fe2f95bcb4321fc3e21455305b2e3ef5fe9d6dd4c1db94631bf3fd8cc79316a3

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 7.5MB
Sample260815-ekdsnsyzd1
SHA256 fe2f95bcb4321fc3e21455305b2e3ef5fe9d6dd4c1db94631bf3fd8cc79316a3
MD5 4ca5628da2cf5d107d06ad52dea2458a
SHA1 9636706e76d6e8de1ed0347471e4492457479a91
SHA512 db58b384ded4889d639888a45e961200b1497e1d9a66b68abb991179489277a6fe7efb4bb9fb368a549e3be2c8d80e55be11ec6b2a574ab14bb2410457749fdc
SSDEEP 49152:U+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21Nx:2OU/jIEeQfoR/IuOFVjUu5M
TLSH
T1A6865A0577ED4465F5B3623089B582659AB2BC614B31C7EF7288923E4F33AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
5728	svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe
2480	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACCBAACABCAABACCACBBCABBAACBAABCBBACACAAABBABBBBACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe"	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBBCBCCBAABABCBACCABBCAACBACCCBBACBABBBBBBABCBABBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe"	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6004	sc.exe
5744	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3324	cmd.exe
3568	cmd.exe
3912	cmd.exe
5928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1156	schtasks.exe
3364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
5728	svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe
5728	svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
Token: SeDebugPrivilege	5728	svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3912	4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	95
PID 3912 wrote to memory of 1156	3912	cmd.exe	97
PID 4496 wrote to memory of 5840	4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe	99
PID 4608 wrote to memory of 5928	4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	103
PID 5928 wrote to memory of 5744	5928	cmd.exe	105
PID 4608 wrote to memory of 3324	4608	2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	106
PID 3324 wrote to memory of 6004	3324	cmd.exe	108
PID 4496 wrote to memory of 3568	4496	svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe	110
PID 3568 wrote to memory of 3364	3568	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ca5628da2cf5d107d06ad52dea2458a_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACCCCCBBAAAABAAACBBABCABBCACBCCCBBBBBCAACCBCCCAACACBBBCBBABACCACCBACBCBABCCCABBBAAABCBABABCCBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAACCCCCBBAAAABAAACBBABCABBCACBCCCBBBBBCAACCBCCCAACACBBBCBBABACCACCBACBCBABCCCABBBAAABCBABABCCBBBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe" start= auto displayName= "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe" start= auto displayName= "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAAAACBABBBAABCAACCCCCCAABCBAABBBABACCCAABABBAAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABABAACCCCBCCCCACCCCBBCBAACAAABBBCCCAACCBCAAAAAABCAABACBCBCBBAABCCCCABCCAABCACCBCBCCACBCACAACAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABABAACCCCBCCCCACCCCBBCBAACAAABBBCCCAACCBCAAAAAABCAABACBCBCBBAABCCCCABCCAABCACCBCBCCACBCACAACAABCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCAACABBBABCACAACBCCABBCBBBCBACCBBCBCCABCACCBCABBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
1⤵
- Executes dropped EXE
