9db404969a5ebfe3a3505f8906a0f88471f67ed96b29380d10ed0219ebb24906

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 9.8MB
Sample260810-ftrlkawvhw
SHA256 9db404969a5ebfe3a3505f8906a0f88471f67ed96b29380d10ed0219ebb24906
MD5 2e146e8a19324ba144cc875e5678254a
SHA1 885123dc9f7f292a909cce082f4f032232c257d7
SHA512 dff3277055289702f0d3cb5a0b5ee5e8771aed78eb5a047cd27b8217e4da6a39a8db73dec1b53bd128b03adcb376bbf9b872c2a94734afba105420cc253f6389
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+ED:RTTTTTTTTJKjKWQckVgtev5mnlNLj
TLSH
T10CA65C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74DC76FA933B906525655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
4976	svchost_CABABBCABCCACBBCACCBACCCAAABCBBBCABBAAACCCAAAAABACABABB.exe
3044	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCACCCCBCCAABCAAAABABBCCABCABAABABCCABCAAAACCCBABAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe"	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABAACACABAACCAACAACAABBACAABACAAACABCBBCCBACCCBCCACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABBCABCCACBBCACCBACCCAAABCBBBCABBAAACCCAAAAABACABABB.exe"	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
900	sc.exe
4896	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3008	cmd.exe
2068	cmd.exe
2584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABBCABCCACBBCACCBACCCAAABCBBBCABBAAACCCAAAAABACABABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
3044	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
3044	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
Token: SeDebugPrivilege	3044	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
440	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 3008	4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	102
PID 3008 wrote to memory of 2912	3008	cmd.exe	104
PID 1656 wrote to memory of 2292	1656	svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe	106
PID 2292 wrote to memory of 5044	2292	notepad.exe	107
PID 4492 wrote to memory of 2068	4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	111
PID 2068 wrote to memory of 4896	2068	cmd.exe	113
PID 4492 wrote to memory of 2584	4492	2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	114
PID 2584 wrote to memory of 900	2584	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2e146e8a19324ba144cc875e5678254a_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCCBCCABCBCACCCBCCBCCACBCACAABCCCBCAACABBBCAACCBBCAACCBBBBACACABBBCCAABAABABCCBCBAACBCAABCABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCACCCBCCABCBCACCCBCCBCCACBCACAABCCCBCAACABBBCAACCBBCAACCBBBBACACABBBCCAABAABABCCBCBAACBCAABCABCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe" start= auto displayName= "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe" start= auto displayName= "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBAAABBBBAAACCCBACAABBBCABABCBCCBCACABBCACCBBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5044

