5e8edbb3201eb6049d52c00f9d15802f90bdc13666836eca5d94ef563e55fbe3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Size 11.1MB
Sample260831-rshstatdrh
SHA256 5e8edbb3201eb6049d52c00f9d15802f90bdc13666836eca5d94ef563e55fbe3
MD5 d0be18222c85e6927dfa590ec3936862
SHA1 802ab4093e28342709ccbbfaf76618db18db36f9
SHA512 5b57877def7c4db576ecdf8073460101f95f2e8bf08d7757ee6b0957b86b17f1c0aafed57391e3e8033ac565be2277c4b5fe59c82d1a1eff26aacf12a888bf46
SSDEEP 98304:XOU/jIEeQfoR/IuOFVjUu5EOU/jIEeQfoR/IuOFVjUu5a7pX:XFIF0wuuFIF0wuY
TLSH
T14FC67C05F98240B1E57711704DEBD27E8A30BA6187328DEFF78D861F5B32B919935B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
3936	svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
1532	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBACBBABCCCACCCBACCACAACCABABBCACBCBCBBBCBAACBAABBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe"	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCABCABBABABCCCCBBACCABBCAACACBCCCCABBBABAABBBBCCABACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe"	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3380	sc.exe
4460	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2116	cmd.exe
4812	cmd.exe
4908	cmd.exe
3368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
828	schtasks.exe
3112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
3936	svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
3936	svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
1532	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
1532	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
Token: SeDebugPrivilege	4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
Token: SeDebugPrivilege	3936	svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
Token: SeDebugPrivilege	1532	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3400	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2116	3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	98
PID 2116 wrote to memory of 3112	2116	cmd.exe	100
PID 4772 wrote to memory of 3156	4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe	101
PID 3156 wrote to memory of 4896	3156	notepad.exe	102
PID 3036 wrote to memory of 4812	3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	106
PID 4812 wrote to memory of 3380	4812	cmd.exe	108
PID 3036 wrote to memory of 4908	3036	2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe	109
PID 4908 wrote to memory of 4460	4908	cmd.exe	111
PID 4772 wrote to memory of 3368	4772	svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe	114
PID 3368 wrote to memory of 828	3368	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_d0be18222c85e6927dfa590ec3936862_amadey_elex_glassworm_hawkeye_hijackloader_luca-stealer_.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBABCCCBAABAABBBBCCBCCBAACCACAABCBCCBBBBBAAACBACABABABBBCCCBCBBBCAABBABCBABBBCCAABABCABBCBAAABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABBABCCCBAABAABBBBCCBCCBAACCACAABCBCCBBBBBAAACBACABABABBBCCCBCBBBCAABBABCBABBBCCAABABCABBCBAAABCCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe" start= auto displayName= "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe" start= auto displayName= "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAAABCBCBBABCACAABCCBAABAABCCBCCCAACAAABBABBBBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCCCACBBAAAACBBCACAACBBCCCBBABBBABBBACBCABBABACBBBAAAAACCBBACCABACACCCACCCAAABCBBBBAABCBCABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCCCACBBAAAACBBCACAACBBCCCBBABBBABBBACBCABBABACBBBAAAAACCBBACCABACACCCACCCAAABCBBBBAABCBCABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCCAAAABAABCBBAABBACBCBBCBCCCACAACCACABACBABABBBCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 01725f34ed4128be34025e09bf2a8b3782ab36932eda20b98cc11aa51647a1f0
