670a7d6dca4e94dff553d64c16c9ebf4bcd9c4f814b8befda9532ea1c4a28fe0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 12.8MB
Sample260828-ca7a5asdrc
SHA256 670a7d6dca4e94dff553d64c16c9ebf4bcd9c4f814b8befda9532ea1c4a28fe0
MD5 f2799e3234afa3622488bcec8c4648ed
SHA1 dc5cb1cdbbaae7e24a6a59a462d2cc3d62ec006d
SHA512 22813ac380a23388f1fc9468e5d2da9e95dbf5fe020c78fbb04de1512bbded6b347fed18172c7f91e917b14906e4f7159c3438381bf599d561e8046eb5e967de
SSDEEP 49152:U+ES+EYD+ES+ES+ES+EI+ER+ES+ES+ES+ES+EYD+ES+EYD+ES+ES+ES+EI+ER+Ej:QOU/jIEeQfoR/IuOFVjUu5Q
TLSH
T180D64D09F98350B1D97741B04CCBD3BF8A30BE2587124EFBF68DD62BAA32B915834655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
1716	svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
3768	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACBCABAABCABAAAACCCABAACCCCCBCCACBABCCBABCCCBAABCCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe"	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBACACACBBAABAACBCBABCCABCBCBBABAAACBACBACACCCACBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe"	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
680	sc.exe
2892	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2384	cmd.exe
5724	cmd.exe
2640	cmd.exe
4768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
1716	svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
1716	svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
3768	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
3768	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
Token: SeDebugPrivilege	1716	svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
Token: SeDebugPrivilege	3768	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2384	4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	91
PID 2384 wrote to memory of 2352	2384	cmd.exe	93
PID 264 wrote to memory of 1288	264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe	94
PID 4992 wrote to memory of 5724	4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	97
PID 5724 wrote to memory of 680	5724	cmd.exe	99
PID 4992 wrote to memory of 2640	4992	2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	100
PID 2640 wrote to memory of 2892	2640	cmd.exe	102
PID 264 wrote to memory of 4768	264	svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe	105
PID 4768 wrote to memory of 2092	4768	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f2799e3234afa3622488bcec8c4648ed_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCABBBCCAACBCBACBABAABAABBABACABBBBACBBBACAABAAAAABAAABBBAABBAABBBBCAABBBCBCACBBCBBABACCCAACABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCABBBCCAACBCBACBABAABAABBABACABBBBACBBBACAABAAAAABAAABBBAABBAABBBBCAABBBCBCACBBCBBABACCCAACABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe" start= auto displayName= "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe" start= auto displayName= "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACBABCCCAABCBBAACBAABABABACCBBCBBBAABABCBACBCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAABCBACAAAAABBCAABCCCBBACABCBCCCACACCCCACACABBBBBBABCCCABBACBBAABCABAACBBACBACBCCAACACCCCBBBBAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABAABCBACAAAAABBCAABCCCBBACABCBCCCACACCCCACACABBBBBBABCCCABBACBBAABCABAACBBACBACBCCAACACCCCBBBBAABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACABBAABBBCAAABBCCAACAAACACBBBCBABACACBAACBABCBABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c483eaa0160c2efa2ef5531d8a5aed6bfc58d96016f9ba6dc3441d2fc33792d7
MD5 dfaa74af5d530a960f985ce1597b21e7
SHA1 2a421532ca335e80c6c504ac4cdc137cc69c6a74
SHA512 4ea6c9101ed16c7e6406d7c2fd5d69f19ecd076bf350f66916afa3553be82ed910ee21ee2758c96af81dc7909bd9c62d2648a63adf8030317cbf5751986bc180
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\qap`g`v~dtlq
Size 10B
SHA256 cd3294c187c30e876f6fa61a1c671d8ffc50fa33035aab784681fe99a3e20a00
MD5 265dad22eb55be76843f57765d24409e
