756a3e97ecd341845353d0ac022b4eeb6ecc9685d4a18782c01f98aea1c7ae21

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Size 6.5MB
Sample260930-al6gvsae89
SHA256 756a3e97ecd341845353d0ac022b4eeb6ecc9685d4a18782c01f98aea1c7ae21
MD5 5ae49dcc930d3b694fe70a35f6555d68
SHA1 afa451fdefbb38fe69d038d39cb0ad86f25e2015
SHA512 7c18aefcc2a3115f47a0731928ddbc016cdb194f8b722a3b8f0bf2337a7aa621e1fdb72789331eaae59f7d1c21317136e02135a17b108a7570dbd4c37eb05f66
SSDEEP 49152:U+ES+EE+EB+ES+ES+ETqatgluu+EB+ES+ES+EE+EB+ES+ES+ETqatgluu+EB+ESX:CrprprpryOU/jIEeQfoR/IuOFVjUu5m
TLSH
T157668D05F98244B1E97701714CDBD2BA8670BA218B228EEBF78D871F6F33B919935711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
4328	svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe
3700	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCACACABBABBCBCBABBACABABBBACACCABACBAACCBCCBAACACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe"	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACABAABBACACBCCABBBBCCCCAACBCAABCBACCCBCAACBBAABBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe"	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3496	sc.exe
4884	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
5716	cmd.exe
3868	cmd.exe
832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3784	schtasks.exe
1828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
3700	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
3700	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
4328	svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe
4328	svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
Token: SeDebugPrivilege	4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
Token: SeDebugPrivilege	3700	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
Token: SeDebugPrivilege	4328	svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 832	3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	95
PID 832 wrote to memory of 3784	832	cmd.exe	97
PID 4872 wrote to memory of 560	4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe	99
PID 3196 wrote to memory of 4636	3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	103
PID 4636 wrote to memory of 3496	4636	cmd.exe	105
PID 3196 wrote to memory of 5716	3196	2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe	106
PID 5716 wrote to memory of 4884	5716	cmd.exe	108
PID 4872 wrote to memory of 3868	4872	svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe	111
PID 3868 wrote to memory of 1828	3868	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5ae49dcc930d3b694fe70a35f6555d68_amadey_elex_glassworm_hijackloader_icedid_luca-stealer_n.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBCBACBBAACBBABCCABBCABBBCAAACBCAAABACBABACBBBABAACAAACBBCBCACBACCBCCCACAABCBCABCACCBCBCBAACABBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBBCBACBBAACBBABCCABBCABBBCAAACBCAAABACBABACBBBABAACAAACBBCBCACBACCBCCCACAABCBCABCACCBCBCBAACABBAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe" start= auto displayName= "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe" start= auto displayName= "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCAABBCBCCABCAACBACACCBACCAACABBCACACBCACBBBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABCAAABACBBCACCABBBBCCAAACCCCAAACBACCACACBCBACBCCABCABCBBABCCBBACCACBBABBBACCCACBABACCABCACCBABCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABCAAABACBBCACCABBBBCCAAACCCCAAACBACCACACBCBACBCCABCABCBBABCCBBACCACBBABBBACCCACBABACCABCACCBABCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBABBCBAAABCCBBABBABCBBABCACABBBBAACAABCACBCCACABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5409c07100eb957582f74c18c6cb8f8d6d11b221d6c5092c0646468e7c316f1a
MD5 ecece38456fba4c122ffaa015d5daddb
SHA1 425f849aa0e50dce10574640333fb6ac690d9667
SHA512 12f0fed3e981ddcd8c21ae1e4a7144ff67ac52b9b9d89ad648a98d329de644b1ef12d91dc99f32f71437f62e20854758aec632bb639922f75278372eb2330144
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 23082d7963169c214b94e498805e533dc2b3b448b2bc95de050abbdf646ba85d
MD5 dd9e98671bed11f9c4abe6750567f9f8
SHA1 c705f228393ff302849ece7d8b47e4d6a6a24342
SHA512 984952a086c923f562bc68df344b2f952d87866d44f7b96afda80fea9de7e7b77c4dc20a5c5b86d1f8d6cc68d9afa96bea096df325be922eff64d4ab0cc336e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 f9297deb8ccd6747fd13ddd1c348ec9d939de3d0c59a5fcfe74dec4ef4efdcd1
MD5 79ab87704bb3cbc5bf8b375d34680c49
SHA1 527c12c6338a7959a76929c6024dfb1e02449278
SHA512 21a64782c643cdf7100c639e5d0022124f92360db9e1f4a6ec57bebc341f18d3ef146308e685016b422b5d5a17d6039d665eed217f324355b3f8ea3ffafc11d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 53a880057f08b543b7a0afc62b57b2f071a9388b209d6d4a496d0c28c890a034
MD5 e1636b067c20c525685bf32224edd955
SHA1 aa3dbf02821669b67fc4c3030b791a0677c07781
SHA512 e78e16374e0c970b8da1fb8e35d26b555a065fca7d951e60a27593ce978bd532466cdc077c3d8b5a242a4abae609db8c8ea8abd8184da299f333b0f5ed61e74b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\qap`g`v~dtlq
Size 10B
SHA256 d7fc02f4dd09708c6338a457914f635a89a1680ff6c6b6ce1641d80d525e9498
MD5 13a8fbe22f30a7e66582081b2f8f3baa
SHA1 f2aadfd628e79d50c26f5c94a6be739a3b695c91
SHA512 15d8b88a73fde21372a411339729ba21240df7ef3ed8fdae9484ddb6619a76cfd83b570139af9368b33931e07627956fecc4bf2f8692ca17a4517267727a86fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 c934df6cbe3acdbfbf393540d2cb900082265ad4a9965aef0a0cc79473e56892
MD5 04444de48c95365640964d2baa87acf9
SHA1 5bb50c5c111c05604153cc6fa7d392b3fcc57596
SHA512 43cf6c52fd7ca13fe8eefeaae681fe61bc19a3c0b0be00d6ebe424b76f46f1629dd29e76d6974d1a0bd41f3a13669409a84bd5c0b7d21e55f104315db41d24fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\qap`g`v~dtlq
Size 10B
SHA256 ef4d146481a4046c2183566657e63c9f69e119debea92b68ecab9c983f5686d2
MD5 d7b1e4ead16eb41f11104464230a9fb0
SHA1 fad2d1e5a859642128a83fceff48312a20cd57e9
SHA512 042756c83988e0f9ee51822bfa71ad99a6ce4a0c0306ee5bc9a54678ede0aea3742e7decfb9763f895786dfa8cfc60f6cbdcb993052cb76d93488113017ca035
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 a6da0eecea2aff17a995e50b1a3ebe48c266172b8bb730af7bf8450f44741c2b
MD5 08bfdd84081bb0ebd5698cb170b2fc51
SHA1 07abd2f3272eeaeb9792537a112b4da8948e7d08
SHA512 0bf09710d8c847221605577a85ac1bf231a73619dbeb24c16a602ee1c7bdbf7f1b0dbc33daa0caf8f33c427f3e61b1a6e48a755be5cffac34b5d85b6b57ee866
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\qap`g`v~dtlq
Size 10B
SHA256 0ae66e48e20988b3401c7013f2e119bce9626343f16387f599dd24c1384d0514
MD5 1f7dccd17894393d91f094f1f8d623c7
SHA1 8fe5886bc2796596eebc8fe7f57229a516026c27
SHA512 9ca6c29b873211a3d4c6115316e963fd35519053f50960feffb25dc58c36eda935a75e745be0c529e26ac91a714bee01ef29452cfce8e6e777c29b1a96d38d35
MD5 SHA1 SHA512

