0778bec5c03a7e58421eb307e4bf9992354a2e253ff789506d3e6fd193b9ce8e

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 11.5MB
Sample260910-e8ckhsfe34
SHA256 0778bec5c03a7e58421eb307e4bf9992354a2e253ff789506d3e6fd193b9ce8e
MD5 7faac3d5fd1e5ccd5e00d30d26842ad7
SHA1 1d857a519051721f3d1809ed27ab95774dcf5b0b
SHA512 9e15aa6553f36189c7da66aa2fba74f2aa19f5c23b8b03dda384bd1f013f8a84c01de6bb56b5ab05a10a648be2fe9102bb77d2309c115e080d8f7efa0eb601f5
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+EY:oOU/jIEeQfoR/IuOFVjUu58
TLSH
T108C66C05F98750B1E87751704DDBD27E8A30BE2187218EEFF68DC62B6E32B905834B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
2608	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
4132	svchost_CBBBAABACACCBABCCACBCCABBBBCBACCACBCCCCACAACCAAACCACAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCAABCCACACBCACCCCCACABCBCACACACABCCBABCBBCCAAACCCCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe"	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAABAABCCBAAACCBBBACBAABCCBACABBCBCCCBBCCCCABACBCBCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBAABACACCBABCCACBCCABBBBCBACCACBCCCCACAACCAAACCACAAC.exe"	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1492	sc.exe
1984	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1888	cmd.exe
4744	cmd.exe
2324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBAABACACCBABCCACBCCABBBBCBACCACBCCCCACAACCAAACCACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
2608	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
2608	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
Token: SeDebugPrivilege	2608	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 1888	3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	102
PID 1888 wrote to memory of 3368	1888	cmd.exe	104
PID 1000 wrote to memory of 1416	1000	svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe	106
PID 1416 wrote to memory of 2680	1416	notepad.exe	107
PID 3708 wrote to memory of 4744	3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	109
PID 4744 wrote to memory of 1492	4744	cmd.exe	111
PID 3708 wrote to memory of 2324	3708	2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	112
PID 2324 wrote to memory of 1984	2324	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_7faac3d5fd1e5ccd5e00d30d26842ad7_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABAAABAAABBAABACCABBBCCCCBBCBABBCAABCACCCAABBAAABAACCBAABCBBCBCCAAACCCCCAACCBCACACBCBABCBBBABCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBABAAABAAABBAABACCABBBCCCCBBCBABBCAABCACCCAABBAAABAACCBAABCBBCBCCAAACCCCCAACCBCACACBCBABCBBBABCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe" start= auto displayName= "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe" start= auto displayName= "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBCBCACCBAAAABABCBCCCBCCCACBCBABCAAABBBAACBABACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2680

