c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Size 30.0MB
Sample260901-2bbchsswf1
SHA256 c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2
MD5 02d69a86ced6eed2d748061d3863b312
SHA1 fb9ac97268cfcec2cfd632bf6813b5bd110706d8
SHA512 6ae89d5078eeef12d6d7b36f9443636e218641efd61f8417c03bdf8b0ba56baff05f684f4c28d64834608b6562007556201ba1f97bf022a23b5dca34ecc601ba
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Egh:JOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1F3674B05FD8684B1E97B01704CDBC2BE9530BE258B128AEFF689E72FA933BD15434615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
1836	svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe
2560	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAAABAACBABBBCCCCCABBABABCABCBBCAABCBBBAACAAABCCCACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe"	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAACBCCCBBCAAACBACCBBAABAAACABBCBBABBABAACBACAAAABAABCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe"	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4184	sc.exe
2144	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3676	cmd.exe
1304	cmd.exe
4120	cmd.exe
3308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4296	schtasks.exe
5100	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
2560	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
2560	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
1836	svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe
1836	svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
Token: SeDebugPrivilege	4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
Token: SeDebugPrivilege	2560	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
Token: SeDebugPrivilege	1836	svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 4120	1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	111
PID 4120 wrote to memory of 4296	4120	cmd.exe	113
PID 4404 wrote to memory of 1808	4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe	114
PID 1808 wrote to memory of 2024	1808	notepad.exe	115
PID 1224 wrote to memory of 3308	1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	119
PID 3308 wrote to memory of 4184	3308	cmd.exe	121
PID 1224 wrote to memory of 3676	1224	2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe	122
PID 3676 wrote to memory of 2144	3676	cmd.exe	124
PID 4404 wrote to memory of 1304	4404	svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe	127
PID 1304 wrote to memory of 5100	1304	cmd.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-01_02d69a86ced6eed2d748061d3863b312_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_re.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBCBAACBCCBBAAACACBABAAAACBABCABCCABCCABBCBCAACCAAABBCABCBCBBBABCCBACCCCBBCAAABBAABCCBABABBAABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABABBCBAACBCCBBAAACACBABAAAACBABCABCCABCCABBCBCAACCAAABBCABCBCBBBABCCBACCCCBBCAAABBAABCCBABABBAABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe" start= auto displayName= "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe" start= auto displayName= "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCACBCBBCACBACCBBCAAAAAACBABCBBBCBACABACABCABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACCCBCAABBCBCACAACCAACACABAACBCABBBCAABCCABBCABBACBBCACABBAABABAAACBBACCAACBABBABBBACBABCBBCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACCCBCAABBCBCACAACCAACACABAACBCABBBCAABCCABBCABBACBBCACABBAABABAAACBBACCAACBABBABBBACBABCBBCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBBBCCBACCACBACBACBBBABBBCBBACBBCBCABCBBBCCBCBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a0d74c84918dc8cf9abc1edca51a0b568e5d38a28350bab9fcaf756f0b1af2ae
MD5 ce38a5bb88392f0a9166b0440dae98dc
SHA1 2a4a856cc23fb35a587c9dfb0b244bbf0d3aa0bc
SHA512 decd686c808ce6777a06070269e213c05b1394ad26ca2de6762b634c264ed90356cd73a9b97fc44f7aaee46a5ff25af8da758da960a15ea39f6f3f12644e3583
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 30.4MB
SHA256 a35fd50c2082cccd0bcb04f97cb2c3e8af51d37f9fea7ec6c3d049751ccb7827
MD5 42b9c660039f3ef68b2a4dfa481bc495
SHA1 05850dd28c30b1b313731b2c68227f72fa31bf76
SHA512 962667621ed6d75366f23a148ff5299e6096da64b4b9d25545afa9a37154d85a3c9f9907a3e7c4b038d61c6da589e4c7abe986b78fded779412bd04cf66c8bdb
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+EgO:JOU/jIEeQfoR/IuOFVjUu5JpiO
TLSH
T104674B05FD8684B1E97701704CDBD2BE9630BE218B128AEFF689E72FA933BD15434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 de2f54eeb265025b3e11e3084b81b8f3c9c53ab5c36c2eada3b26910ad4508cb
MD5 2d77e0ba504d384d4f9e2c78889449fb
