d28473ffb6a6f5d88427596b3b456d93c4aa1c2a1954e1e70c45f32b38f6891b

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 23:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Size 4.3MB
Sample260901-3glk4sfc65
SHA256 d28473ffb6a6f5d88427596b3b456d93c4aa1c2a1954e1e70c45f32b38f6891b
MD5 f47b3ecb9a58fa083000c9db7391b3d6
SHA1 8e527e2c46edfe21748248ffaa8e929bec3c2a38
SHA512 c1e212d85521c2a844bf9afea3e63ab6db55ecbe7bf40295a45871d9561a41ed64ba39bc29bb5f38e9796966eb1ecf262b0cef34095286c3e35a2af20db5f4cf
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Ey:vOU/jIEeQfoR/IuOFVjUu5m
TLSH
T16A269D05F9838072E57711704CEBD37E8630BA6586328DEBF78D870F5B32B919925B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
920	svchost_BACBCAABBBCBAAACBCBCCACCCABAABCAABBBCBBAACCBBACCACACBCA.exe
2928	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACACACBBCBACBCCBBAAABCCBCBBCCCBCABACBCCCACCABACACBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe"	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBACBBCCAACCBCCCBBCAAAABCACAABBCAAACBBBBBACABCABCBAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCAABBBCBAAACBCBCCACCCABAABCAABBBCBBAACCBBACCACACBCA.exe"	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4496	sc.exe
5044	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3480	cmd.exe
3996	cmd.exe
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCAABBBCBAAACBCBCCACCCABAABCAABBBCBBAACCBBACCACACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
2928	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
2928	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
Token: SeDebugPrivilege	2928	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3480	5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 3480 wrote to memory of 2108	3480	cmd.exe	94
PID 5832 wrote to memory of 5892	5832	svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe	95
PID 5104 wrote to memory of 3996	5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	98
PID 3996 wrote to memory of 4496	3996	cmd.exe	100
PID 5104 wrote to memory of 4132	5104	2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe	101
PID 4132 wrote to memory of 5044	4132	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f47b3ecb9a58fa083000c9db7391b3d6_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACCBCBBBBBCBBAABCCACBCCABBAABABBAACCBABBACBCBBAABBCABABCBBCBCCBBCACCCCACCBBAABAAACABBCCACACCACCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACCBCBBBBBCBBAABCCACBCCABBAABABBAACCBABBACBCBBAABBCABABCBBCBCCBBCACCCCACCBBAABAAACABBCCACACCACCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe" start= auto displayName= "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe" start= auto displayName= "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABBCACBCCBAAABAACCCBAABCCABAACBBBACBBAACACBAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBBCBAAACBCBCCACCCABAABCAABBBCBBAACCBBACCACACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABBBCBAAACBCBCCACCCABAABCAABBBCBBAACCBBACCACACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 662f2446711e028c18e9a72e023ca24a8f5b64957005fa150f6a0d1f3923ffe9
MD5 c2ccd409ecf9867c1ef31dd5617f09d5
SHA1 e39ffe9092a7a9b6ebcbcac11e2928a6e4b6801d
SHA512 95a0a0a31fb226260f4ef7400d51dea7d749ccaa39af26da7894eaacd5cd387614a2b57739e24eea0c9a6f23c97d8ad64ca2968b27f20e63e46586f15dfbd5d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 14532050b5e990ccea8dfbe7a6a7b195f9206a1c32d371546714be21744571e9
MD5 8d8746ad5a566ad78d826c78b8af3573
SHA1 e509defc6f8be899d119a62c03727f1a38baf637
SHA512 15e6702b69454cac1fe9ac7af913641d383bae2bb92199f3800ba98c645bdc35cf8645248dc8e992aa2c20b673acbb1fe4ec76ab8b63553ae8d3b3e69f562ba3
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.9MB
SHA256 f428bc23a34201d254883e1481be13df7bf10288c5b79a8ce34bf27aa02aba50
MD5 946acba01362107025079429d98aa959
SHA1 ccc02c5e8de0d2a3662793a945d53e6b99c0549b
SHA512 72f37907509348eb60ef7fec1d3a75e7bb63cde4aa4df30913de21e9f4b41baa9e13f3a93505a630ff1170e34446aff6450ea041f3ddcbb71271403e2e8c5ea0
SSDEEP 98304:vOU/jIEeQfoR/IuOFVjUu5pgZ2Hb9t+2xt:vFIF0wuPgZ2jt
TLSH
T13D369D11F9824072E57701714CEBD27E8A30BA2587328DEBF7CD861F6F31A919936726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 1b9208fdc0df54d9870d1e93e23ce18e4fa7b98744212e99f7c8f073c148be60
MD5 babf0209b73f18805e8f5cb04046d972
SHA1 379283146fd05139ce03695e9b2a3da553b5a75b
SHA512 ee9a8cffa14a6d370dc6b387a074ba376ef64f00ed4e2471fb04b0c51be0a6c76b72b3521dabf8823ccc1d5b08c8a922dee009256b6458453d1cbd361c18a789
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 4ad5dfb0e6a60c09847ed770e54e1dcf7e710a0aaca36b7a320de65fb3823b11
MD5 56b7af1d30199ddfcf5b628aa91e6a54
SHA1 59c4ee2d6f620665527192d89463728bbbd3a74b
SHA512 34bcd4d1e7dd232b2c68d775def324673c292115e69960034ab47701b563e16838705dd3c76273b2ec5cb597cd9ee7bc60824d56df9b80dd7be9d39ecc14d608
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\qap`g`v~dtlq
Size 10B
SHA256 bf047458285fcc8394cd2c0016dd75dd150b59f7daa1a9aa099e743b604b6b78
MD5 bdb96044347801d7141f57a3bda182df
SHA1 0bd4d643133d8fd2af90dbe92a1e9fa8991094b6
SHA512 1ac1151a1580edc4fcacc2092021044b2722fe649c185f5ad8bae7ea438025dd268b4efc54eba97c16c6491a23eee936b09997576468f41e1d2f73c5384a1970
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2af0af90627c01743890c3c9f5b7af4bd90035ad29b4dde617d7a4dbdb3846ca
MD5 7e4376fca8a0288a0bd0e30e613c1ee9
SHA1 352eaa58d1d4312580a4eae15b97e63b622d6df9
SHA512 ef11c61491fcc5bf780fb7e63c6ee2c80bb3e4bb7a5a349de1c0f47db0c9b7e86b448a81be9166b420c7d7ff3357d75f34987a36cebe3b32be013a2075edc160
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b543bbd3d4fa43fb57a42c86e182745adf008e76bf31c4d5bf50f22824d36c2
MD5 3c2cacbc15fa5f0f0de4f55a52ef666d
SHA1 d8fb24e6682113e5c0107311068083754f2e28fc
SHA512 d3c0372d55f13b12e73a8d409aa8bf384ccc7ee67e3e8892f30929eb6bfd9bbda787b2716c941dc7db68107665e67388fa9db6643a522bc4c2a083276396afd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23eb9d5cfe1413b100b31d9211efe72c8d1941aea3f4417568126c554c502b82
MD5 975282834004e1e64d50a42b96ebbec2
SHA1 63d8894bce51a031cd2b7a40ed34cd21201c266d
SHA512 55a92133138a71d7917fc06ec52065369ca16631e12416f115666ee22ba4fb6b2fc83f896c65e1f82467fde29e5ef75172cfb53e134954e416d7d416b967d86d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 175d072357d968df2326b85e8fd230447f672976f439fe900e92c51f5db7ad1b
MD5 f4abd65f90ee7208492037ea8f88f91d
SHA1 8eda5c6fe62ffd387050c51c28a346690925f60a
SHA512 80919aac9a30e5a51882b5b6107e2dd458843f6f25c7b3da2fba8513b627b5221485f472361030a56d04ac5e6cc52758decc0fb37883dbfb81848f3fd76bbf68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e38106a37d1c950691e79f3f8ce8619ac0f4da131024b1d8845170b12fb272ab
MD5 41d05117d94ab25c508b165046ac4985
SHA1 0106a5e0b688a47e319b32dee0d646f292cac692
SHA512 2e5c3f122fb89ebde7bb6e121a6e4baa6e0756c05476acfc83d9584f3ff7f83a2d0448c22876afcc3e6fec43fc78fa50b2d50a120ae3df7e28e0d78195953a3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dadcf43a865cd9060e1e5bd45690ac4ef46c8f5601e4e2a1cd705603edaf447c
MD5 16509dc211ba38b34c8704b9188944c6
SHA1 2296ecfee4257ecb16f62b361c2cc9cf320eb339
SHA512 e9a43d22942c835fd0c5740f56ba0f48fe2640ab076e1cc3c9bbc93982592c4e136b1c02b9fa97e93ef4e550c43557b0b15fd7811b8328415a9f5c104eb5097a
MD5 SHA1 SHA512