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABACACCBABCCACBCCABBBBCBACCACBCCCCACAACCAAACCACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBAABACACCBABCCACBCCABBBBCBACCACBCCCCACAACCAAACCACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2a9be2d9ede615717a8fa6c8a9ff3100cef03dd0dde72b81399487931ce8245a
MD5 3dd1b727aeea0d15d9262e9b2bb4462d
SHA1 6741c5d0f02ae90bcec9416a1cec7911fd23a802
SHA512 ab90db282dac06d481833c3249eda29bcfafb481b80ba6a772f4917c7555b4e0734c195b7ba7057fb2ca924d832a26523ace0d8af8087d7cea5cf6998c656228
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 12.0MB
SHA256 dd0b3612aec8623784d09c6414267b7ccc24a73755d4c6a5207b16a956c48d7f
MD5 782548df6a4745538399b18a0ef43902
SHA1 c7eeb209bf1af1cea8c4d00085453d5e0dee657f
SHA512 2149ee1dee7a8578cae63091ea05bc5e5cc13adcf3101f90cc77be16622dc230d5e44402e6e499a80203de46fd6205fe649f7a10690dd8f907219ace28e6bcae
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+E2:oOU/jIEeQfoR/IuOFVjUu5fpi1
TLSH
T1F6C65C05F98650B1E97711704DDBD27E8A31BE2187218EEFF78C862F5E32B909934B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CallingShellApp_1000.19041.1023.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 d201f56436b5f8366bca3375c03495623fa027e52f400e44610ea5fec1d6e897
MD5 55ba467706c9bbb1a410b64d3123227b
SHA1 6dc01c5f1fc81a1aceba654a4332ca55a7f782f5
SHA512 eb7ca8d64f8a380529e0e13d0f4682fbe3ba5919f69e0e34e9d89ffbbc90fa3c2498f555832e08ed23bd37f0cd4eb72094ac1bcf6db53d3b400b187c0416cb82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\qap`g`v~dtlq
Size 10B
SHA256 f0c53bf143c15e2579534a919b3d531928d753ef48d9c6552dcd644e5db45c45
MD5 49b414cadf3a4cb896e963f7b99c1d13
SHA1 aea8a0f788676b43182b18d52bd2276a108186f2
SHA512 404a382256cbf28e059de43d3e8a3506bdd1a5d0ba8cab5826d79cd3d4b516bbc71b5179dc8df5c79f4177bf183a16e089b210b1275678b4fd3b74c30655e82f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\qap`g`v~dtlq
Size 10B
SHA256 394b586fe96499582cdf0ff4ecd751e5f1bd063cc78a5dac31c3a904d3bf76e6
MD5 1c17a75233621320036d3675c4413961
SHA1 2a66451167226d50b2d66264da3e2b810e737b16
SHA512 074184ef9171e0fdfad5eafcca50bfceed691fac01d756285ea70add0731453c987d2c0c0c0771b24e8e30540ee295babbc3de121e1401cb186442a85f33f1f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 47efd5f65436e11f55d6797859aabe205e296ccb7764567553478c3a6484256c
MD5 f143ba497623ca96df0a1dc3acc1c2bd
SHA1 4c7f95e38032f4c940e5aa6ea1b49bfbe36a0532
SHA512 9aab69579214477483f1b151d002a0f6f73d4e6bee61fefbd16c1f46d29385b0798476e8d3e6d732a2d1c8bb6a4248726905804c6ca9fd0262629dae2501cfb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f648377028a8e08db4e8532e6e124a7f5acb6afc5ec1068e5e9076c3bf40c07
MD5 b91af5e5787f364bb74d222d6a20de04
SHA1 e39ff7d1aa61392379603fde537570b84629eb02
SHA512 62bd0e8a55af7c49ad7a780b863e1af9438799a2278cbd441b7c817ab34933f4b6403d7662c93f8f1eff7147895ba0649e47c4143a4fa06db9599bb17264a8f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab7a9a01570be0913c4cfd1e9ae863baf59759b1b15a59f5116a244076751562
MD5 533b42bfb3ce3737b02f7460e9ccd075
SHA1 0143e086b05354d409eae9d44348b67b70beabac
SHA512 7a9dd7e6cd0b04c0d1c9f268523a138ac7d023c01b2074bd64093dcf732db351f1f09d4cf862505e33367d98d71c809caab1ae45ea0478de97d85326c3824bab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36ad5a336a1b043a67c4e1f13012ddfccc9dce6dcfe7214c5abddd9758eabcf8
MD5 bd0ba5991ab7c1796a30e1baabda7b21
SHA1 4452aaaea7d72b11c057ee3f4949965566b1f4fd
SHA512 ff8402db227d62ed7cce2aa5b2f5cf3b17bf311cef1da469d7c0bfc42c8dc930f527b258f9eb1689dfef7ed14ba537ee76a919a22531947828345c2c680dc792
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 46316ea888b1967a79be79f4607d355a5de50f025ea158b6f6a1b9637b22a8d4
MD5 20bb14246fc81a6f94dce90428cb7cb3
SHA1 6fe4976b3762ce937d4c70de29efa3cb866aeb03
SHA512 5509fc8ac6b3d0502978f3df663400467d9d1ba99d698d42d2383e40b5ed41227fb989376aae9eb91bec553103e3e7198d4b00c682b68ef256e9794b64339e8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cebba320b4a6889eee59ea043543b74d0e1694f6f911856b73590c2ea1d95848
MD5 d204dad7abbe964a9fe19e3b608eb227
SHA1 6f8ade854c2c1ca0493915f3192246fbd69cc62d
SHA512 6751a1ac725b68e24e2da30e532d033bb6ff8f77c9e60f78f25a6abe757615e565acb00e8ef87f27d60411a7186d9c3ae297c6b5f24a04700a230885c3b1a7c6
MD5 SHA1 SHA512

Submit Download

svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCCBCACAACCABCAAAABACCBABBBCBCAAAABABACBACCCAACBCCC.exe
Size 11.5MB
SHA256 0778bec5c03a7e58421eb307e4bf9992354a2e253ff789506d3e6fd193b9ce8e
MD5 7faac3d5fd1e5ccd5e00d30d26842ad7
SHA1 1d857a519051721f3d1809ed27ab95774dcf5b0b
SHA512 9e15aa6553f36189c7da66aa2fba74f2aa19f5c23b8b03dda384bd1f013f8a84c01de6bb56b5ab05a10a648be2fe9102bb77d2309c115e080d8f7efa0eb601f5
SSDEEP 49152:U+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+ES+E7+ES+ES+ES+EQUUP+ES+ES+EY:oOU/jIEeQfoR/IuOFVjUu58
TLSH
T108C66C05F98750B1E87751704DDBD27E8A30BE2187218EEFF68DC62B6E32B905834B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 60191722f88ab15355d641139c9f993c7e79d80ec02e0126e17ed0712848c7f2
MD5 1a749dc50d51c6d5ae60eea2fa76c8b2
SHA1 f50c01551e813cd6743fc73d1ad7bf823064c8a5
SHA512 490bc095dc115ccd9ece0f695bb8ebe971ce561765084572399903a4107f45cb5fba95379ac3fe2d0846b0e4462cb549f3c9aeadf3f5c56b54752a19ed9f6659
TLSH
T17511E360B4B5D833F23238DE511A9BAB1CE4379FBC58EB0423094218AB15D34CE558D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-35-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/1000-25-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/1416-59-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/2608-74-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2608-601-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/3708-6-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4132-79-0x0000000000930000-0x0000000000951000-memory.dmp

Download