0a84b385f0f05f0db244b41c4a49389b8c32fc2bffb065171f3a05e109e5525f

Analysis

max time kernel
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 88.2MB
Sample260804-lhkxjacj7v
SHA256 0a84b385f0f05f0db244b41c4a49389b8c32fc2bffb065171f3a05e109e5525f
MD5 d3534dd220738eb0c1ed9c0378903772
SHA1 a5f31e8053e2f2b7e22fc2e33ab622cf6216379a
SHA512 2e4d9e4db16c0f3c1cee0bad1053cdcdb37d4f07ea03401966a53e8b1b0a9a63ed288645e58d0ee7ecdbda4d6894b75b4d08ee838873dba3d43d804c82913dd7
SSDEEP 786432:i33333333r5u33333333r5u33333333r54EIvW:i33333333c33333333c33333333aW
TLSH
T18718C046FD8580A0DC7A123048E7E2764831BD36812189BFFDE97609EB3BDB1543E676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
2084	svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe
5216	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBABCAACCBACCCAACAAABCCABBACBCCACABCAAAABBBCCCBBBBACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe"	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCABACABBACBCAABBBBBACABAAACBAAABCCBCAAABAABBACCCACBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe"	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1632	sc.exe
1824	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1124	cmd.exe
4088	cmd.exe
2892	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1188	schtasks.exe
2572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
5216	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
5216	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
2084	svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe
2084	svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
Token: SeDebugPrivilege	5216	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
Token: SeDebugPrivilege	2084	svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 1124	4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 1124 wrote to memory of 1188	1124	cmd.exe	93
PID 4140 wrote to memory of 4520	4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe	94
PID 4184 wrote to memory of 4088	4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 4088 wrote to memory of 1632	4088	cmd.exe	99
PID 4184 wrote to memory of 2892	4184	2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 2892 wrote to memory of 1824	2892	cmd.exe	102
PID 4140 wrote to memory of 2676	4140	svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe	105
PID 2676 wrote to memory of 2572	2676	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_d3534dd220738eb0c1ed9c0378903772_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBACBBBAACCCCCCBACBBBABCCBBCBCCCBCCBACCAAABBCCBBAACBAAACACCACBBBACABABACCBBBABCCCCCCAABAACBCBACBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBACBBBAACCCCCCBACBBBABCCBBCBCCCBCCBACCAAABBCCBBAACBAAACACCACBBBACABABACCBBBABCCCCCCAABAACBCBACBBCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe" start= auto displayName= "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe" start= auto