5625d82b5bc589cc8f847089a27df070d596313d5a22e7be1b7d4dcebaa94988

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 9.5MB
Sample260815-eqgfraydnc
SHA256 5625d82b5bc589cc8f847089a27df070d596313d5a22e7be1b7d4dcebaa94988
MD5 3facc5d9d5aa5172695b8f761253a65e
SHA1 ffdd4d50dc02384883d2caba94384ae1b41b8cb4
SHA512 3a5d6bae9639a482d110861d198bbb738dc7023868e598153d29370dcf9a617c816211f1c9466d5bfdf32367e35ba67cbe402f3c638193ba8a631d3ab43a3443
SSDEEP 49152:U+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPw:lzzzzzzzzjOU/jIEeQfoR/IuOFVjUu5F
TLSH
T154A67D05B6E948B1E5B7613089A6C279DAB1B8514731CBDFB388832E1F33BD1AD35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2172	svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe
2912	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCBACCCBABCACBABBABCACAABCBABABACCCCBAAACBBBBBAAABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe"	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCBBABBCCCACBACCAACACBAAACBAAAABBCCCABABCCBACBCBCACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe"	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4328	sc.exe
2160	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2088	cmd.exe
5080	cmd.exe
4424	cmd.exe
5248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1672	schtasks.exe
5152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2912	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2912	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
2172	svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe
2172	svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
Token: SeDebugPrivilege	2912	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
Token: SeDebugPrivilege	2172	svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2088	2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	92
PID 2088 wrote to memory of 1672	2088	cmd.exe	94
PID 2388 wrote to memory of 920	2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe	95
PID 2484 wrote to memory of 5080	2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	98
PID 5080 wrote to memory of 4328	5080	cmd.exe	100
PID 2484 wrote to memory of 4424	2484	2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	101
PID 4424 wrote to memory of 2160	4424	cmd.exe	103
PID 2388 wrote to memory of 5248	2388	svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe	106
PID 5248 wrote to memory of 5152	5248	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3facc5d9d5aa5172695b8f761253a65e_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBBACBBBBAACBBABBABAABCAABCCBBACACBABABCABCCBBABBBBCACCBBABBBBAABACBCCBBBCBAAACBABCCACCCCACBABBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCBBACBBBBAACBBABBABAABCAABCCBBACACBABABCABCCBBABBBBCACCBBABBBBAABACBCCBBBCBAAACBABCCACCCCACBABBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe" start= auto displayName= "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe" start= auto displayName= "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACAAAACCBBCCACBCABACCABBABCABCABBACCCABABBBBBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACCBBBCACACCAAACACACCBABCAAAACBAACAABCCABCBACCCAAAACAABCABABBBABACAAACBCABAABCBABCBAAACCAACBCACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACCBBBCACACCAAACACACCBABCAAAACBAACAABCCABCBACCCAAAACAABCABABBBABACAAACBCABAABCBABCBAAACCAACBCACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCABACBCAAABABAABCBCCBBACABBBBCAACBCCBCBABCACBCBBBCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a191be6956ce52b002a79a8508ec3901d026ede546fa0b555f0cfc9fc335d197
MD5 9194527dd294af124355aa1845b61ebf
SHA1 fb424f6bf256c1ca0bbfd11e341c573cd795b3e3
SHA512 5ad78e3b4ce5ceb39d51260d663f369f6063bfb2430910858858715161ae5b8c8ea52f64d767b207e63bc2000948b174071659e5f4df7216d897d7fa8db6d2cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 447449c4f0ca7dbc7f2a5f4904871167a0d39fae7563b85eee2c13189bd1676e
MD5 bbaaf591a03ac37092318a895e2c0f43