MD5 c8d401875160bc288c94cc095b44cfd9
SHA1 fc350da08749ddacf3a879cf261b256ee4332ef2
SHA512 d4ccffb15c6f71e4950800241c7b373579220f491926d0e8f52334dd019b988b94e797f9ac199e57f5455da8b8b8073d1fe0a62e34528691ae1e4f1ff9147960
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.5MB
SHA256 401a5894b92b481cdfb473e76409a04a58a60b42b6ab62cf14a25dae5f2f3b2d
MD5 bb39020f77e183d5f223ce8b9f8bb297
SHA1 a36c90ddda5f4a38a58c7fc4cb0e42eba26b7d5c
SHA512 e332b72ac8b4267148f0d034cb99bb20a1ed801ecd73b9074748260d564a951c1a5148bc86a268c2285c5c2bcc9a0a03e6b958e8ad72e8c2c3a75faa90a3c380
SSDEEP 98304:XOU/jIEeQfoR/IuOFVjUu5EOU/jIEeQfoR/IuOFVjUu5a7pcpic:XFIF0wuuFIF0wuv
TLSH
T1E4C67C05F9C240B1E57711704DEBD27E8A70BA6186328DEFF78D861F5F32A909935B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 a3b5f70d724b0a5bc67100b6bfb5c691f34e35f38b455721e58b246c7ceef5ae
MD5 3a091799a48ec4966754ff1079f865e6
SHA1 7cd3db7b5c9f0de91a698ba35e203d3ca2250722
SHA512 f99734e759a1705a5a81c92385c1b43f9a97749bb95733668622ed8f508a33b0064b7e171cce17106da4f7d94c76cb2e4682763d03a68621423c15ccc1917f21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 65bb3c44509d621fda33fe819449882990690fa9a207df690a7feb260861c2df
MD5 90e9fae624d72ace7caadb80639a2cda
SHA1 e504c657346b70fe383ffd610669ed8b1283558e
SHA512 fafda52819d322cbd5d763d9262e7832a4977f602d0ffa7620f54cf9ef691a151744b2bc61615bcdf4a1b99b31534f2d1a911b62cea4ed0d7df1b361c0af43e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\vi\qap`g`v~dtlq
Size 10B
SHA256 14d6e192be2e586d19f2db95174b0d963758fca2fe71be1873996b9178463e0e
MD5 1c5f3051251635023965230ab7431cb7
SHA1 e2d2cdd25c38b584d83dfea41a69800949c1e34f
SHA512 c5f4527f5a610ea232640c681b8e580c20beaf7f5b3e84aaa37d061b3251d106202b9b3c2e6808413b845990969068acc92759d81e4505a1a35f8d2cd23ab0f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 a3970145cba08d6af665e55475acc7af205b6f53eb95e0f66ea771186fe47171
MD5 3a97cc9e12b2b3759f421e31676df0c2
SHA1 140facfbe5540286c2dc263bdb71718f0efc645e
SHA512 912d788084d3bdf0a2f083ab53b6991c059bdb97de4da0569b8e41dae295b281d27a5c35ed6cc408dcb3e10a1f7ed5679d33f052b4e7e42d6f31db0a471f93c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 d2dfec22dbdebf893d617783747ded708325e04ff2bed8fccfea5dd95a42ae3b
MD5 1bd75b15115321d90df0d33295ad4318
SHA1 0841ad3f51e084f95a80ecf260ea803d37cbd56d
SHA512 7e9ffad295b0c3f6ed4d07af952969e029c2b38b432977a71843bcc55d0998e40476131afb3f5e5fccdeaab75fc199e8ae3b463a55451c4ecefa8789e5267218
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d4402b84db75c736991b7859324f57a6d19d03037bff595f4d438ba386acf0e
MD5 780ba9b78e1c068295b5b1fb35c639a1
SHA1 af57f21fb19ff006dbdb9a78d8d97f4d75553b91
SHA512 586333ff21d5fdcc0aac020c1c634eb67a5ae5756c807be870095a3c8bae83a9a9ef8299847a982d30ace597078ad212f6345bb7fed900ae8f3e10f18914cd4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfd3c61b2a9d02611d90e64ad4e8af7087d75b4725db7e06f7f8091fe2e96c00
MD5 d057dea9177ba43a64aec7443b83a3a1
SHA1 94636ad41bedbecef59f4c09d4414a26ec1884d1
SHA512 e1449e4a4721879e8f0dc2206c3bf02a6c2800cdb44491c383ebe157aae97b32a09fed30d7e77a4ab5cb1f8a5691e0c185c000f8fc1e984961e211855bd96fe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7d04424b9031324f84300ebb1586bf0a0f0ff051efe6bfb98d05c818d0beac80
MD5 aa36d03e13abf6d23fd156682c96fb7b
SHA1 e9d8baba164cd5e0a840130f693558c73b9da2e8
SHA512 a6decdfafcf8654232d727543c2e16e5e797edb6dc9ea2f8a9acfb25134a78711b22d8228e2a4ffd1a06550e6935f3efba8d783818fdeeff987b4439196b8a06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4099801b7d75ceb9a7e674a90616f9d02f0f5b44dd8c94d3daf492b9ad446c97
