52707fa8bc31273ea5b8aa806a28c70988db1c50db4007a90a6fb207a4dc46ff

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 10.5MB
Sample260814-e3wffavvc1
SHA256 52707fa8bc31273ea5b8aa806a28c70988db1c50db4007a90a6fb207a4dc46ff
MD5 515dd6f5423b3f0a3c3fce5a57a4d702
SHA1 7e0b789422e7b3b10e36700aeb094b347d58eed6
SHA512 7018a7f1c4c0dc8a70862adef923cc9a6c0b49e5c9dcfc7e8c08a8487332eba69693e6e339ca6a2f2233ba3b4637e275030c65e6a03beea1bd352967ea5b31fe
SSDEEP 98304:+rLrLrLrLrLrLrLrLreKjKWQckVgtev5mnlNLB:4KWQc0gEYnvLB
TLSH
T1D1B66D46FA8684B2E477023148AB83B75B70BD154F12D6DFB348936E5E337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
3428	svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
4952	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABACCBABACABBCBCAAACCCBBBBACBBACBABCACCBCCBBABCCBBCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe"	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCACACAAACCBCBBACAAACAAAABABACACACABBAABCABCBACBABCCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe"	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3608	sc.exe
1164	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	cmd.exe
3044	cmd.exe
1624	cmd.exe
3284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
984	schtasks.exe
3516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
3428	svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
3428	svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
4952	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
4952	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
Token: SeDebugPrivilege	3428	svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
Token: SeDebugPrivilege	4952	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
640	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1624	632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 1624 wrote to memory of 3516	1624	cmd.exe	98
PID 1972 wrote to memory of 3436	1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe	99
PID 3436 wrote to memory of 3732	3436	notepad.exe	100
PID 632 wrote to memory of 3284	632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	104
PID 3284 wrote to memory of 3608	3284	cmd.exe	106
PID 632 wrote to memory of 2192	632	2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	107
PID 2192 wrote to memory of 1164	2192	cmd.exe	109
PID 1972 wrote to memory of 3044	1972	svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe	112
PID 3044 wrote to memory of 984	3044	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_515dd6f5423b3f0a3c3fce5a57a4d702_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACBBACCACCABBCABBCBACBABAAAAAABBBABAAAACBACCBBBCCBABABCBCCBBCBBCBCBBACBCCAABAABAAABABAAABACABBCACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBACBBACCACCABBCABBCBACBABAAAAAABBBABAAAACBACCBBBCCBABABCBCCBBCBBCBCBBACBCCAABAABAAABABAAABACABBCACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe" start= auto displayName= "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe" start= auto displayName= "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACBBBBCAABCAABCBCBAABBBAAACBAACACBABABBCBAAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAAABBBBBACBAACBBCBCCCACBCBBACAABAACCCBBABAAABBCAACCBCABCBCBBBBCACABCCAABBCBABACACAABAABBBABAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBAAAABBBBBACBAACBBCBCCCACBCBBACAABAACCCBBABAAABBCAACCBCABCBCBBBBCACABCCAABBCBABACACAABAABBBABAAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABBCACBBBBACAAAAAACBCAABCACACCCACABCBABBBBCCBACAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 331ba50656b28aa9746901e4863e965fdd7af26842d1b106b6d2d1f486019642
MD5 19b87a43cab5c07d453a65540ba1679b
SHA1 92bdf86e6bb8fab301c45802e47e8e7039b537f4
SHA512 775b8eee60e6dff97f7d9e415b14b8c747217ae5f4791a5c7dbc31bdc55268ccea0b937da8d58727e8b214c40f6bc55d72b9d1a36a5b146776e2806f248a5a70
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.0MB
SHA256 780fa59d14880831e8e07d8f04e39aa2891f8e87194c32908845a325b9ffea3a
MD5 950f4248f2eae870d1eb75e418ea7cb1
SHA1 e756d9d450e5d97612ea2543aebb9da0f3a8504f
SHA512 8e4d54dfaa73485fd4ce775cb122fd29feb210f2897071547317ae508ed225d05cb9e48e38dc89d0bc00934aad59b2a3958e93e1686626a4147dfc707e643d92
SSDEEP 98304:+rLrLrLrLrLrLrLrLreKjKWQckVgtev5mnlNL+piM:4KWQc0gEYnvLs
TLSH
