c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 9.5MB
Sample260828-rbfbcsdb65
SHA256 c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388
MD5 780d42c420a92f1d2a26fbc28b52d114
SHA1 6d9a45d73095e040c2c29be77db7b4a4539001c2
SHA512 c4ef6f418a6a6605153dbcaf3f978b3e2dfe0138ff129518e02b9c0f45454fdaebc1e7418884815e66acbd068c8912fc59f7468e234799fa719a142a948b2719
SSDEEP 49152:U+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EB:FOU/jIEeQfoR/IuOFVjUu5u
TLSH
T181A65C05F6DA4471E87761704DA7C27A8A71B9618732CADFF28C862E5F33BD09834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
4292	svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
2452	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBABCABBCCACABBCCBAAACCACBCCCCCAAAABACCCABBBACBCCBABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe"	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACBAABBAACCBCBBACABABBBBCABBCCCABBCCBABBAAACACBBAABCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe"	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2240	sc.exe
4432	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4044	cmd.exe
4844	cmd.exe
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
4292	svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
4292	svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
2452	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
2452	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
Token: SeDebugPrivilege	4292	svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
Token: SeDebugPrivilege	2452	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1204	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4044	4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	101
PID 4044 wrote to memory of 1340	4044	cmd.exe	103
PID 2352 wrote to memory of 1032	2352	svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe	104
PID 1032 wrote to memory of 3044	1032	notepad.exe	105
PID 4108 wrote to memory of 4844	4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	109
PID 4844 wrote to memory of 2240	4844	cmd.exe	111
PID 4108 wrote to memory of 4996	4108	2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	112
PID 4996 wrote to memory of 4432	4996	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_780d42c420a92f1d2a26fbc28b52d114_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACBBABBAABBAABBBCCBCABBCCCCCCBACAABBAAACACCBCCCBBBCAACCABBABBABACBAABBACBBCBBACCAACCBAABCAABBAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAACBBABBAABBAABBBCCBCABBCCCCCCBACAABBAAACACCBCCCBBBCAACCABBABBABACBAABBACBBCBBACCAACCBAABCAABBAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe" start= auto displayName= "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe" start= auto displayName= "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBAAABACBCCBBCCCAAABABCAACBCBBACBAABCACBCCCBBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBABBCBABCCABAABBCCACABCBACBBBCCBBCABCBBABACBBACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 51995b98bb1cf31eae5f6d8c42fe3a754e08ad88d14ab89910ac42272dc4f090
MD5 f753f1a1c1c95c9b67a8ef41f1e494ec
SHA1 fadd84f3a6097122cc3ddd8eab08f3309da26306
SHA512 0cdd38c6a02751aa35665f1edb724232a7870574bf720955e48187048bbd6f093b8aef1aec74f282c7b937ae20981ecb78338fbacb5869826787ab21d2515e77
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 9.9MB
SHA256 d604c835da031344a504c21ca41a58fdc17035de1a1194f20f3e3a2838f3de60
MD5 f928615ecd8f0bb5ffad719815dc1f27
SHA1 40e3acd99bb38d8b7857c0e00d4a0ceedacab4f7
SHA512 5368106aa6fc5e793d3585b2a3f7395020523109f7036cae6bb52c11af7be4fbf36a303e0e9030a5b35d6a22fff6d92fd3c13af3a1196243b351a706db7191e1
SSDEEP 49152:U+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+Ek:FOU/jIEeQfoR/IuOFVjUu5ZpiE
TLSH
T150A65C05F6DA4471E4B761704DA7C27A8A71BD618732CADFF288862E5F33BD09834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\qap`g`v~dtlq
Size 10B
SHA256 55edc3b89d535b8c8b02f32b4e24139ceca741f7325f3c4d39d344bf4d7b34be
MD5 e8f79df3b26b637dcf1479b5e06bbd53
SHA1 d330a20689829cc6d961fc267cffc725606f4931
SHA512 2174daf7136f62763d90fc82217631d202c8211d86dfb11d8ba784060866a1cf100028387e7e537445482952cc60c21813e5ea3e45b3603eed84e30bad2888a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 dacd78e5e9390eae95fbf183b62626f828220978b93b2f2d39b68de7d0981f0c
MD5 2783a47655539d56a4e7b81e0665fcf9
SHA1 2a1df134ed7ca35bfac88624726231d29d1dab6c
SHA512 e2045a10e1354bb62bc4f147ba1ee8cef6598ab90ef7aa355aa0e666f4ab3bf3562647cc464726293e6f143387f5e63d4745df545a607c00fcb98112afbb8df5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\qap`g`v~dtlq
Size 10B
SHA256 2e67e7b3796fc0d52a5b3fca2ecb80e435f593975628de97edb7cb2f5333c0c1
MD5 8019fcb15db55bc86e21d1450586f04f
SHA1 f8102cd9b1b57965ffa1bcd89903f853853987ed