MD5 c7e51fa0c5b27548c49eb49c1b16af8c
SHA1 e040f0e9c977075b60553b2bffe75e6ea4400991
SHA512 29ea7852d74c4a20ea04ee084f9c6d42103c4e736be0c86c82cf6f10bb91f09e6b126dab5a4ad244df11db91762291dc5b93ece32ae1aa269830ea1d5f8f7e4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 66be0076431f8fa3a097afffc33f28b3061b51f704002ca0b9351b77618b5031
MD5 d6a2a8dbbf4ccc52981232707c265f28
SHA1 8fb7b0a162fcf8895be1345276720fbc1b523c2c
SHA512 60d55fc332d35eb3cbc00218f3fcc09575d91f9c8d37c3bf35b02dc1e85c58d3e0c3fde4968f183cc2928fe7865a5d2983b5e965c0dd56b0cb6e7e4373b6c7a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7d2d62dda47d1e57c3a4d5cb614f4df5803dc8eb36447c5da6f96bede57d7ff4
MD5 52daf10f1e78f45eecb7e11a6d23d839
SHA1 3ffffbeba796af58c187c2878f523223ad149026
SHA512 34a294ebaaca981f2947432bb634ae5c62b4742ba3eaaf51eb00d68d2d3de29942a50083f85e32eb723821bb81b4ba78def20f6dee998af248110da140818661
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e8cec4f08b17d1b7a010b375cd03de7df4d45c66066385d1e0a657f97d2626f9
MD5 96e6e2ebbe677223f24ec7b76b596ddb
SHA1 73703c56467d7d62843a6ad87ae69fcf504ebe88
SHA512 7c1441cef1ed520ba1a7187640a86ce24ea24a5e1aba249c182fee2fb909a1cbb15af93d3a9db88c29ffc84f0270be3d62853d0fd5d08de755086110bea96ef9
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACCABBABCABBBCABBCCBBCCBCACBBAABBCCABCACBABACCABBA.exe
Size 11.1MB
SHA256 5e8edbb3201eb6049d52c00f9d15802f90bdc13666836eca5d94ef563e55fbe3
MD5 d0be18222c85e6927dfa590ec3936862
SHA1 802ab4093e28342709ccbbfaf76618db18db36f9
SHA512 5b57877def7c4db576ecdf8073460101f95f2e8bf08d7757ee6b0957b86b17f1c0aafed57391e3e8033ac565be2277c4b5fe59c82d1a1eff26aacf12a888bf46
SSDEEP 98304:XOU/jIEeQfoR/IuOFVjUu5EOU/jIEeQfoR/IuOFVjUu5a7pX:XFIF0wuuFIF0wuY
TLSH
T14FC67C05F98240B1E57711704DEBD27E8A30BA6187328DEFF78D861F5B32B919935B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b734e5c4685a2184aaca53d5f9ad578a7af67e23e477fe2788f6978d6f8c780c
MD5 2d911767d67baab54049208538bb2344
SHA1 d95aefe445d3e529374d8667b81296104c729f51
SHA512 fd4884430d7d335cb0e49e3075cf734b86aa3d456fc94ee18e3c2f0f23c34fd68ffeaa31d9447a79871a1c302cd0be11ca69d447de8f6cbce0a9bf266a1f7fa3
TLSH
T168213EA1D0D6CCD7E43298CB9719D9D70CA437BBE89C6A461329C109E7C5C31CD454E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 67ed0b7dec45e971be1c42ed30aa95d8d72ac5c57bff2c68467efcdb2b99433c
MD5 688076de33c341369dc55b0f191d9e23
SHA1 51093820ea3a791705cf908588820be4d87c5284
SHA512 daff87cbd6de7166be641f0748d8cbc2b0f09863323f6ccfc5730cc714324548bc4d2d909e18f0c93b5c0a5ab326e906ba6b73a31e8483bb919db17ad678a1ed
TLSH
T15D113D91D0D69CC7E431689B5319E9C71CE433ABE89C7A462339C11EE785C31CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0712fc7efb0f2c596eb6e76e2e142699e848af33c55f482c1749489238b14a6b
MD5 b1aaddb367c3351cad30439f7fbdcba7
SHA1 032d66ac1c5a8daecd0944cac13b5e3f787032d4
SHA512 05d68689b9eb114d05882c3617701822b11ba4fc4e63fd2b6a5eb2959e6a55158052b8abdbc24f6719a7f770215b41c8d3cf5595cce34181665763c79a54217a
TLSH
T145213BA1D0D68CC7E432648B6319E9C71CE437ABE89C7A462329C11AEB86C31CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1532-2932-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/1532-2843-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/3036-6-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3156-59-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/3936-2043-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/3936-75-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/4772-36-0x00000000007E0000-0x0000000000801000-memory.dmp

Download