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 22.7MB
SHA256 01c36ddfa51079318b8e696f18981964e141cd086e6081fc3fd6baccaacbb924
MD5 f8962944e7bb9df4dd4c1294aec79752
SHA1 22beaf83bcf90d36dd22cb649528aecd58e95c6c
SHA512 68eb2601266d16261b4ab89df8b27224906cb289208e8b06f1afaa42a12ab3f9061b9eb5cdedae454b7a85745699dbe3ecefba33ac85a33660e186129366d562
SSDEEP 98304:2OU/jIEeQfoR/IuOFVjUu5BOU/jIEeQfoR/IuOFVjUu5BOU/jIEeQfoR/IuOFVjH:2FIF0wuXFIF0wuXFIF0wuVZX
TLSH
T147375A0577ED4465F5B3623089B582659AB2BC614B31C7EF7288923E4F33AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 1.2MB
SHA256 b779d21d2343d41c7b61a2b0f0ac6762cf2c97a981bc75f0b641979139a9d88a
MD5 403ae7f0d4d994d4829a9c60a461c2c3
SHA1 a6f6062ac1d0163757013d1277add3467354a884
SHA512 2e7d42152e1080f29d735629ab3b5721dbbd4c08e9a98cf71a35cd248996042f38318cac199aa0f5bdaa7eaf324c9d2a2bb9c57e0adc06b09dd7f660986a11de
SSDEEP 12288:mgUFgEsnojAMTjkWIw2yzagw1LUeDuUlIIgUFgEsnojAMTjkWIw2yzagw1LUeDuR:m9+EM0NTiw21LxUG9+EM0NTiw21LxUGm
TLSH
T1FD453A0977ED1454F5B7A23489B28265DAB2BC615B31C7EF5280E23E4E73AD0AC34F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 45.3MB
SHA256 cb7e47178026c7318e427d95c82180d6ea8598b32207150f4fc80302e188dc58
MD5 3b0346bdf03b3a89ac4cbddf82b129ef
SHA1 783eeddccecfee5797e22cca3612ea5653f998c3
SHA512 efa38f0f647875f76c6c34d731822fe6dfdbf51bb670c75dffadf3b933316213050c62cd1d3bc2e0dac023cc76d6f4e4b66a0ec52f0df9ddec1f91c5020344bb
SSDEEP 196608:2FIF0wuXFIF0wuXFIF0wuXFIF0wuXFIF0wuXFIF0wuVZf:APPPPPVR
TLSH
T144A75A0577ED4465F5B3623089B582659AB2BC614B31C7EF7288923E4F33AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 52.8MB
SHA256 e24279a4e4fb486b7fc1477eabf26d14697bae0809ccd04ad0e3bee6d737c760
MD5 6a6325d46eb10c77af132240510bf5d3
SHA1 940cc929616fb96cf39837825293507d443a9e36
SHA512 c07d5cfd9aa5f2a63729962b287a5edb0578a1f5477361642d5b8480e08296184804ad6cebf4983fb9cfa5af6a5ae85a87812f4ba84742586e7dd3c825d70375
SSDEEP 196608:2FIF0wuXFIF0wuXFIF0wuXFIF0wuXFIF0wuXFIF0wuXFIF0wuVZQ:APPPPPPVy
TLSH
T118C75A0577ED4465F5B3623089B582659AB2BC614B31C7EF7288923E4F33AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 adaf507d49bb82409fc82b87300e8253372307783f62606d819ff2c4974d37b0
MD5 8357f2729370546bbeb73c3eb93bcfc9
SHA1 9b29072d275b4b9677aee398de2f089492e18b8c
SHA512 e8423f3e4b7df90c39737eb35bcb12fd9848b08f06657d7f5ddd2ed26a490e46ea88a224ac21bacffe0412eb9775f9e271b8da224cd425f6edc90df66cf032f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28198c854d1c244610ba5d1a1852b7d7f476d3cc06f4d58142874330555604d3
MD5 b517075cf7d2dca6b4e50c89175c65d8
SHA1 80be9260a659de57472fbf2929023e0befae903a
SHA512 817541917637c143e7d11b72cd5b87fae55f90f10936b7e85021c4169ac548630ec93477ff729c1c044bb05740582a683f4d7fa20394ef2154eea3effe768666
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21ea07c40a8e5a40061b9eb932c76e97f54c1ab30feef3da4e2a5135fcacd6b7
MD5 260bcf6c8d3a5a279be007008ed71e34
SHA1 ad8f2c851906985cbb9f8779fafd452d2e08958c
SHA512 fc4948d2f4a9017c7b855a4f5967326df702b04508ffbd3d4b936f194dd7cafdb382645b7a4a6b1123b00adc674498cfcf3862592233198a3ce91c4f7d675cda
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d1a5039305e078a5e4e9dd20138c6a1336dd65088ae17a775aa93584bb378e6
MD5 c0babf82858cd48df1d2e00d88316411
SHA1 c6d7ab0656c5a15b7d9441d76a14fbc1dc672356