SHA1 578f44a588bf548b3d92ce0886d2dafbd293902e
SHA512 8fec5f6cd115778a5301fb6b3e2fdbf97b6e88930e98518ab5011c3674da7738d98710e0dadb0f4d851098cabe3e3f5a08b4a9ef4cb74c02095353b4049d7844
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.4MB
SHA256 bae93bf57f0a3abd79bff47f4d3715660ea9f94536b7422954b483483e708d63
MD5 787f7ff7f1c80fff2ee499a9ba417601
SHA1 0715c4983a5e895016282b0a55f05567a17e6e9d
SHA512 7c91829b4b5f77bee71b551075ce330c038b99646e6a58fd205bd6f53f40b76fa119dbf74717954347e933b30e44508a7e9994036566046e7807ddf64a689927
SSDEEP 98304:QOU/jIEeQfoR/IuOFVjUu5PgZ2Hb9t+2xt:QFIF0wuVgZ2jt
TLSH
T184E64C09F98350B1D97701B04CDBD3BF8A30BE2587124EFBF68DD62BAA32B915834655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 4e614d3c98620a5160144fd73e0f86135f6244f076585d3d740524b7d0cefd02
MD5 0a4950215e622fe2d0bc4e5efd0d3dc5
SHA1 860df055c4a39a4ca389cf9a0484d0927b9604f3
SHA512 6ae2f9546cd4ad898623cd466fe4e9dbbc21b899a15f62dd7f54f0f767b7dc799704939bd00521bfac4897a42b198178b987180f7f65ec683a3c53ffb9e45493
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 9f316e5f03c7b73518df5c44089f002104810398980d9fe7bbc175d5ae781ad8
MD5 242414f5e3bc92ff744060d0f942a8e4
SHA1 bee08e21e5851a61069540a27c8d86c9b2fc1175
SHA512 fb598ba62927b70d814daf2161b83a1e5ffe077f37c51c027aef57e16db95e06a268f1a2ad5fea39bd518fa305cf8cbf55ef0b0efe65a43c49df1dfbce73879a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 a17e0d8b5a5e26df37766aa1c8b359a30b16641f21fe27626e99d6a3a71e1877
MD5 b32c027377391de49d997f232c8dbe89
SHA1 2e7890c8afc1b42d7a5b9d06cbc96ca99be49849
SHA512 0be2624be1b765cc8d41c8d2c5ebe56c5018a879bde11bf2cc00ab1c84ce18dd92420f002aeabb838601bdd54fae79ff34edced76d0e2a8e70cf334d1236de4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\uk\qap`g`v~dtlq
Size 10B
SHA256 70bd3436a1c68b392e8bc10edac3a944a8c70ce83f78c1cb62af6788fe5fffea
MD5 5c95662c056321a534b6aa357b963e50
SHA1 a117b175b03a8d4875b2842367dfc02b1c9426df
SHA512 95f190a7c2c0e40d45108e190e65d5740da4370d1ab304c1881d9fb2c8db761a5945ea4dc3f794057212896d428aaad44c4b379469a803398f08e2b9c02fd7cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\zh_TW\qap`g`v~dtlq
Size 10B
SHA256 3b603efb7445ff7a6290e0cd08eee973732b46ebe3ab69d3ed7aab91d6be9779
MD5 82be57e5e20381614ca1394613380bcc
SHA1 b9f44cb50eb51df8a94bea06646f00c612b809cd
SHA512 247dc0d9fae1fdfd1039fc3b54232094ce89c7f2f28451d43604f64d504ceddb06100bbcc8381edfca85ada1a53889046a184acfd6e882d6c5979701b6529d49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 be5873f452b819460d595dbcc7a915f898ccfd836116ebfebc139e4f2c47ac1e
MD5 2b99189492789a4dd9a39d18e03388c0
SHA1 87be9ab4576e5b76c82b87f1efb3683f97259da0
SHA512 63a49812f9dcf79412b5b1bd07f668fa802f33839b8c1a9636d1979ee33c81a312c8af43e3e58434c71d34c781fe0bbde71e6e82302ad519414a4e1205d53c2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\tjxwgo0i.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\qap`g`v~dtlq
Size 10B
SHA256 552e171b14c308b60f0265ec2d169859dcbd175f1c23b4bc68b7b3d27fa5d63e
MD5 8872b43ef70d21db1b4800e1b19b4444
SHA1 bf96efa2a8903ec4c8e1b1036f319cc97ae08dbc
SHA512 23310ff54ed0f8675b63585eb53483d80182679700fafdc9218a6b9f0bd2be88c3afd185172a82b5b7c92e8aae7499d9234c48d53a1f150859ed3b5c35db03fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99012fe2315516f83a8e23e263e5e96d46375ba9171d56ba1da1845dfcea37f9
MD5 a4cf4c245ae9b1b0bdc34a42e83d8e8e
SHA1 fae223f6784eb83097a0ec7ebd866e5c5b8b0ee8
SHA512 a7b2745d0c47421c9aa9494cbb013eeabd9542e773b6bef990ca50638fd8499b56132331678833c4d6d38b5cd9e97e3ec8a3c598c97da5933f12f695e687dbc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b1af41c19ca6ed4f1a88b5c0ef3178412251cac79ea5e60692253fdd2bc3c7f
MD5 532ae0415f9588f8f64a3c49ddc17027
SHA1 30b8fe0a137144010bdc2e524f186a761708f2d3
SHA512 f70c6f27fe16e4481f41988584695aeee0d8db594b6cdc69239c7adeb787376173862cac729cee1d942ebccc031e7f2b8dfbd4177e5585a6eff46373ebe4c327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea9bafab877c98ccc34d98b057f59abf721d5561ca98d9d8788deaec156b7a38