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBCABCCACBBCACCBACCCAAABCBBBCABBAAACCCAAAAABACABABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABBCABCCACBBCACCBACCCAAABCBBBCABBAAACCCAAAAABACABABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2f51e44fc0ff955e357bceeb242e851b40bb610eee24891ac972c479a8752189
MD5 3d62d6996b980337bd7f99d85357280e
SHA1 40c9f6de05b33c23375bc14e37ed3b49a8e716f5
SHA512 88ab4a794bd1c790b31e91c29a447f77e67bd9eab339acc85d91225c5dfcef0b8a83ae8994f73a5d77545d23c95ac2684bd106e2015f55b3be2b1ffa3c86afd6
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.2MB
SHA256 4f2d95d14ada8a9dd19e7240de8f5542b9d5eb9db4d53be780489e38b19e3628
MD5 e425c011ecd1f80c2636b0da93c30b6e
SHA1 d909c700b4e985cb303de2e89306499fc796acd4
SHA512 03ee3b386499cbd79b4c40e1548af81dabeecf3ba852c05fae8af17292f83b26e5ffc5558e3d6944840dfa17b58b45518b97d2a38a23a7e0b43af45364ec0f1a
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+E5:RTTTTTTTTJKjKWQckVgtev5mnlNLYpiD
TLSH
T11FB66D05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74D876FA933BD06525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\de-DE\qap`g`v~dtlq
Size 10B
SHA256 7dd6a7c40f1fd0cfd79b924df5975f3ef49df2d494424c8d1c9905ce6cf44f22
MD5 d9d9f253a7ea7b11c17777df0bf5f397
SHA1 c6f8f7cd1fe64830ee5932a560df8dcf3d4c0423
SHA512 ec10418466c25890918e3273d4fa22335967c51e928704bfaea0393e1ab5072a044e08d3f9f13b57728a8c429dacf367da23cbf14051526b8ee0c01a486b80a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16\qap`g`v~dtlq
Size 10B
SHA256 1859d899a215883628e976fff2e1e51e7868fe8c868dde6bfb4995395ef3fa09
MD5 42680fa451d995f8d303a3935aa945f4
SHA1 da63142108564efa3fda1f1039ba435296ce5673
SHA512 1454290f9741e963446a3de6898871f60f531de6cd2df18839d18404a93e7ab25e2a02f07e592bb713af368f3ec8e55839565f2dc4b8e4c645a8d1af5ea80f40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\zh_TW\qap`g`v~dtlq
Size 10B
SHA256 f63813159408bb468546443fe40df9dac9d54c869752d15fa7cf77fd09466d1d
MD5 8df14e3468687094f87bd08ee0f99041
SHA1 0c408550e22c8eb45d0b93144c561596ea36c84f
SHA512 4b2d4b9ece4bc126803bd9ab5e9cd144fb33b500c2b3823d01e798ae60a75a4704ffed24479abc7d53322738bd1ae84291c9d23413aaf105baee952d3e1801dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 7bc2de5bc773d1cd70b20df1bb9a4cad78eb1a697e9fe13ce0fdec77621a9060
MD5 cee0c36e68ca36a6d463da0e7fc0018e
SHA1 001719f33c0b9fc19835f25f628a54bfea95ef6d
SHA512 69e42bd14d5470a4d745e2b26d1f2d29e84c4a8352cfd31b24e0f5dd4f623f42db406f0b64715a137dae063cde94386b81c3b0c15346dcffd28e443f536228b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c4c523ceff640733faa8c695f706b6bfafbde27521c96908a685ad303364f012
MD5 ba1e407755ef93319edbd0c6a4f9ea26
SHA1 ae79075f017d03a6e022d6c527706cbac0de3c17
SHA512 cf57b9a37b3ca48e7e7c037e29a5004bf26d45628011714592fa3a866fafecaf84f34e8097b262299231e5db7636f7e0d88752430adc972926f2b871ff0399af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 810309a16202692b1b4279311ece7167e5f51d91d60bd5807d1691048288a992
MD5 d3f4e9b88be970059173334517d484cd
SHA1 f96f944dc4180af69fe5c148f2d1c83a9083280e
SHA512 8adb8f917e1b81df45e68fae7dbbc517e1617ed73485025590c1c3f81c0da85b49c2d65a24b0cf4d64cb69717d4a31f71582dbfb8f4fa1205fe2be340544c6fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 20cb06d979af7f7819ec2c5aeeadc2cd1bf838105af28236f49584c1f1b55a21
MD5 0022ffbcb39691a9616decbde2a4a84e
SHA1 a090715c110392bcb936cabbf3c7de31c5cad8dd
SHA512 3923cbc2e15a80fbad278e64d4750b8e9787b034ee77f6378d2021ca3ea7838b4a8fbe568f3c511ec1a83ddb016ba6ca2daacbf9ad08fce381b61818d3453642
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4270a91d7f0f6a1db05212746ad118572c24fdd7bd939ae3d28e600a043bdbd7
MD5 5f91bca8ecec2e65e5db40f5ff1b0268
SHA1 8bf0f649fe8cee3c59b187c2825d18ed7a1dd7a4
SHA512 7e552c292127f5424e0923e7d822c776add53a77c9645fd3c2688253ed5e02f6773f61a62be04af2baeb44f1f728a1a13f3dcf96bb28a3491544fef8e2dccd6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43984e0267500df273d9facbd47a87d1601b13faf86d88ab0fda1556bef3ba26
MD5 cceeb5d2df9ec84a4c5b65f7dc20483c
SHA1 21375ce0b92336c0c7448f8c8bd98d06c1309e51
SHA512 325cb1bf916b9e4bd8df584c0c68bc2c660fa8ad4dc3fa563bdb1212b6a89c263cb3f55524d3a3a2a5ac8b303bf5dd9de85b7d2631c851af7b0c3f13ff9e216e
MD5 SHA1 SHA512

Submit Download

svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCAACCBAACBCCCBCBACACBBCBACAACACCCCBAACBBABABCCCCACCB.exe
Size 9.8MB
SHA256 9db404969a5ebfe3a3505f8906a0f88471f67ed96b29380d10ed0219ebb24906
MD5 2e146e8a19324ba144cc875e5678254a
SHA1 885123dc9f7f292a909cce082f4f032232c257d7
SHA512 dff3277055289702f0d3cb5a0b5ee5e8771aed78eb5a047cd27b8217e4da6a39a8db73dec1b53bd128b03adcb376bbf9b872c2a94734afba105420cc253f6389
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+ES+Ek+ES+ES+E2+ES+ES+E9qatglv+ED:RTTTTTTTTJKjKWQckVgtev5mnlNLj
TLSH
T10CA65C05F94380B2D82B01B14CCBD3BF4A70BA258B129EEBF74DC76FA933B906525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a639c94347682d06a0c6efcc563ab1114ddad252c87daf81228e991bda50b0f5
MD5 9a5cb09e5e63082e90276c3e793eb1f0
SHA1 f857d6f0fdaed163cb8e5ed1f60a4faa6caf8818
SHA512 666a5e258526b7d5b3b3ccf9706d5fa2460350f32636db9442a4d952232aa9022b308c46b2092c5c51b438cdf1c72c4a01b1441340ec0629c1d6bf3d359ddaa4
TLSH
T16511C855D4EAD823F9732CCF92299BD20CD436DFBC686A14130943187F99C35DE568E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 7bb010d0f1074589fea01d9de97d11a050a3791e04b561a710f2f2ff4cc67dea
MD5 5f77b5ab77f07412c1775ee0aaf8f0e1
SHA1 c516c4ef22ad03434e2b07173fbe678f24bf7628
SHA512 1cb7a4041a8d9c6783905d8eba59a223dbac3fe0c5ecd713dc69ba61e968b95c1b91c952bdfb2ff745ebf434a8c8122f17cb15ce83e1f6a2e08dee6d02cefafc
MD5 SHA1 SHA512

Submit Download

memory/1656-36-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/1656-26-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/2292-58-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/3044-113-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/4492-0-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4492-7-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4976-77-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download