displayName= "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAAACAABCCABCCCACBACACBACBCAAACBABABCCCCCCCAABBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBAAACABABCBABCAAABACBABABACBACBBABABBABBBACCCBCABCBCBCACABACCACBACACABACBABCCBBBBACACAABBBCBCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACBBAAACABABCBABCAAABACBABABACBACBBABABBABBBACCCBCABCBCBCACABACCACBACACABACBABCCBBBBACACAABBBCBCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBCBCAAACBACBBAAACBAABCCAABBBBCCCBAAACBCCCCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAACBABABBCBABBABBBBBAACABCACCBABBBCACBBCCACACAACABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7ac011f662ecf0995a716a5d081ea39d5ce37ae2a0351752c1af6e0ba996d17c
MD5 963a142242ae33d0cbb696a49eb3d6ff
SHA1 27e9c74960755f65a2b8f2f19cc3d10ae1ef1520
SHA512 980c531091579f5360c2a141f67b10d341d5ab38d2c6a122816b99a7afa989295a347a2c4cd3124f56e006edb18f189c2ab485311049446a74c49601ef072745
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 419fcd042309bbe9862fe74c7fe15ec3a6c5efc60dddebd618ded3359b074231
MD5 ddcfe33c0c9ba73bce2baf9ac3ee96cc
SHA1 cb9d6fb56ec2c2cacb0445683296b1b2c3cf8192
SHA512 1cc9b42442b6c272a82095f8603222ae08b18a5322c79e0b87b0cb1c6fe66626c8d2da635145679954554e635661a3bb7d57e1e9accf3c0db65adae7afc2965e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 b87174ef8371a0bff49210f26eca725002694b499480f97b2fee7e5f570644ec
MD5 31ec02fb57a9748937e0679bea16f17e
SHA1 fa506d15bba480078e98f646371d8a027ebaa97e
SHA512 6a7670d0d080b2b7828a250bac92457e96cee66b3887b6c519cfe0562b55c7dbf89282fd8123a7554e984d7d3085958ac7c5f705c7007cae8bb375d04a8d486c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\PowerGrid\qap`g`v~dtlq
Size 10B
SHA256 b6c708d614720897e4f5d68d37e891972203c8dad73ac86fe1bc12133d7b5031
MD5 f87ea48ae107bb410c4364473492696a
SHA1 9937dffaa4d60f1a5d25b532d0fd1604f33fdcb3
SHA512 e20e920aaaef99c9843a110b15413cb3b5882999886a8c90f5d09da30b889d3b3497fb028006a7aa25c2cdf1a24cebda35de0aeed523700179d25ee26133f61d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 f295eecf0e6ba52698a2b17e62eebd38c89921a58765474ab96c69e1dd188c80
MD5 93c5f20798158daa14eff8cc72fd4e80
SHA1 388bf93ba728e9bb2760ac092795d67817af0866
SHA512 ff681bae26f36c53933d645f859c4ef28afbe3fb3f5f80e9f3bb3acf5533a752dcaaff0ab2703b2c688ea6ce3b166ec5d376c922d074933db7394c18a4658426
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\qap`g`v~dtlq
Size 10B
SHA256 a267cd786914e9cb6cbf9cdd2211f6a549081214916bc1b7ce6354acea0fc21c
MD5 eb59d9b7c3930f7536543820fa85ac55
SHA1 27580607ad14368cfd7f5fa4342ea4038a5dbc2b
SHA512 9fb05ddc9ddad87ef0f4a2774df20d481afc932cbb88c1950263f199151b9ea2ea1de1211c299dbff1fafa280ac93e891fc7da04cd3a97fc9388315982a63fad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 94a27bbe79fd53f18d1dff7eefe5fb0249b527277aa075e801ddf05d55c5d6e0
MD5 4dfca12a6697ca198435c4a86f021c9f
SHA1 df5e05f008087508b95c37dcb867982183dbc9df
SHA512 4831544ddb18103e2573d192fbb426c2ff4674631bc0e0a90e98076e86bc8b1948041d0649cf1c4e39ea488dc3aef265428780fab60c22b2f7f5f6a57a243fb0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 d59888b0ef6617a5a014f3af8905413d294151080e4f3c55c395ac8d175e0904
MD5 9bde6df3d59f6c3a76a804ad2baf34ae
SHA1 696ebb953582fe62b4524fae990902a48d7df22f