T1EAC65C46FA8684B2E477023148AB82B75B70BD154F12D6DFB348936E5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WDF\qap`g`v~dtlq
Size 10B
SHA256 16e98669c1278ee4912154a6581fdcbcddfb4768d6ddf5bac881c80489b6f18c
MD5 22681ff7393d03af067aa5d9d785d050
SHA1 3658fbe18582f50bb25beb7aec9c8a180000ef73
SHA512 d0ffc5f8951e1f454647fd7fd6b3f8a698f405ca3b752c9534bf211fa71e768d2b738e1e0d0fbb81c1dfd8e185d904549c60c3eca98662364f962fff84270d68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\qap`g`v~dtlq
Size 10B
SHA256 4903b3141be3298195f1cf0398d31f5bd59d1cef787e69c7d136db2061565ba7
MD5 fc6e235089b58326d1a6ab685c33dd12
SHA1 89c0782af338460e6bf3c1d04a6fdfbc4c469be4
SHA512 46a6907548abf71245e80e90347fd39bab6ee089f7fd18cbee8901618b62548250bb3bf52c7246aa5ced3a22026abdf4e3d74c799da033057ca774aff7cef46e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\qap`g`v~dtlq
Size 10B
SHA256 5633d0bcffc216462350f27a159186ac0f70cb5635b5682993dde87daca18131
MD5 7a30b20a68df0dbbf16f7c02d4ef5ba5
SHA1 d8f0011f1b5fee30c5a8474597cf62ef144341b2
SHA512 44821b1130e2b66f034c153fd01fa979301fbd10aaeed025997898781499626c5cced029eecb03348d38635230435254df062103799bffc2e422f5f67bdfb7a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2d5mkwou.default-release\settings\qap`g`v~dtlq
Size 10B
SHA256 8dd96e36984954d636159c7f17d810b9b8e7bd39d550dcfc12c4cc0f4a87be5e
MD5 00814e42d3704bec41f569a1267a6150
SHA1 01bbcc54db322abdbaba833a00838aa40137306b
SHA512 e01d9a18d76ceec10afce6c68af567a8153681937dd17c40f8473e08d2bc2e472ce60cbdc6a2349cd0c3ad804c67472a7a1799e412a8ec23554cfe646a6a0c49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 35e4274f1b25ac53eb05cecfd3f43b6e81b1c14faa90c8ad6a89469e82b877d3
MD5 188b01bf3c6ad5201b8cbed289ff3b48
SHA1 0a893c3d4818bc46e1e54ddde571b87115a00fbb
SHA512 fa2a000df530421c3e5db6467cb9eaf52969029981765e53d3b15ccb6f1e245907c747a28f2a37a155d91457ce251ce517599aff733118be95b3037b21d93a07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72f7a6295f2c69d475661ee037d85997330606f5525edf13a56e07ea81b28a13
MD5 eb27a3b0243cac533c7289c1dfbd62d2
SHA1 76bdbb04fad0773408c52d965756df33909427d9
SHA512 3fc56200fe89d05efc11e54155beea0e64dd1dfaa17c469d064c8ca228126aa1d8c30faf1818cd741d0103deb1180266aa907c13289be2747b9a6a5595e65e2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e815679ac4aa464b6f83abf012f51bf3154dfc461d10aabe2c87743fe2319ac
MD5 4c89019fc601b70b815a9df048b130c2
SHA1 b760e23506698ae6d982f6428493809f8795b8b1
SHA512 4285f61a797173833994af32b76fc063cdbd7ec0f914e9ec34536a1d99e41cd49ac48e6c709531feac26df4c609ffbb07711a65f691810dd3ff8a24c5f397213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 795f1d25f2bbb0cd11f688acc3e8eace47a98b413085e7ab0a7f4f9ed7a70434
MD5 49634498fdbec0fb6a5efece0d7d2666
SHA1 337b298d4aa10f75134bea18a8909da8fb1a9bae
SHA512 b2ddd6b01fdd69ea4ac7613c0e3b93dbaef1aea0ce6975c48920e75e6ba4b34890a7c98185e126e6deaed6ca46c8bc5a24284c9c39c9c2fc44445fd88b0f550b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f24e261dbdf3d518661823eba33ac16726adea2a8d16228d3d27d450f25ed7c6
MD5 362122cf87f109f005377ed84a7c8b7b
SHA1 2230694df5640a55a96e11786e87d609c5da74c6
SHA512 9dbf61cde5713b116ad644d92b8c69f8796684c2fed069cffeb8c7bec2ab6084fb0948cb44a2af9225e38f60379a1407b12957ba2c3526726a5a24bbb56c2a57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6bd972f6bccc69c1ec410344f499a0353f6376cbdeb2603adb08c5e260aca4a8
MD5 ee669182dee1b595f42adaab8d32059b
SHA1 f0d70e1425d5c6ad9377b05eb0b8e12411ceb728
SHA512 6ccc0fc69376721cdae8c42d33d362617fd9b6baccca74d9f2e834924145505af936e9792c6a0227ddf78df39e3cd70c165234ddc7ed01b94a692fe02d323e23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d7c1cbfcc0ab0ee343f541fb75d28937b646a2f7cd1a2e62235e8f3baa8d5369
MD5 2e7c31ae120d8a5bea9a935380a5da04
SHA1 74e9ca6f13fb1641f7f7cbfd812b867207dc6617
SHA512 88726984805e3d9e943286453eb98b97577bd5e8816f163db46886b98f7c26500cad4b71ca1f573fcf7a7fc8d0587d875236dee5ce840df7232064a34bf90ae5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 674d66af06e2a3cb025f7393214b006c4e59e9ff93260548e7aedaa8cec20301
MD5 bb45efa9cf7a6019564b7ff81ff21114
SHA1 584a7f8d784e7df248679ea6fde719b20d499721
SHA512 a425a35b64517109a4787fa917ff1b66eb755c9bc70363ae26e41d7a3c2bd162be8711baadeea0ed6c916be714838e6210a4838939bb93dba07e2a6d585dbd5f
MD5 SHA1 SHA512