SHA1 2b949a58f3cfb1918fdddc610461bcbc422b46c5
SHA512 4f7b8e4c467a9033b50b05013e2dd314b0ad068a28006dfbe5405a33b9015e9f98a0f1f944c5dd09af0801247db7ce131bc66c57b8a8e0b559080d864f19cdd5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 55ce2d20d3627bca5d64b6f901a2f142461eafbceb1f30cd3da6e669cdf0af39
MD5 7f003f33d89f3b8d640521e21c6e8139
SHA1 8e776b2965590295c3a7d3cc81f9d5952114e41a
SHA512 0280c0dcf8a9ff6aa583cbb71b028106370cd196b30680ebbcc4494b8af542ef7a3bfe67af4d344d2f3b469088056b2e68aa561a69911867e09bca131c28efa2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 397a679d933d922b1db796e6c6890ddd39854235e92caf27551b8bd1ebc91a27
MD5 415a37c1671d2f6fb19f4f9e34d078ea
SHA1 b10c1599d5397f343c526ddd88d140558a4072ef
SHA512 b1b52ebe67390f0c383b4b09b3e69afee9e699b262511187915ea8a5d314293d2cf86be97950f89695917709698cdf0e1cc9ddbbfdfa245c0b8f8654f1e9aa6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 ed6cc0c19d850f3f9f628291018774927ea49fe54c112745c1fc1c217f2c68df
MD5 78bbfa4c39fb04574e994a5ac4199049
SHA1 6c1f08de88eb8267facd846e402ad211524bf0f5
SHA512 c575a6f4abcb1a2975f908f6f848493f1185d6f75c5633fa6a7e7c738f049ca0eb3a916528e5094796427c28d0be92310cf7ac554f26ccd2e1617615c2679eeb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 db99d4beee6c8ecbbf430138cc2a8b2423cf6d5be3b80a315ecc4d77d9400bb6
MD5 ab9ad4414a5dc201d568da9b1f6b800f
SHA1 b927bccf7983f7d8d22de38ffda2bd8a975ec2bb
SHA512 837da3a833289750701c9361d83200c2e89241c10f67ee4696712d56d11abcb43a371f6f7d1fd45170de5365a151edb16a061ec3f6aa7c4d8e77f05d90a2940a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 77b52b21d44330d8613565bf9b544e99f60a06f8e77e5fbf8fc50039e8d5a116
MD5 0b579822dc7171688604af2e603ff504
SHA1 f07b28bbd3e722e0b475f6b87ea7132758ce42fd
SHA512 77a5718fed9445df9dcc96a76c568a9136f241834788403e6735bf5af956af0c0897edb8bd068eeb9d8774e018c559b2ec7799e52a4e0a3f7afecbb1ffad602a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 4317c55ca9a8e8d6b54c1f3da5c9cfd9a9d7c31d66fcbffc24de01455900cf02
MD5 c0c05a55b8f6f8f06321c4c558ee7c71
SHA1 a987ff6300282ffddf891ac4da5c5d892fa10634
SHA512 8078f9145212b9af9bd4beccebff8d62c441aed78c03026952fa9b6abd2df8dfe33680cb5e59d0b18bb5992a43e713b2c663a1932fd8d4a72118ea75093b069e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 362e0d0b6ca62e516c59873650da37d98e791a01a27d9f52e93ce2032bcc2e69
MD5 d361b67158ba458d968857184ca203dd
SHA1 adad48c909517b96b92fcdab27bead1c8a7d1b84
SHA512 e00d37f0efb30e585fcc75d07279a3dc4b5d4d08baca521f4466def530b947cec0afeb7b494f784b3e00504a64555a12008bd28f74dccdb426974e74eccea765
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ad5a05fd0be80412b415d409750a64e1921ce0b998d6c69d97a931c14c30f81
MD5 891d70253f1e7d5baceeb8c5268af025
SHA1 06bcb621b898f852f6bfb19b19f529ab8057f80b
SHA512 18b7348f858ade3c129a95fd9a2e84ed398d796a2e3a5f3a19279225bf9ee64106968c695a45281c46ff6acca07dd6ae143ca65aeed71654c9d084698121e36b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b86c654783ffbed77382597aaf28710fe4bfefdf4a339791451194a643f96b2d
MD5 60b42c29d01676eaadeb771f4ffc58e8
SHA1 af8937ac61d41dabda48c22712528050dc432b13
SHA512 67c356c05f216f19f0b32b40eb06ca291ba9654cdf46918cc318d8ca030dd386d32b9fe44d2c5b5f961991fb9baa6191dc5a732906b19bb0f0b130c5d539277a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 365992811722ffd4fd6f8cba5ffa5d7094ae314ed127f500a7d289ba9c039993
MD5 29556d564b8a500b1db9f1f040112918
SHA1 a1b503cb0871ada3d04f3cf02c4d8a761e1f2b5c
SHA512 75050709c3ad399ac0cb2b2d60bd43d29671a326c3664a217fa8fd3eb2c6b9f33b0a25728eb898f2cd8f90b9fb984d9f3776b52d816b1df9c8ff14cb0e957e21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3e17ffd29bf6d7965e2e885e578e62c1e0041533ee0e2d76c2567c9b3e97dda9
MD5 8af23c2eba075bf70badc8ad6dac63fd
SHA1 99e791fbe73d1ae30d2dd9942e7edef8ecf2d333
SHA512 db8d07537dbd9eb7671b10eb6322dcc0e1de430bb62c54e83d74e41ef13bae43f1aaffa7db7dcaf7313803beb71a2c04db224da027a1d414f83d02a3d8ea7136
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d52a450163e8be4886c7cbc2af324218240e39fe5b61c59efd667e33f6715685
MD5 6aecf1748fc53754eb8f8aa310974312
SHA1 d057f2b10694eb801c16e0b2aeaa5acaa5b953e9
SHA512 482808633d30fddaed4b2caf514de2a401f90e40ca7a36f5cb391fbe3f2bf030b87fa6788dce2a705b7674b19b7f1e42d6c692e504689ebbaf2b7d7848ef6596
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 795dd8147c3056cccb27d6ef059d14eea74c2d8c1ee51ef21c52524e126ad399
MD5 bc922106d1737742bf53d2e481f47271
SHA1 4c2dac0d7dbc737cd77243c0cdd55e8a062da75a
SHA512 727c6709d4f538c1dc0b08f3f9b3c1b9f3ddf6a8be8c7090d666c859b43a925e5d7a428e3c396f9cce9aabe868386a638fe51c4e0a7741a68502102b17952ef6
MD5 SHA1 SHA512