SHA1 4fcfd295435122b26ca216582462df9c216acebb
SHA512 4230338afc8358c164a7e9487174b3e4cee64b2eebe6cec64f0b996214c71727c0c8576619fedce56a30ee6eb9fb3284751e8ab32776b9ad218faec6e891e1bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\uk-UA\qap`g`v~dtlq
Size 10B
SHA256 044a4c2736b2be95ad84ef187b08630b6850028f66bc2b8291c29af340d81e6a
MD5 f7154dee7d5be7135728db36b7af1cb4
SHA1 ca6cc90544bed84cc6fc7b9a9a68df3dc03b5e43
SHA512 bab3b77f8c73b04bd25d95a1aba8cb01d751a0dd3a9e1e7237304c76afd6fc5f409e5f1edbec02f7299d9d29b9d1ae6c5184caa72c68de4ca220927ad5893d34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM\qap`g`v~dtlq
Size 10B
SHA256 6662b5d8d477d13534809a203387ac5cb71dc11926961a1c06820e0a1ea547a2
MD5 b10881331457f9eb73aa77de3b267918
SHA1 b7b25c56a9d2dc15dbcd09e0113d96438ff15bca
SHA512 4c3e3821bf9e654595f6e8e3e7cd0f9480b70fb93f4e402472a30b68393a8526484c8f7afe7749cb4709c51123a7039567edd6b403d008173cb9d87c253260d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 0c6bc65b3dc485c4f75ccf883e6f3ff6ab9fc50ae6051d901e171098b7c55e4a
MD5 32742607835582be86b7ef08e507cb72
SHA1 b15f5cae4268069a6ed7609dfc3043fa2cb8ab38
SHA512 ff4fa9e9315b97dae8b701514f318dc306b4bdbed990102c9fa46ab0439f4852d13b0a648fa555c4486b925b64acd535904914ed9fc251887d3ab3ea1407cb7b
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.1MB
SHA256 329dbfbc0c63f80b7e1cdcd3683fad420289148b4a8f0bc230650d63249761bd
MD5 53a00a2fca94ee8d0b29aab1f0c60f9a
SHA1 32dc31e05d53b389ae39b348bc61318a83ab4f9a
SHA512 a2bd05b7ad88b04bd794c51f1969b1a2506e5d3033c92802af69976129efb315113ce6c459e869cd1348428e9ff4ca7fe285dc0b8ae733e7a5e1788498654ae0
SSDEEP 98304:lzzzzzzzzjOU/jIEeQfoR/IuOFVjUu5UgZ2Hb9t+2x5:lzzzzzzzzjFIF0wuCgZ2j5
TLSH
T11FB68E05B6E948B1E5B3513089A6C279DAB1B8514731CBDFB388872E1F33BD1AD35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 f7b2407664826b65cb8dfdf043fdca14f45b66c92039c8dd332b3ec3da69f6e6
MD5 d8cf1da097b541380d3d3c4db027fcf3
SHA1 47262718c88703d9dc46e018c346324c41051a68
SHA512 2294dacba59e39ba0e9198ba89d52f343f40fef4a3a55b5026bf521bdd87cf41325823771aad1c7cce3e44c564f41e944f98383448c5e431c56104a0a99cdc68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\qap`g`v~dtlq
Size 10B
SHA256 e7481d5cd62bdf19da8239831966faa92c5a730d73d26ab5baf36d058359b81f
MD5 0f894755c976e8abdbbbf17be8c568c0
SHA1 187a2e6786e2bbb33573053cdd294f2a55f5723e
SHA512 59a7c7089b8c9df69a737305038b5ea02912516a5ed0558f14866c70f97369e6732dc7a9b64a3544f3f3d58cbc41d8d2db1e748d3e049a08b74feb8d9ac24dd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\qap`g`v~dtlq
Size 10B
SHA256 541f991a90136a7720ad1b9aabdb700a94611c17db05d112a9d95c5c721b6af4
MD5 86552ae2081f12663b45019439be0ffa
SHA1 a2d35776491b7491a7d0d7942dc8aa9b8926e21c
SHA512 c73386ce39f39e657aeace39f253b84e881a3b26ffb76ba690aa86a2a0e7a2f7c41ed69351b518871f25f581cdeaf874e7737a68f7169d1b7a26f906d9c29031
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 6862a53c51c2557606a6f82b28de6008706c2e8aa289fcd43fb2152aedea01e1
MD5 64a560c3df3d0bbb7a04f74bd3f1a625
SHA1 5e5b89b246607dea99c84c20a3ccde618d0c90c0
SHA512 e41a69f3394ee2269be97cf356ef2ef20c2f0900f84355d00426feba47580be789acc5282420c2cc67ffbfe9e0e3248ae6fe42c950948f6bd09661d174319cd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\TokenBroker\qap`g`v~dtlq
Size 10B
SHA256 4fbd4cb76c566603f6a6b66c480f16a3e8d4829a8a5c7c283dee3597cdadab96
MD5 7a887ff15fa397c4a2491f15a362529e
SHA1 0f627f4d3d444bfa3615bfbe965434b2c30020c6
SHA512 c18865317c686ad954174d89a79703cda70553098ffd56c41dfa4f56a5a4c5adeb34b32df30a10a9c810cbb017779935e641d7577d17f7e796f67dc4a793778f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77288cb08f0ce74193367d96de94ff5486d886eb2184c2a09d932e610b22e78e
MD5 3653f3ed10923e7e45b228030d85a7a9
SHA1 ed3e87650aeb86ecacfb5e0084affab53eae1890
SHA512 70f75f5409af38613a03aa6d8024561f2ab958d68b86645c6c24db86a3ca2204af8b465bb84880893ec950f39c612154cbc0cc7a197dd110daac6d49e8d57704