SHA512 4fc8f631c4fb976bc00d4daf30e83c23ce7a5c39841924817b88b2922863cdd16d374e8960c9d4fb7b89d0c6c6a376ada1f7f60e8f7d03d5190f35dd1804a99f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d5ca5d43913e3c8e88b1136a05c76d4f05b5a81fed7a5e6a8ff8c137cfd1f38
MD5 91e2152cf08aadcbb90a546304ce09a8
SHA1 263a8c924d0d706bdc95a36ca032ae7ce3f5ceff
SHA512 a324fd59f1e61dca459ded2793cfde5403e09c505444999beff30f301941837ba36bf80d2e133431247ec4415f3040382347d6e3c49ff6d07e5833ac80b0edce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec3e09c027ea244c6a1644e5de79006a03acc09d16cd5ae0794ce942dc89f465
MD5 78813ae586b50847b7ee8c7fa6ec0b53
SHA1 4753eeab94c71e9eb63c79331377318675a0fa23
SHA512 17214af8bf991796139c28b48c56f7d8191a62ac6a2c649fe54b47cae616a4bc63ee47272ba35f575de1487af8c632afa05ab26267e4a518adea413edeb87c61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f3088e7cd1c337fa5741a392ab14ac99e266d0e827dfcf8e92fcf6974a2608b
MD5 b805f055c950b1d37f71b046214eaed5
SHA1 6aa4a182b72f185e170efe536f1684d2c48fee8b
SHA512 f18f622e3296954481fadbe04063cef6a239f235d4998c1abb799d1d552bdf68fe55c771acc20f3d274d75b7ee19a792ae405faadc06fa88cc7b4dd0b64f0e27
MD5 SHA1 SHA512

Submit Download

svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABAABBBCABCCCCBAACCCBCCCBCCCACACCACAAAABAABACCABCCAB.exe
Size 7.5MB
SHA256 fe2f95bcb4321fc3e21455305b2e3ef5fe9d6dd4c1db94631bf3fd8cc79316a3
MD5 4ca5628da2cf5d107d06ad52dea2458a
SHA1 9636706e76d6e8de1ed0347471e4492457479a91
SHA512 db58b384ded4889d639888a45e961200b1497e1d9a66b68abb991179489277a6fe7efb4bb9fb368a549e3be2c8d80e55be11ec6b2a574ab14bb2410457749fdc
SSDEEP 49152:U+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21NP+EPiw21Nx:2OU/jIEeQfoR/IuOFVjUu5M
TLSH
T1A6865A0577ED4465F5B3623089B582659AB2BC614B31C7EF7288923E4F33AD0AD34F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 aa61a968e9d73194ae6c40f73ae401ca090fd9b0a028cb2ee005c949f7187cf7
MD5 d6b2c805fa12a6d0c689d79af540a331
SHA1 371ebc7236da7996418f606901b471d1c3bd76a3
SHA512 441fc4387e4e9089b92076616365bd73e186539640b56ad5768029ffdb580f68527e0b89181f4a5a80c43f1a458baff57d8a94e784cb626da485a8cc98f63fa5
TLSH
T11B118422F9A5DC67F932648E6E2DDFE308B43B9FDC9C5E1413088118A7D9D328D594D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 386dd902735f7621b9785b36723cd00eb5c1921bffc7bc77bd50f24a051523dc
MD5 8ac5d794f09ceb348834f2e7adb421bd
SHA1 8ab9f83b1a98f9ff4c991470dac30bd1b366a6d8
SHA512 e02ac0872ccdf6e9c55b6af1f657a1b607810a4ed699b572a21ea5eaac16d0e2b3be3a047e21140dee6b4eb165ddf391a2a6f5862a67ee369969029de2f5b16b
TLSH
T1DA11C862E9A6DC63FC32648E1E2D9FE308B03B9BDC586F1413044118A7D9D328D694D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-110-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4496-89-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4496-46-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4496-69-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4608-10-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4608-93-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4608-68-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4608-21-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4608-47-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5728-83-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/5728-108-0x00000000001E0000-0x0000000000201000-memory.dmp

Download