Submit Download

svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAACBACABCBABBBAABAABABAAAAACCBACACABCCAACCBBCBACAAA.exe
Size 30.0MB
SHA256 c0d1f19935e3bc08bf091f7f50f31e2d17635aeb74f465a0cc6a7be308dfc7d2
MD5 02d69a86ced6eed2d748061d3863b312
SHA1 fb9ac97268cfcec2cfd632bf6813b5bd110706d8
SHA512 6ae89d5078eeef12d6d7b36f9443636e218641efd61f8417c03bdf8b0ba56baff05f684f4c28d64834608b6562007556201ba1f97bf022a23b5dca34ecc601ba
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Egh:JOU/jIEeQfoR/IuOFVjUu5e
TLSH
T1F3674B05FD8684B1E97B01704CDBC2BE9530BE258B128AEFF689E72FA933BD15434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c664cd4e9163c974d36435d16b162fb1450694e7e567dffc4df5339d8b317ff4
MD5 0fa66c71cdfbc2eb9239b7b190bf24aa
SHA1 95df2d75378ca5853b3353b0d9dea90dcb90f2bf
SHA512 64fa8383f7e72086bd7923994ab243ec24a843a6d9fc3e03fc5fa18f288dbfb169179cb1acc995e7ce2ab24d7474cfd050a5c2befcdeb4d7f423e4327ed4e919
TLSH
T1AF21FB11F0F9CC57F13168C7DB15ABC74C993B8FAC9C9B84274D8208A759C7A8E168E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b70a8557f66d936561ae60a346f076af64e935578319f3c452ab34602f3be942
MD5 51171049d90936ca850217199b3c2401
SHA1 edf6fde36a7e4bbfcad1c248714463d25d94c4c7
SHA512 1a0542b83c1dbf1212d22d85248b951c690fdab1b83c4d09f396d318f46e7e470f77cba0c6305df7c13a3f6b7a2b56876dce3c2245b1c06db69ddc36f848287c
TLSH
T117213B51B0F9CC57F13068C7D711ABCB5CD93B8BAC9C9B88274D8108A749C7B8E128E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 567998737eed27814f1cfd802214fbee9b4b78675800820e88bb68fc356d0724
MD5 21ca4bb5d9a070876284be929435dc7a
SHA1 806b391d41e85f2b7ff5d47e16cbf983b208caf9
SHA512 b85a7c0ca9583d0390231d1e927db9c7c556af85985e787e6dfe64cf127a8b164cd0f85f6d87bc9f9c19485eaf949e069c510ce5d5bf4049ab858f3d3dbdeded
TLSH
T154112B11B0F9DC57F13168C7C715ABCB5CD93B8BAC5C9B88274D8208A749C7A8E168E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-6-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/1808-59-0x0000000002D20000-0x0000000002D21000-memory.dmp

Download

memory/1836-2552-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/1836-71-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2560-116-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/4404-36-0x0000000000490000-0x00000000004B1000-memory.dmp

Download