SHA512 dac67f37a9bc206f33605fe7710448c062dbfbe52d44d50f656cece02236ca2a93fcbb8054f499d99aac32c08e428f6b6cd578bb626dd7f8ef1bef9097c22c3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\cache2\entries\qap`g`v~dtlq
Size 10B
SHA256 13536a79ebf44e9932c580c12452527f9fbf98c544a0b3b9b622903de43f268a
MD5 f1fe836cc18d76633339bf8342ecf2ac
SHA1 6b81def34e8c436b49af24d7438cd27f7fed4afd
SHA512 1e97b3f57c24ffcf16d9c78006b0d93f03c85bc5009f82e46d9f227b0d019468c4801cf3a3c5e78a455d1fe70e958be41197a9ef5e442203978f4abf975c9869
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 5bb2d650c2ceb8798337f46b2dcf4cefeee817495d3b4581ba9bcff749d5354b
MD5 2ed14be39773bc89069b8cf91beeba3f
SHA1 a2ff8dd3229943a60d00561cfeb79d7d34f2ea14
SHA512 45ad6dd7e60bb48116f9e7b587a40e876ccdb100b46e7719a3cff5ffaaa39c0471fc224a9224bb0fc7aff72218fbffaae319cda0eb23b8e61dcaf46324a6128f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a6ba2b25e497a9b1ceb40075aacf704f72cd2bf4702f06435e95b4218a9b12a
MD5 64aa557ea52967ac4d3c208d1834f7f9
SHA1 45273e0168c2221989575bdbfb7a997314b235b8
SHA512 29bfb539e298cfd5c08727c3e2639e7e79db2571fab3b7b754404e7c3dac89639362f3ce4d48c8085a3fd19647ce4b543d30f751345bfd06665afc84c50c6f5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9e968aecf6db3d75d317c92952135e3f6e78ad8187c305fe37332932d819e8a
MD5 ed101fa0349c4119393d51a33fffa757
SHA1 f3d1828fd4ab180867f4cbe1388f730d33d75f73
SHA512 7f51a92af30b2957d3a0690014299e518be35227b7b2833fb4010324cbc91db5e1b2e3cffa6fa88bf9f77450b68cabc65380ba7b5cdca483c0352a81f1ecf7f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2bb6ce1917884d61d07e2d753f22378895b77af6a13b19132e3f8c3c310e0bda
MD5 f3126fecaa87ae25e06c3ed32fa216ac
SHA1 961cb414c727ccdb980aff25f5610f8c7bac013a
SHA512 aec91972745e72f4c2eb2076d3709a66e956b3e25850cff552dbff77b732573bcb8879373eb3eab4972e8bfc4491b309694ca33ec11b9af97eeda6567c12493a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dc6de640e4c32bd94e99be148978e45bdbd9dd23dcec8af8160726f52d42fdf0
MD5 85a3057808ca035266a3d92cca1b4e56
SHA1 8dcc926b0b9949e5e3a9289ed69f68284d0cd897
SHA512 00da9ec5b180547acec878364d78903b1c94bd4aae7d08c02b1117f463566e81fe3798b9a3a8ae5c37ed643bc519ff382af227d9110eea3fa2cae6ee01064f26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fc083a6c7906879200b848dfb4700e7c02caa4d96fbc0118ef6aab1a110540a
MD5 dac057fbc3cf44177c971b33d7eed03e
SHA1 afe05b48677cdc91a26df9faf8a99ccf629f523b
SHA512 ba29488ec7cc5350612e51a8b5e68b782ad8b7cba51e838cbe9f1c2cd86eaca91e850d4b0dd09a7caf5e955c1cd03e0b348c66fa3b95732403dea06de4cb274e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 807b434344781bf8ce27eac3bd7ad45d0ee35e690ac3644194712ccd1ef85954
MD5 2cce9d838c7b5d7478065337ff56965e
SHA1 7438ef77bb07520de5a2509ffe6a58a699ed8eec
SHA512 cdfd71069222763cbbc068f021120b44c585a30b9c21b0cdf18fea4b559cd3c48a40d3fed6ae01d0b51201ad2d507dc4c1f7508851df86c5242bbbcd85ec1d3a
MD5 SHA1 SHA512

Submit Download

svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAABCCCAABBCCAABCAACCCBCACABBCABCBCBBCAABCACBBACAC.exe
Size 9.5MB
SHA256 c583a8920f7950f92648042d14ce5a0172cd0abb6346862f92ae32acef5be388
MD5 780d42c420a92f1d2a26fbc28b52d114
SHA1 6d9a45d73095e040c2c29be77db7b4a4539001c2
SHA512 c4ef6f418a6a6605153dbcaf3f978b3e2dfe0138ff129518e02b9c0f45454fdaebc1e7418884815e66acbd068c8912fc59f7468e234799fa719a142a948b2719
SSDEEP 49152:U+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EQHiw2J+Es+E7+ES+EB:FOU/jIEeQfoR/IuOFVjUu5u
TLSH
T181A65C05F6DA4471E87761704DA7C27A8A71B9618732CADFF28C862E5F33BD09834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 3844ed45b2f817b9af6c3a35d19ac1a93f3c9147187a09cc0cbcc26218ab6625
MD5 c539aefe16ec5aeba9efe211fc16474d
SHA1 3487dd8d0992963784957ce994bb5369bfeb929f
SHA512 d5afb19f1161064280bcd47796dedbf17837c5fe84cd5f80eb56e7c9ddf7dc0d12a743b3693ac6c7d1e11d7c8811238909c1520843374e3b1a2dfb86292e92a0
TLSH
T1DA11C452B5F5D813E533A4C79325DBD7389477ABAC986A09234D8118BBD88328E9D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 943fb3ddb53db3f3e55cd700cf8ad741eb1b627d242d27f372909fdc29e294ea
MD5 0a0d407caa6f2d3c41fe1b37f120be7c
SHA1 9e1e42efc66fa1e42024da036a8df9aaed7f3162
SHA512 74e8f02d145408c7132c587bdc9cca1474277dd4c792d5a689c3d1f174de0c3e7a9f3fab6ded96a4bc45cd06e24164709801d6a3b26370f0d743643ad436d565
TLSH
T1EC21FC52B5F5D813D43368C79725DBD7389477ABACD86A09234D81187AD48318D8D0D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-57-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/2352-35-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/2352-25-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/2452-88-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/2452-2756-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4108-6-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4292-77-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/4292-769-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download