Submit Download

SetRestore.exe

Path C:\Users\Admin\Desktop\SetRestore.exe
Size 19.9MB
SHA256 2bf0f2dbcfb5b981abff0b470d11d33d150e6396b66e58cf78c217379bb43835
MD5 e30c6f4f0e28751efe581b3b8ed49604
SHA1 1a3ee40cc6dec2cbca155f6b7b16fb78c78a0e22
SHA512 85303ffe9bcbb7bfa34daaa0544d1ab224955810bbef0b71e5ab2c3e2c37d4abb0f06d74c399e5d29b4a19e3b3ac87791d2927762607a5d200c4242f157ac62b
SSDEEP 196608:uNNNyFIF0wunNNNyFIF0wunNNNyFIF0wuJw:3WWW
TLSH
T148278D05F98244B1E97701714CDBD2BA8670BA218B228EEBF78D871F6F33B919935711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetRestore.exe

Path C:\Users\Admin\Desktop\SetRestore.exe
Size 960KB
SHA256 72ef5446677461ac24c263ef704f1715aabbe1fe371ec787cd60847450d87364
MD5 6b2d268643e0c7b62c0219aa200fb857
SHA1 7e229bf3ce08fca81739e2746662a9b3e9470e04
SHA512 e3baaa3d02602655e73115d28fce3d6e72bf87774625870cd85e0b16168c101c0a2c4d1089f7a944301c48a440f454116c63e61908fdddaf210f79c5b34aebca
SSDEEP 24576:m9+EM0q9+EM0c9+EM0F9+EM0q9+EM0q9+EM0iExqatglrslZOZj9+EMR:U+ES+EE+EB+ES+ES+ETqatgluu+Ei
TLSH
T1BC256C09F94244F1D92B41B14CCBD2BF8670BE218B128EABF749C71F6E33B916839655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetRestore.exe

