01a09630278dd1f24d2b199a80bc20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ml-IN\qap`g`v~dtlq
Size 10B
SHA256 8a2fa2a4beb4e1e0451dae35c1ec702010c68d40fd6bf0d1f8d167bcdb762a4a
MD5 a5486b7ad46f52701f661993e1c301fc
SHA1 b534fdc647d7841aa3881a08c71d8b3cba3bbd12
SHA512 39ec3df747d4e5b7f75916fdc83122bc7528ae121e50aca5fed2cd94c348471ccaeac994364e384a294e1b057f2046649c95d44828d863d209f237bdf0638e9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 2a0898b15184b5bf6303c859ab75bba2061a1b8be37d89513f7d45fe0abb9a40
MD5 a1141823db8c3c0e1a2cf88aab27d637
SHA1 3de1cf0ae3cc40a4ccb977cdc525eb335eae2d2c
SHA512 f28c1a4005262af025e6feed468cf177a2c60e47958b641809bffae2ce60b0fbae9280be8f8a593d847761be7ad59b1ce9c9f7ee3d162ea4bfec3fee8da64d75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f1443e4aaf8b87b30a2b07c9fa5c3a0bdd68a20b259c13cece2cc0a179095d0
MD5 93ee64a29d2c80399a19d860ae42bf1b
SHA1 044324e75e105d44c291817aefac3c1f112e587e
SHA512 31e768612c55b446549678306d14eb6a4e6e593a3b978c8c4b9fe99d096f719e38f8cc8eb45a8a6a68c627613d1d260328343953db973b79ab92d61638ffbfe9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f345d7cc43985925967c088aaffa3013dfa52ea65efa83e8a47763f5cf01395e
MD5 eb26b7227995f6e1a0ccdc926eed203b
SHA1 658d9a1707306d242d6a6f2f65d958a1af8dcb5c
SHA512 814cc92222ca6474e8a4123def877a4f736f1f5bcb317bb586c8bacd5e56f6d48c17e1b39f9107c7b80143b0e148271ee0b5468d8f8639f54a6b9064c4de119c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52ed549d5586d7bcca65a7a9a937e230cc8e258586c2645bdaa36444429b9128
MD5 1b73ad3341941171c375467b61178677
SHA1 56991686744af8e58e8eab5d9c22d4b70da3ca21
SHA512 f0edae8030ae8f6a1651ee39d856bf1015dfad11d2b15d1ce87fcdb9413c90ca36aeccec36097f3a22f0c8b7713bb5482cfb9aa35b9eca5a39d3c2e412dd1666
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80ebd6fe759175d3fd2b590a4d203f712ea8214f6862481f2f0ae76b2aaa7a14
MD5 e1f864bed7b2082e8e4675b668a55503
SHA1 3d784b007d85fb1a81e127842aac44b8bfd980bd
SHA512 8f3173bc58ab103b2e7ca06956f17735b791396009e6c06f6ed2ff15e49b24b034c46a6e96cbd8c52d3792690eb3c78af9a91ded95a2bdbb1bfa53936f92f46f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c5460befde256ca2bd480290fec2f4b06abecfd7d391c576162692c61d8948d4
MD5 2ab009dad471f4af45e824ccdfcbe38c
SHA1 846257c071e3ac4120f8391f54b36aa4dd299d87
SHA512 6a196b7e4ac995316f8f1bb9e3753333a83762514138e076214736f6c09af42f6b9d692b4c8c5a96b395b7e2624e027583eb6d5984d062769f11a0a5fd5343dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ccb20a348b07a2c66fcc37f6e7b8df26d8de29b3f34532ebc43c193f806aac53
MD5 737944c13afed4c245ea3060b6edc989
SHA1 4dd00ab760d4bf1affcfd39060443d7c42d1ac2b
SHA512 559fac6e8ba2e4aea5ab530010febc108af698d1ac4f0379cf8da679120f84e3218944dc438627cd244eba92cc0959a651b4d9e2b97ccc82a4e370ef6ec5ce13
MD5 SHA1 SHA512

Submit Download

svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAABCACBCCCABCBBCBCABCBACCBCAAAACCCBCCBAABBBABACCAABA.exe
Size 10.7MB
SHA256 99f7c081160aeef6295a5bb0f30d7559b70b8b9633be5bc2d755213971794804
MD5 f68adfcb5d7f36546e04a33cd76cfe73
SHA1 53070d4415d5b4c5d4197e6cf4e72f16bf34e7bc
SHA512 cf130bd3d54c5ffa4d4791699c1918d57865f3c40a7f230688c6763659dbd0566dd88be505413584d69699da782fe69ac78ce67410e293b2d61b9815ca0b4d5d
SSDEEP 49152:U+ES+ES+ES+Ex+ES+ES+ES+ES+ES+ES+EA+ES+ES+ES+Ex+ES+ES+ES+ES+ES+EA:bOU/jIEeQfoR/IuOFVjUu5B
TLSH
T146B64B09F94340B1D92B51B04DCBD3BF8A60BA2583224DFBFB4DCB5B6A23BE15438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 29bbc92056eaaadc1fb46d87b74860860c1aad122bdc567bed8268b76b3902a6
MD5 90eb37c27fec223d7f4ce34fc56a0e93
SHA1 6e08544c25ec9894f2aa1a4dcdf79038f07a1323
SHA512 85b0b8c84a6b529649303bb3739db459775c4f56fd95ffb96206ff672805a3b97494404aae014289a73625414dabda645023549a77286774cb6cd0432389f168
TLSH
T10311C861B0F5DC17FD3328CB9625DBC2ACA4369BAC6C6A05634D83186799C318E558E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cc89d1802ed30f3d2ad5492c951991b1bc31a25b081f32f409157bd0dfa60693
MD5 9dd6123def3d60b5d9707649b1e8e4de
SHA1 926d3289388edd015e1d80b781e65435e0be20ac
SHA512 48cf3483a18b594d5e1baa9a3cce9391135e427fbb2247ae6794d4f7978a835d27bc713736c49c5ab008993b1a8d8713bf3641f6d1f928f7291ebe5de5d335d6
TLSH
T11D21F660B0F5CC13F93328CB9625DBC3ACA4369BAC6CAA05634D8218679DC318F458E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/776-145-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1408-77-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/1408-1661-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/1712-36-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/1712-26-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3960-58-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/5724-6-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download