SHA512 0220c1d8d464590f9196639e3efabe487fdcb0981c867bdc08fcf568f7a8c99cc57f0a15a1cd35d43d77b4fa10fd6e4b789bc3afc604084bdf9dfc3b119f008d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 69ede7575dcd79ddcc1582a4284e46e79e93702d86ac5eead4b011527831d37a
MD5 8edbf2554bde5d98d68555b143e66711
SHA1 bf042a2dc9d917cfd4943a615eecd9f29d55f3a3
SHA512 6bd040257394e10eccc130b32f86ace94a4ab6c1672a4e9851973c3bcb42979e48eb051c98e0ee7fe67ff4185e01b03d411ede84167968b7570221b345de95ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 f0be85bef1b3d8cc37748bd935787618e7bf5106d989d397167e62f44af2277d
MD5 c5c7d23d00942c4793d22f0c2197afb4
SHA1 322725f7f6e5c645d57849f2e09e9aee1c27e536
SHA512 698e6cc266c63c07aabb608b44117569439b73ce79e435d435b2f0251b5396d08b5ab851e888522fc28c9909df94f9bb9fa6777b795ffdb1c68bb013cd149b2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mi-NZ\qap`g`v~dtlq
Size 10B
SHA256 1b8ca650062fc0c952d3564854aff5875e6497e1ef7a3d9ec5160286f57ff7aa
MD5 03309004783fde0b896aa5b105f6aa4c
SHA1 f0a5aa8df45092b4c2149960211643f3bb201167
SHA512 3d99e74009734a8c0f40b011b52739fb717a56df3ba50ae45b4d51b49f833daf6bf1a16e9594bfd3e794cecb1299309300644727b8bdb9019a8b884c30f38f02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 dabde444bce3ab31c43c41960cc8505a797092b47b9754e938295906f953177a
MD5 150ae7ba568db8653a2e5dc41b581ba9
SHA1 3352b2b3d0fa2c13a57ca774913aaf445866498c
SHA512 ce98d2f641837f881a47a1aaa98a79b23af6e6e8436b5dd99294356151c5253f347b119707078c09dac09a89c1d9b637dfe5ca30b904b98a02e73b0bfbe768a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\qap`g`v~dtlq
Size 10B
SHA256 15a5270276b4ff15c182ab38cfa77856dd673eb15021346ae6649d59db50342b
MD5 5d235a87d1dccbe3f361eb436c47cf2b
SHA1 a64e853f2c0f44c9dfd0557965dd81473f7dcbaa
SHA512 173e6aca6e7f45b86cf97c139368df137a10f08024374be7fd9a5b2857f67751de224b3b65fd24d898e53584af18cf0a3f1250f6f96b0581c3a12d576eee37ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c705d30fc08392ec8c14b09039f2a38a69a4a700a14780c07f5bd2ac470c11a6
MD5 5b14a6c5b3cd1f5eb3ba51fff789b9a1
SHA1 23fd8c78ee0a845e3bb9b69f6ba7fa2bcee7a1ff
SHA512 15b0327df4f21b86706e5e2ef6f087463f9340091fb8d72b46f483a2a57a176d6a3fc985eec7e304092680ee5b331edb23a4c942bc694d31272077d4cfafe0de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0456822d0729a5f935e56ea39a143ae0a6eb736ef0a25b4d5397048743ad1d91
MD5 ae21fd4a33df7c517e23c9946c808a4c
SHA1 856dafa663bf39a103bec2338a35470e2e2d4d4a
SHA512 aaa817d495c2ab94ac32c71c70c927bbb5cfbaa1492360d629d0c31dfd2ca000c18d2100fd25eb13b9cf9e5c21e5ad01a125941387bd0fe3521c564734959684
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc79e9dd9728c80e44a23e2c8d6e2cd5da5ac5c74490c736aa47cae5cb42d55d
MD5 bf1bbcddca89d270cbb6c26a7eb65c69
SHA1 260fedff28f171cda574a87fb9eea12d563d4239
SHA512 e7f2de22c16462b5d715f33dbc5bc67e26a3d0fcdcf90c1847a2310aa65442a478976f6129fc1196ca836addceb2676ebdff3de14a4fff9cdea78fed46dc95e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 342e575c4f0ed3b650df51805d52fcb0ce52b0756a22e203b08f5d06225900cd
MD5 1672bb43a5bb4ee808d329cd92febe51
SHA1 4a68cd0d3b5364effd17cc0e4c9efe62c1e1dd6b