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2af5414d8cb6884d6075a0c4ed0a7fc58e132b19e0f2000c164b4d9a47b46fb3
MD5 e9456390ce57029823aa54e727efdb47
SHA1 72fbf1eac71602a725b773bf11102995e939be11
SHA512 dfd047deb84e7dad7474e671dec208c9bf035fe61133a290c8eab17bb66e1eb1d5220afecbeccdb064a554685213d6ce3e9d7182ffcb63bb9a79cc1ac408f30c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4873af6ed369ed3b6370336f991af1203ab7c88d582b7166ae62e3114634ee4
MD5 719d92c65cf0ed4ca3b41c51dc455514
SHA1 6ecaaf497fc81037832133daadbed43a41d827a9
SHA512 c7d0dc239ebbee32bc88400cba26335655e02c208ec9873bd9015ef68b19a07231397b0ab58908af5967a5aff477e5884711ee534e842d299e5557f96b7841c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49d8c3e66310ad3b9f78b16564f981c6a5aa1d4a1c27fe04533bf785db04b87f
MD5 98319a84218a3109bf3b910a016cd108
SHA1 73fa9b3a5583a121c25d6eb00881d284e9b19142
SHA512 abfa55f5616e6002de641fdf542f124b49b2106a4975fd8be07969be3d104be5e63f7af2d6c852134ea2cc433c11457c0087ce0c4877f1c9e1dd68f3db156e24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 203ad2d36540a72af0c7d215b89dd14334a33d33a99b296d7a6bcd839ad797f1
MD5 e6bbf624c9c0a2a9244621d1b54de813
SHA1 305cac84ed5414f7d825e199ebb996bbf852ed6a
SHA512 7014c453812eb6422c9b3933c1fcc4afc5659b8525ac8994ca65ed1b63e543f97e50094369cc488c8db358528b188bd7f8e145262435ca0d59326eb37d50b18a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af486027b90b43cff542aa113a6169b5e0fd8507775ed00150308a32ef885799
MD5 f3e2b2fad1c08f6196bce4c48913d090
SHA1 f2339e2badef98144fda3eac1a9f4fb1127f70bd
SHA512 71f4202d43aa024927da6342973ab6addfcf87957985def98b1f40b0a61c2cafa75fe708bc2d7f6e4fb3b54616f1808c7e19db27dc973f2d2c7b38af80c5ebbb
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAACCAAACCACAABACCCBABAACBBACABCCAABAAACBACBAAACCBB.exe
Size 9.5MB
SHA256 5625d82b5bc589cc8f847089a27df070d596313d5a22e7be1b7d4dcebaa94988
MD5 3facc5d9d5aa5172695b8f761253a65e
SHA1 ffdd4d50dc02384883d2caba94384ae1b41b8cb4
SHA512 3a5d6bae9639a482d110861d198bbb738dc7023868e598153d29370dcf9a617c816211f1c9466d5bfdf32367e35ba67cbe402f3c638193ba8a631d3ab43a3443
SSDEEP 49152:U+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPiw25+E/q+Ef+EPw:lzzzzzzzzjOU/jIEeQfoR/IuOFVjUu5F
TLSH
T154A67D05B6E948B1E5B7613089A6C279DAB1B8514731CBDFB388832E1F33BD1AD35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b5aa371d44f04cfb34fff432da316b860b671ee7bb70e3b69113d84c592adf9f
MD5 3cbf69c7adff55ec6d528d5bada01db5
SHA1 da40f8451c43a8d8536185091e854907b92f1fc0
SHA512 3fcc67917858b3feef1ea663a91f3938a6594fff05bae620e1b32a2c1781dc62a010d452bb76e7752c7cedc3839105c727794a19dc749abc0e77cd8709d74554
TLSH
T14321265168E5C853FC3268CB9A2D9B830DB47BDF58AC6E14234882197BD5D31CE5D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 75eaf63f80662cc0bb30ce2b1d34c19986517887574fde361617caffd0af4cff
MD5 f66877491ccaadfdc8113d894d533f2c
SHA1 9f6bdafb020142363d14a9a24f4338532bcbb631
SHA512 093bd0a59c2c4bb5c71dd789604d53e596ebed11cfa6618a41b2c5173047e49fc2967b41a2a6fa96c0bd3450f708f5f3cf8f8201877016d64d41f92ccb004542
TLSH
T19421F36168E5C863F9236CCB992D9B820DB43BDF5CAC5E14134982197BD9D31CE4D8E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2fc9a27921c64215a68299e5ecc6ef74e38edd99465aa3e400c9b672d1be63c8
MD5 3f28ac2cbf8ee449c9904868aeb64768
SHA1 406cf68dc28ca6aace08841bed04eb199e095851
SHA512 9c4c3c9f90b0af3d42bd657530cc40ab67d0bf2d6319c15cc1a4d17b0d9e19efa9c3eaed00c56d039a64aa391bbddca4c9dc953c829e068d33251d2d39e95ea2
TLSH
T1BD11575168E5C853FC322CCB992D9B830DB47BDF1CA86E0423088219BB95E358E584E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2172-63-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2172-3928-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2388-33-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/2484-0-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/2484-7-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/2912-2014-0x0000000000330000-0x0000000000351000-memory.dmp

Download