8e37bf69679f0e969ddb032626c92d9345915d86e1b01f3dbcc167dc8e95b6b0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Size 5.8MB
Sample260908-e966hssaje
SHA256 8e37bf69679f0e969ddb032626c92d9345915d86e1b01f3dbcc167dc8e95b6b0
MD5 d738bc314eaaafdcb0ce9cfe7abdbe32
SHA1 0f7405e59a03075d836419c92071f5e86e2290f1
SHA512 8f2ebf384a72f811ae220ea63e0ad2fca2faaac1dc1bbfbf4357f26f908684b3a3fb2cf30527bbec8b776fc4192e11acea266c75068f049bcc66f0513c2a0ae8
SSDEEP 49152:U+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqad:urrrrrrrr8OU/jIEeQfoR/IuOFVjUu5U
TLSH
T186566D41FA86C173E4670231489B83BB5B70B8554F26969BB38C536E9F337C0A732B65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
4668	svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe
4440	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACAABABBBACBAACBCCCBACABCABBBCBCCBCABBCBBABBCCBBBACCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe"	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCABCCBBAAACBAAABCBBBCCBCBCACBCAAACACACACCBABBAACAABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe"	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5876	sc.exe
1408	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5452	cmd.exe
4812	cmd.exe
4568	cmd.exe
4088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2136	schtasks.exe
3260	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
4440	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
4440	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
4668	svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe
4668	svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Token: SeDebugPrivilege	6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
Token: SeDebugPrivilege	4440	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
Token: SeDebugPrivilege	4668	svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5452	2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	92
PID 5452 wrote to memory of 2136	5452	cmd.exe	94
PID 6096 wrote to memory of 2700	6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe	95
PID 2584 wrote to memory of 4812	2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	98
PID 4812 wrote to memory of 1408	4812	cmd.exe	100
PID 2584 wrote to memory of 4568	2584	2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe	101
PID 4568 wrote to memory of 5876	4568	cmd.exe	103
PID 6096 wrote to memory of 4088	6096	svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe	106
PID 4088 wrote to memory of 3260	4088	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d738bc314eaaafdcb0ce9cfe7abdbe32_amadey_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCCCBCCCACBABABAAACCBCCAABBBBAAABACAABAAACABBBBAACCBCCACCAABABCAABCBABBCCBBCCCCCABCBABAACAABABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCCCBCCCACBABABAAACCBCCAABBBBAAABACAABAAACABBBBAACCBCCACCAABABCAABCBABBCCBBCCCCCABCBABAACAABABBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe" start= auto displayName= "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe" start= auto displayName= "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBACACCCAACCABBCCBCCBBCAABACBBCCAABAACBBBBCBCACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCBCAACCCBABCBBBCABCCCBBBBBBCBABCBCAACBABCCAABCBCBCBACBAABBCACBBBCABCBABABBAAACCBBCACBAABBCBABBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABCBCAACCCBABCBBBCABCCCBBBBBBCBABCBCAACBABCCAABCBCBCBACBAABBCACBBBCABCBABABBAAACCBBCACBAABBCBABBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACABBAAACACAACCAAACAACABACACCACBAAABCBABCCCABBAAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0ef3fb7544842d24a73314e96ad5b52541fbdc1c880cf11e729219a024fb3949
MD5 e05050887b32aa435fa8b540391ecf75
SHA1 59a119c64704932ffcfe6be58a1f540a23010bff