SHA512 a54f729a3c26d843455707f6b905534d67fd6d395135ea768235eda53547e4431294b53ab941442711a6d4fb26da7fcade6e8d50362bcb6d66a07fc0db5612a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 952d1aaacf98ac8c438328e3f265e7e878de89ab6c58739cc1d9aafdafe3c03d
MD5 a6cb7803f5067601108f9561f14c429b
SHA1 67ae261cdab5fcd4dca13a33d12d66ae18138b5f
SHA512 56acf7934ad0272fefb626afbd5d0be929baeb60899977f655bc80a96eca7b595a509b264f52ca23b2b289a1c27a95635dc7e14d1076de30b35cbe82cce42d4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 891b1b2a15bae4cc155f42a962a8f2caf9f4cbc4a37ba63fb8d304747462238a
MD5 5b9533808a254d87bb9a9634fe711ddb
SHA1 a4f3238132357f4b1c8b849d3b674274b1954218
SHA512 30013734e334f0d6850b992e59fdba37f66f6c64ad68faad2a30de1833df78171f524ec861c4d172ac22336572158e9aaa5ccbfc0c27a7a81e8a60d5ff7656b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ec8b42f4a2daeae16067190499e711d4d4d8d485f13438b8514e0529f428742b
MD5 22ef65159de82ec57369d6dd23ffd283
SHA1 c991ea668c02e1e57cbb1f2e65bad9f614762207
SHA512 d56d0f5ca730d214a2220449e845c1f4a5b2c2dc3da38d02e14d8b90982208ae9de6890e64f7d0706f9bdeb5fa9393bb7199ef90b40245fd707472e228c27d44
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c40fc6f8bb28f7ae23be9eb4793db136d3facb61c390c8c24d52e1abf219dc51
MD5 85649affb2bec01dbbd343ae389a4576
SHA1 7e308e49dc4ca90e07f8697c3877b62d6d446262
SHA512 af2284de905861d1e54c1907e430c552825f0c60c83061eec73feeee889879dad9261bbdc3091601036c632b2d4c7cefa1a150608b4b9002d2f4a82c3946e93f
TLSH
T12A212C5060E8C8A3F63268879725DBA20CED778EACDC9A04130D961D7A8AC31CD19CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3cae31fa72cc5efecefa9e3d00ef01b84d42f542cdd87d4bcbd56c3db72ab84f
MD5 69e2f964f929c6fe553eceadf71414b6
SHA1 9a86b3a13d2997355cb869c3953b7c21a7b467e3
SHA512 e7ff8d586941dcfc3545570857f400e957b577f49783e9a3dede448038f7b2ce91330af19172ca0f2b504e1e93164d1c2e0be1e81d8974dc0437783a3aaba7d2
TLSH
T156210C11A098C8A3F63258C79725DBA20CAD735F9CDC9904531ED61C7BCAC31CD098E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c84d33f59c3d993165cf9175e348c27db1cd1cada2ddd9f30cfbe9d010c6e370
MD5 15644679e868d8832833755daa0b0b45
SHA1 44fd1406d01ad20a8a269e356ea54ccec2cad19e
SHA512 6a0d0acbc171d2512527cab260eb1bfb86cf414322977c5b47057ca46149f188d488432790251bb256d75abd57f4ab2848d80ed3101891e663ef9905660653cc
TLSH
T119112B1060E9C8A3F63268875725DBA20CED738FACDCAA04131D961C7B8AC31CD198E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 8ecce76d5ed99aebd20ca8e0afe4b8205791cdec46983a51b1ace41ceb7b8fd5
MD5 6dde317843876f34299a1712b61d5dae
SHA1 beab282f505bed6df8a23731af468007ce2572fb
SHA512 394130a033c39e9d770bf6187ee71eebe12d5daab27560f4163e5e016925ba5dd1d24863a66e56e31c7d5355aa9bde466ebb281081ee8ff7927ff937e8701e91
MD5 SHA1 SHA512

Submit Download

memory/2084-2102-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/2084-67-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4140-33-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/4184-6-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/5216-866-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download

memory/5216-2377-0x00000000003B0000-0x00000000003D1000-memory.dmp

Download