Submit Download

svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABACBABBABCACBCAABACCCBCABCBBABAAACBBBBBACACBCCCACCC.exe
Size 10.5MB
SHA256 52707fa8bc31273ea5b8aa806a28c70988db1c50db4007a90a6fb207a4dc46ff
MD5 515dd6f5423b3f0a3c3fce5a57a4d702
SHA1 7e0b789422e7b3b10e36700aeb094b347d58eed6
SHA512 7018a7f1c4c0dc8a70862adef923cc9a6c0b49e5c9dcfc7e8c08a8487332eba69693e6e339ca6a2f2233ba3b4637e275030c65e6a03beea1bd352967ea5b31fe
SSDEEP 98304:+rLrLrLrLrLrLrLrLreKjKWQckVgtev5mnlNLB:4KWQc0gEYnvLB
TLSH
T1D1B66D46FA8684B2E477023148AB83B75B70BD154F12D6DFB348936E5E337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 26ad23824cbd74c5757a149106ce7242e87737f9ec079e00449b62db63e2365a
MD5 04969bc625d2d19b6c0879590cf8d9c3
SHA1 f32a0476a42fbe2c1136b57d4a2fee74f36fcf98
SHA512 13b996d741f2392d4eb6004eed45e5a4a680e4f275af724aba14e886202e44d7eb9d47071bd4c1a1af6062fa932e7bafeeaf25daf29c42dfda50d08a6680ee4e
TLSH
T1A0210C31E8E5C477EA33A8CBD519EB920CB8B79BDC589A4413058628BFC9D358D590D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 4260a2a584467067235d86cd57fabbf99ded236e6660b2affcddc80ebe20da52
MD5 1bbbe3962539a87de0023ec292fdbf93
SHA1 68781b863d1783b5c65919ee8aa9aaa8fad3580e
SHA512 fcb84af4aaf20fb276fda2446f7aded1c14c463d45fd12e16e031001098e17c128c722d717ab349beb310b2406a612ca74c808a7359cdba81df252a198707ab7
TLSH
T1BD110821A8E5D477FA3368CB910AFB420CF8B78F9C589A4413048228AEC5D358E550D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 a1736d7b8141e216df61cc83bc19bee534bc12057ed01b5ec14f86a70f06ad10
MD5 dbb473bf4cad25e32ed5de7d09abbd24
SHA1 aa1d15d9882848eeb0b9a016d5d15b9567f23111
SHA512 9f4ab667794f0bccb73ba77e54dc0cefe546211636b4bc182978283bcfe934e22b6e050fe53badd3e306af66870f954f7254eeaa1c0a726ee278e527364ece5d
TLSH
T16111E661ACE5D477EA33A8CB921EEB420CF8B78FEC589A4413048628AEC5D358E550D6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-6-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/1972-36-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/3428-85-0x0000000000820000-0x0000000000841000-memory.dmp

Download

memory/3436-59-0x0000000002440000-0x0000000002441000-memory.dmp

Download

memory/4952-2811-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/4952-3009-0x0000000000660000-0x0000000000681000-memory.dmp

Download