SHA512 4b6752a35f5e5bbb9addac6c2fa5892f897b8cb47cbd11375e4c224e4f88043ac3cf9a3df39bb8c11108facb1ddead0311f0adf79839ac947f3dff99c906a262
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 cd36e3e2a9feacf1fcbbb1bc407b2c3a01b2474803717a52f30b7647134f0ddd
MD5 3b8497b2e468b40195be7b147f179e76
SHA1 a70d4bfce9cb5bb90026bae8e17d11626dba3ff7
SHA512 63b1476e0a672ee92f3d14a014a11d4d3552c1254c355fa466c5859f918501cc00aa78b23d7109c916b543edc44f23e4a474468452bc4a8995b427ca19d1d2f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\RetailDemo\OfflineContent\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 6081e68f32cf613cc16bf4bf0b1a9dcd9256f194edf045b8b53582fabef31825
MD5 60d03c633f0c7753e206bddb7adaa539
SHA1 7fcac801f67f4ad0c09ead3c04ece98fe37d60ea
SHA512 b8e8a9307dee2d65735897955f12f64c3b8ddd7e53217d01b9f4576cb0fa8324a77c540f6d53bbed5fede9a18b089b6039d0c327264b1f99dc4d968dc113c093
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.4MB
SHA256 5ef110ba1a39a927dd8351cbefb7e1a3dedac4aa2d329ffc7e477575521c646c
MD5 26ab033a4fd287116187be576ac75737
SHA1 bbb42682fa45d6198d66b852aae58c67b2bf7377
SHA512 543a908a9b06d1f7eaf1ba49b21af9c0da3b58d3e89463d75fdd66970166856c1b60d70c1675d237fd175469c85d2c4f992b32da30e49163f51ed040ec16fbc9
SSDEEP 98304:urrrrrrrr8OU/jIEeQfoR/IuOFVjUu5zgZ2Hb9t+2xZ:LFIF0wuhgZ2jZ
TLSH
T17E667D42FA868173E4670231489B83B75B70B9154F26969BB3CC536E9F337C0A732B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 e80f23ee0984ca5cfa8b956e554588e2f7c485525d58bb5291054acf66af6cc7
MD5 684954598c3a9e51ac52594642a22b85
SHA1 c0215ed7817026e43883ddbaad717a0b6832f5c1
SHA512 c35537ebf7a261f11bbae0e32380d05940890365f97b08891304ea04cdfa2ff872e32dafb5679d8a2a0471f591931a8b9076d69a072fc40aa456e6cda89f0cdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-4046655672-1449839301-2197395821-1000\qap`g`v~dtlq
Size 10B
SHA256 ac1bd2f1355b5cd1f3d80fc3f124cc3f3006a31a737eed6251b5dc58f6689e62
MD5 feb6af4d872d476062b59179b1c822ba
SHA1 17c28e7d78b46042058ee0946ae9021c94b5b450
SHA512 b4074f5bfec448822528e2b064529897a96c7e87f5ef0f0656056d6a100913b9313545b165471d0ebdfc9a477471ca8b54f280171e891abb406210b3789fc4d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\qap`g`v~dtlq
Size 10B
SHA256 5d51171df3535221ac81a33f0035bf262be753c0b9eeef0482912b5c2b551f0b
MD5 8115e2d2cfbe2787227ce1029cb29048
SHA1 a4c75d5c239150ab47b42034cf3a10b50da95c90
SHA512 71a0d3dc7fa76bfc8782c8d5973d44a6009e1fbad00a3df86432fb2e26bc1d6e17039672bcd97efba71fd869e261790e40ef767bd0bc0cbcb2b468fc08baefa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 390f6eadb5004cdd6e0ad8223774de8e4c5875126f17ce439a2d07fc1d3b285a
MD5 ee0886a282389a7b15c3606466d7a0c2
SHA1 2cfcb323c6fd28322e2f3f0fbb7eb8527247a5c5
SHA512 0e71ba01eff95f6881b6c22d91effd1f3293c81b4fc85697631efff420d4cb132a9cb9eccf095eb2e2faf9fcac4f7d2c25fc248903ff739fffca2924da1f16ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0660f3ba2d327fd04b1400ecb46b689154644ae017937d1bf0e630bf866ffc25
MD5 597955af912f55b7f31c90cac5e47af4
SHA1 1116f5e648f6de61e9f5bc40b9b612fc38f308a3
SHA512 1726eb8c7a1b1c24064eb528ba66cd7deae841598380ea0234b455c5264ee63c85777455edd84352bdfb6294e5b239a89cc5a41c0c239116c97c61cbb59aea44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e265f0da7b9fc89edeb7740159b09631ec2af6df7204398843da5ddb00cc1e7
MD5 e3c232615d8ba0944e882c74b22cdc9f
SHA1 26e21f9405948b01b1f27f500fed068e5d742ffc
SHA512 eefbce80c10b26352b764e296e87f8a39f2ee66e64cdc2fb6ae493a808cb51548b5d235279b760328b55efc9c9a76dd7251df003cef3e7ce98772483840a151a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 265fda88752356c9acce3ffe4d15243eafc6909c262a252fbee9e9d44faf7f37
MD5 b557dff9267febf196dacbf9c895d974
SHA1 5a065bb9ba2e719664053b349ada11a90e8da0d9