Path C:\Users\Admin\Desktop\SetRestore.exe
Size 384KB
SHA256 f10d406020846d0427b2a073f9f72e34d0372d12e82954be4a58f511867f468d
MD5 b1e36bbff9ff25bd562051e98e1795b1
SHA1 926c431557537cf41c2597bdeb474190663f7aa7
SHA512 4cfab478ea58b1f97c349e5647f76a0b105930232b08c6b657644f8987e55a0763f3cbc4d73d168aeeb3021a0d1dc325c316bc9ef665718311cfcc709ae4cf5d
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAd1+dTTUFgEs3XojAdc+dTTUFgEs3XojAB:mgUFgEsnojA9gUFgEsnojAHgUFgEsnou
TLSH
T1BA841A09F94340B1D92B51F04DCFE3BF8A60AB25C6128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetRestore.exe

Path C:\Users\Admin\Desktop\SetRestore.exe
Size 52.6MB
SHA256 f7809b6de57a4f4be272d3d241d41f02af5b22878cee3f05733d943254ec1b11
MD5 8911bede6fd66d251dd6a8ba01652b86
SHA1 415586d68f4478de087df4b2a2b16a5ceb1a1747
SHA512 5327dfe5402126ea62661b6e3810441c0c1424133fa6f934d10f71a206cbbf0f0a6cda5f227458d72584232324440504e12f231e404a4d7420d12d031e721275
SSDEEP 196608:uNNNyFIF0wunNNNyFIF0wunNNNyFIF0wunNNNyFIF0wunNNNyFIF0wunNNNyFIF7:3WWWWWWWu
TLSH
T1FCC78D05F98244B1E97701714CDBD2BA8670BA218B228EEBF78D871F6F33B919935711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d74698e6052f045d1b5ca6fa3c036e57d1e69ae33255bc33e811203a05f9b739
MD5 50d3f4746d5fb756b1640ef82daa7a3b
SHA1 ac999e291fa69fbe317cb36b6d3eb289351c162e
SHA512 89d000082c3f9ffeb9d4a59890bf13ad97fe9f2ce448a60499e73664ddb18ed142494af344ee85dc9163ba735c9548415f9a45f644382cf41859f5ebc6aa332a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e207f78b699d142c6735df55a83482d35ac18352757c3f09ef113ad6b4ff79c7
MD5 78134c144bde6790b5543c851ccc78ba
SHA1 0fe6d088a72d81d5b883cce863b25c0bbd54209e
SHA512 21ec283d3158662994c2134446257b5cd928181fd7d5b7705d16e5105595ef56df62dbfb49649b995e92d5afd93fb8a72177ca04662b7d0f04bd40ac17a56364
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c3b571a6c14afe239acf99e049db3489a30f572a58f2c7d7d64057e16de7906
MD5 33d0f3a25672fb45f15de200e112f966
SHA1 10829667904ccb403f107560a4b818f10808a6d4
SHA512 1b2d8dc9fc70bb5e79cd8186f04496f9e76e91cc52ca6fcbb1aee0a8e705e67584cfd8e096eb6c633d1ce4a8a68ff4296d5dd9a8651ed772df96c88be2fd7087
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d519ddfe8e57c74dfa0861e67bbffeb0ee0c0fbfbbbaa3b8c8402ba4515b7c9
MD5 55867b749834fa6041b6d4f6ca5cc27b
SHA1 df74310cafe027acc36c54873ab8f8f2fe804e8b
SHA512 d084b3ce4dd0055f132a95ab8babddf5a93558b868e6c068c1460260a674eaf210dc445e1f1320b001c911548cf79c1fa3d8212100833c9bb51e72ca2d68e32b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01e672f69dd4366bf68b6a3b5b3c41bdeafae04d8cc4c83823364c89dee6ef1e
MD5 b8c05280e892cbadf9ced5c6be3f7fad
SHA1 12ebbb0647d987995f4acde9b7693a61cf968b5c
SHA512 0cfac364f1a1d1b7e8d9c42358631dde6b3129177d53e1e5cd9d7a061cb9c93ce454f35b19be4d8a4b8794c101d45f4b17561b447c61a88bb96134dbf4dabdd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8883b85230e71035cf52ad446f153d0e477f22b8bf3cd0e44dd141733046f466
MD5 944cbf5b12310b469683452824dcc5a0
SHA1 27666e945cbc761ea2dc72956d06b118f6e52453
SHA512 db5397e2f25bf86fae11c181b2e9601c4c27cf0f9ee8e54437bceb9e9b1da3124e4f92a624924b1b1802f9a29a55b700e886c775c111cdb012686368bca3007e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dbbfa81a2199eaaecb018dfe342d5be6137ea5b8a478384e302da5f8798fa85b
MD5 9fabf227448ccdb9b614cb8f7b666b19
SHA1 b631d475afc613d77dc0c6712731eb7437fc1f55
SHA512 6691f31ba44d2ee04e883fe4be81d60ff936e82209c9c96efcb885cb288585a9a7d1cfceccb0fc36ce681a09f8def7818d0876366f6b0fc5d7333769c5a46753
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99701b6e9646ebf2f4b1de7752fe3fa801dbe35a6cb6d146164f46329eb83f27
MD5 a46653d866c00e7f8f0c0272d1a478cc
SHA1 eaf3ee78a3c8baa6dce080887d7406236cebdab2
SHA512 e8e5029bedf5b9fa8ea451dd1228955f74cb8bf33689487fcb94c765e2b9882f42e9cb7150240493339600b68d4955b09687166c55b40b13153f7efa800d0662
MD5 SHA1 SHA512