MD5 ca039d5fd501bd126e43e8e83e69e6de
SHA1 1a793cfa06e9a188d749f74e2b8532ee14d0bc79
SHA512 8d8cc4bc9b41dad1bb97e1b900f0ec8feb48eff72044328a686c772e5a73014b5e97564abf2fa49e8e6ab7f27b9bfe1b176f70b0a398545f003e6492b8bf61d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67e887744affbfb0238bc0773b8cf6d9cc7ebfa98c36c55b3e4a895325b4dd08
MD5 ed44dac3fcc92b3a30f455724a3fe4ef
SHA1 5636b112ec13bb53d1088cf8528b4a6daaf9e255
SHA512 a660f11dc17245f65a688479f1d378f7faa62ed105eb179d88274e46ed85b0fc664d92b75b0173b6c32a316744d8b0b2aedcf96db844a7a6a57cd1017aff488e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 239f0260933fc0c45a45bc075295b54e8728e77c0e04131b26c1d219249f7416
MD5 81116ec0607e6bd436a372204cb1a2ca
SHA1 10af76806b71c54e8ea38316254c0de13e2b72ed
SHA512 b0e6be7593740740c623e48827e30674c9ae232c40c0b34fcd2f8ae46b2bfeadf98c5d8ba176bb6d87a4942a959fe17aa3fa752c3e410732685471d1938c9997
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 998230920f716295a78fe9de12f57685a4036be8af9eccdb127dc0643c4b693e
MD5 4b588026d948995cbe7106eb7e2b7d60
SHA1 3982376c6f933b69e42b1ec568a6c58f9042e6f3
SHA512 4d4c6bdc418a6c2d749ccca9dea4f01822a3fe98fd9a57c2716dbc7d92dd4714701ffaac3565f277c6ed0c0b76f94aa5dae208f2c3305b24fad058df9d8c2a6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9f4901c91a7d69a0bfe1244ddba55f91e844b4b99e571213dfe2c2b049dbb9c
MD5 7da43eecf9739e4e660047eee559976b
SHA1 1bde825923fa66914f88f5d62c9d8a97ee677abb
SHA512 710a78aa879a897d53d54582d33bd2b9c172901b9174d3f31b982ab81ed7b607b5344bb05d4a6e7d18323e1019c17414a41e1caf08a74894669e7bee2f84486c
MD5 SHA1 SHA512

Submit Download

svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAAAACCAAACAACCBCACCBBABBACACBABAAACBCBBCCBCBCACAABBA.exe
Size 12.8MB
SHA256 670a7d6dca4e94dff553d64c16c9ebf4bcd9c4f814b8befda9532ea1c4a28fe0
MD5 f2799e3234afa3622488bcec8c4648ed
SHA1 dc5cb1cdbbaae7e24a6a59a462d2cc3d62ec006d
SHA512 22813ac380a23388f1fc9468e5d2da9e95dbf5fe020c78fbb04de1512bbded6b347fed18172c7f91e917b14906e4f7159c3438381bf599d561e8046eb5e967de
SSDEEP 49152:U+ES+EYD+ES+ES+ES+EI+ER+ES+ES+ES+ES+EYD+ES+EYD+ES+ES+ES+EI+ER+Ej:QOU/jIEeQfoR/IuOFVjUu5Q
TLSH
T180D64D09F98350B1D97741B04CCBD3BF8A30BE2587124EFBF68DD62BAA32B915834655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0ccd85cbd2122961d0568cb0e6a743289720c42baaf024c2c8d2feae433c9f1c
MD5 9371d53467e4ef2e1b27c7f64ce9c3c5
SHA1 0cac979f63df6637cad5a65ae2e8dd6a649459a1
SHA512 fb0a3e2490a5142930ac7ef2d01d8edbef447a653ce20402689db729b467ee4356f8fcefcab878e23ec85f9feea832a3096bc9f93df252974cd1db95c2447fba
TLSH
T1BC21D332E0F4EC67F53368CB9615DBC29CA4379F989C6A01A38D8218A7D98318D59CF1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5d3aa71f77a2a8390ab9a4ff051df1a0e8b272388d0f933f07314e5d30e51c11
MD5 e18323572c7997967a2e7dea03aa4c97
SHA1 882eadc2247f8cd9d006ebe381fa331756f48aeb
SHA512 aaf95ce463b186576d5f54140affc3ae87c2c4e8f6ee6f88376ed78fcca58555fe43ac7087768796070323f7c0cc3899db3d5d52794a50508c476156519956ab
TLSH
T18E112732A0F5E877F83368CB96119FC29CE4364F589C6A01634D8218B7D98308E69CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ef510bab02698087496f808c19021d87a6029949ea914853cd7072b33b251867
MD5 46a929c30011ec2836a121300a0477e2
SHA1 df1881ea129314034d7d0a5cf4eaa4ec3cf15909
SHA512 174e83777daf4dcc642e82b7273788421eff35b42dd9ff86138f83d0001e45c510cea279f73a07ef11f3a86cc1369d5964700807916997969007b24a7f978d0f
TLSH
T12721F671A0F5E877F83368CB96119BC79CE4364F589C6A11638D8118B7D98318E59CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-33-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1716-1234-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/1716-68-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3768-1243-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4992-6-0x0000000000080000-0x00000000000A1000-memory.dmp

Download