SHA512 87bbf4d258397adbbc8ae9fb4e8b10118c71a8576e74eef6f0d7dde3c241ebfb52986a9795dcb2dd4b5d99c9b407ad78d128f0151f36513782023c4792bb5baf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7098c78f8654bee0b17c25fb0c7156e185a3ab2c1f016a88c4be31a8428cd0e
MD5 c2f40f2a38fce5d368e5eeff797c706c
SHA1 2a53ce996c313af9dbd07b7450563ab25bf39227
SHA512 c090db9e928ef71ff91ef9199e2f503b4eb26be645f13d693b5712483a888bf612602ab7e3ce376d2732b2ad44a79ddd75b3d66f131930437fcbea71009d7fea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 219e72850b2002107962f9defe061baf95617dcf19e90b9364e8d9d5e2b7839e
MD5 fd6e0c5ece06f8a1d48c46aa98e9c7f6
SHA1 a105045b125fb5c7a7ca6a4766a1d2f04f2041c0
SHA512 5dc2f95e716caec9d229d8bafd2dea7ae4c18e5a40359253f5c2a9572768ea1aff0f2f5f081cf431ecab9bd9182bc59e1c00e8bc07f03dfd57e08138c9fc6d0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d07d42251c95ee662a2403dc801ef486ede86e78cd73ff1a9cef08a0da5c6d52
MD5 1108fcb437f051b60476b8457fc7ef0e
SHA1 fc440871733377f516dd3832666d845dc3b1d945
SHA512 c94f8fc2104f3eb4347dea5281e0ea4c5e72d45a57a7307704dfa0cf82d4cb7cfd2d0d02eae2e69cbe0844e295e7a084821cecfca050b6d86b1638443ea77e3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7dc9884aa199a40739eadffea87bdb7ed354d01ecf20217bd1e63555872f5ae1
MD5 52a9000a0cfeaa4e5a212886237d3ded
SHA1 09a573b753216e9978cb37f3605d6ecae55829ec
SHA512 54c32ff31457fe39a16fbfb30438b88fc20550464ff0051df44a67317997c5ff3b311da0818fcc612d5552270dfc0d3104eed5cd1b8570c05ac06216e7a83b30
MD5 SHA1 SHA512

Submit Download

svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABBCBABAAABACBCAABABBAAAACBCCCBCCAAABBCCBACBABCCCABA.exe
Size 5.8MB
SHA256 8e37bf69679f0e969ddb032626c92d9345915d86e1b01f3dbcc167dc8e95b6b0
MD5 d738bc314eaaafdcb0ce9cfe7abdbe32
SHA1 0f7405e59a03075d836419c92071f5e86e2290f1
SHA512 8f2ebf384a72f811ae220ea63e0ad2fca2faaac1dc1bbfbf4357f26f908684b3a3fb2cf30527bbec8b776fc4192e11acea266c75068f049bcc66f0513c2a0ae8
SSDEEP 49152:U+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqatgl2+ESduqad:urrrrrrrr8OU/jIEeQfoR/IuOFVjUu5U
TLSH
T186566D41FA86C173E4670231489B83BB5B70B8554F26969BB38C536E9F337C0A732B65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 214b3132397301b9c4925749add66541f1e3aa5e2e7bcb733eac249c394b4688
MD5 262ce300b69761b64de890f8d41d6a11
SHA1 4a9d372fcc47530ad95ab6031395510e8e38c71e
SHA512 eb532468d1c1b9374611b9a54e7a9178e13bf334a3f1a7e33c6683fa096e02f4eb99f411c4ac48d0107d577be2ae875627b2ae87e7310abb44b112a7dc0c40cb
TLSH
T19C11F931B464DC63F1226CCBD139EF975CA437AF9C5C9A48630D8718A6C9839CD59CE1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b1d151cfe3d3df734ce590121f6a0e5845ceebc181285a768055e06c96d1e1e4
MD5 463c40435c43a3a110a8d5e28e705c94
SHA1 77d078efa960243d14dd34d0b9c168b76a6a85fe
SHA512 cb81e975b6dadbd3953ed7613234b3f4ab5be3e024d45865d06db3a9d8c86fd805b98ff99b418ab82c1df69eec6602ec5dfbebb2ab1b7ecb7d7909acbbe13593
TLSH
T1A3210A31B4A4CC63F1226CCBD139EF975CA43BAF9C589B4863098318A6C9839CD59CE1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e047bc1331fb40da6a0b7bc2d51d31c85b75506e525e351080c7003d94bf6755
MD5 4bce78d390f93c341f67fc454c69dfa9
SHA1 16e68e82e4945e674ca1608a18f1838da52515ba
SHA512 38122d06ead0b351997ef292824bfb0e82b4782fedae48e61d95ec974515252aa207815be2f129c8cb55e0c655b88e6d7ef3d09cfea3514d9419f1f702fd5f24
TLSH
T1BF110832B4A5DC53F1222CCBD139BF475CE03BAF9818AB5863099718A6C583DCD59CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2584-6-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/4440-2957-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/4668-71-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/4668-3976-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/6096-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Download