Submit Download

svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACBCAACBCBCACCABCCCBACABACACABAACBACCCAAACAACACBACBC.exe
Size 6.5MB
SHA256 756a3e97ecd341845353d0ac022b4eeb6ecc9685d4a18782c01f98aea1c7ae21
MD5 5ae49dcc930d3b694fe70a35f6555d68
SHA1 afa451fdefbb38fe69d038d39cb0ad86f25e2015
SHA512 7c18aefcc2a3115f47a0731928ddbc016cdb194f8b722a3b8f0bf2337a7aa621e1fdb72789331eaae59f7d1c21317136e02135a17b108a7570dbd4c37eb05f66
SSDEEP 49152:U+ES+EE+EB+ES+ES+ETqatgluu+EB+ES+ES+EE+EB+ES+ES+ETqatgluu+EB+ESX:CrprprpryOU/jIEeQfoR/IuOFVjUu5m
TLSH
T157668D05F98244B1E97701714CDBD2BA8670BA218B228EEBF78D871F6F33B919935711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 dae8dba063ee314e9c0789348ed2e7736a65f3d97c1f77bd1e4f69d70ce2cf69
MD5 6ba8fec0400011c97cb0d0ba5fabf021
SHA1 503d69da77f8afd3b96a6b0104509bfc02524ef0
SHA512 94a2bb2062b3ebf4d214617f242b8ce2f2a82eaba073ee83a2a8caaed63d0bf53350392cdb8fdcec662a58a9c28667370468e389cca7217de462ae87b6888d43
TLSH
T140210452B0E68CA3F03138CB7A1AEB9A18A53BDFBC58EF0413594218B796C35CD150F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 dbfa7f3ec7ed9083eb5daa7c551830557d520b1a18237c9b348301c7be4f5a33
MD5 10473d04d64c0e30df341de4acebe436
SHA1 ce779d505aafb23fc6c2c1be63611bc4b4120009
SHA512 1420fbb1791b963b416c6ecf070906bc8e1ba9562d2053ce97cd568a637e4524f4ce4cedc92d12da274eef90d9fca4b48f17d107c9fea2c65051dd43827b0830
TLSH
T12621A521B0E68CB3F13128CB7A1AEB5A18B53BDFEC9CDE0453595218B796C35CD154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5d0ead40a1f2598f2bc8055cf465e151bd63b2f59bee45e9dd6efa746522b72a
MD5 ac88c40f4a106bede248f0d9e88136ac
SHA1 9426aa0b6190c90f58bb5c196fc2068ad5cd7950
SHA512 7baee5b8cb472538289831a45ce882285045331b18143041e12bfa19293048b4a393281d29ffb0d7f1c308a31a3954b67a2505bad193d609bffdd97b1545722a
TLSH
T18D110111B0E6DCA3F13138CB7A2AAB5A18A53BDFBC58EF0413594218B796C39CD150F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3196-47-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3196-93-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3196-69-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3196-10-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3196-21-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3700-2071-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/3700-4109-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4328-88-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4328-4108-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4872-92-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4872-68-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4872-46-0x00000000002E0000-0x0000000000301000-memory.dmp

Download