Submit Download

svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBBCBBCBAAABAAAABAAACCABAACAAAACACACBBABBACCAAABACA.exe
Size 4.3MB
SHA256 d28473ffb6a6f5d88427596b3b456d93c4aa1c2a1954e1e70c45f32b38f6891b
MD5 f47b3ecb9a58fa083000c9db7391b3d6
SHA1 8e527e2c46edfe21748248ffaa8e929bec3c2a38
SHA512 c1e212d85521c2a844bf9afea3e63ab6db55ecbe7bf40295a45871d9561a41ed64ba39bc29bb5f38e9796966eb1ecf262b0cef34095286c3e35a2af20db5f4cf
SSDEEP 49152:U+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Eo+E/+EO+ES+Ey:vOU/jIEeQfoR/IuOFVjUu5m
TLSH
T16A269D05F9838072E57711704CEBD37E8630BA6586328DEBF78D870F5B32B919925B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 712084fa863f2778d3e44032c6690b36bd12228faf204bf1ce018906056a0ef3
MD5 c22822992d5f4cd1eeef24eb740030ae
SHA1 ba064a0c4dfb8147e3a81ef88b90a3f30d6843c6
SHA512 ead612bfbb3e08ee734869774913fa700377935da97830aeaccc74443e34348431a79a1a9731c80c9879e38e3c9c064a7a97f5ed01fb871737b49dbc01bfe416
TLSH
T11A11C872A0F5DC67E13568DB9269BBC70CE43B8F64ACEB5413094218B685C28CE554B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-69-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/2928-72-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/5104-0-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/5104-7-0x0000000000260000-0x0000000000281000-memory.dmp

Download

memory/5832-33-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/5832-23-0x0000000000820000-0x0000000000841000-memory.dmp

Download