0f31645a7577d62f970d377c7029a96ae7eedf5641a0a4b143d10dc20975d47b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 25.3MB
Sample260814-ernapafb46
SHA256 0f31645a7577d62f970d377c7029a96ae7eedf5641a0a4b143d10dc20975d47b
MD5 6ede80ba5f6af4ee0c37ca5889c46f98
SHA1 5cf7bc616bc9dd960d317a71a0437596d416d655
SHA512 50055cff40cbc53abb1d224d6aec29046ca8582f7beceb0d61df006bd123a86c8e8770bde3d3c6fedb743e62e7b12f6387e705c488f24d2f5a1f192782b5a492
SSDEEP 98304:yVVV4VVV4VVV4VVV4VVV4VVV4VVV4VVVBKjKWQckVgtev5mnlNL8:0KWQc0gEYnvL8
TLSH
T168474B45FA8A80B2E47702704CABC2BB5A30BD154F12D6EFF349935E5D33BD0AA31665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
4724	svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe
3688	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCAABCBBACCCCCBABCBABBBACBBCCCCCACCCBACABBBCCCACABCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe"	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBBCACAACBBCCCBBACAACBCBACBCCACABCBCCABBABCBBBBBCCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe"	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1156	sc.exe
3604	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5376	cmd.exe
6596	cmd.exe
5656	cmd.exe
1936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6540	schtasks.exe
4392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
3688	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
3688	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
4724	svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe
4724	svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
Token: SeDebugPrivilege	3688	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
Token: SeDebugPrivilege	4724	svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 5376	1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	94
PID 5376 wrote to memory of 6540	5376	cmd.exe	96
PID 2892 wrote to memory of 5004	2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe	97
PID 1288 wrote to memory of 6596	1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 6596 wrote to memory of 1156	6596	cmd.exe	102
PID 1288 wrote to memory of 5656	1288	2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	103
PID 5656 wrote to memory of 3604	5656	cmd.exe	105
PID 2892 wrote to memory of 1936	2892	svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe	108
PID 1936 wrote to memory of 4392	1936	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6ede80ba5f6af4ee0c37ca5889c46f98_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABCCCCBCABCABBAAACAABABAAABCCBABCBBCABCBCABBBACACAABCBCCACACBAACCACABABACBABBCBBBCCAAACAACBBBCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBABCCCCBCABCABBAAACAABABAAABCCBABCBBCABCBCABBBACACAABCBCCACACBAACCACABABACBABBCBBBCCAAACAACBBBCACABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe" start= auto displayName= "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6596
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe" start= auto displayName= "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABACBCAABCCBAABABBBBBAAACBCAAABCAAABBBBCBCBAABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3604

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCABBAACACBCBBCAACACBACBABCAAABCACBBABACACBCCABCBACBACBCACCCACABBBACCBBCBBBCAACCBCCCBACBCCABBAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACCCABBAACACBCBBCAACACBACBABCAAABCACBBABACACBCCABCBACBACBCACCCACABBBACCBBCBBBCAACCBCCCBACBCCABBAABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABCCCCBCBBBCABAACCACCCAAACACBCBBBCBBCBACBABBBABACBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 079a2a1be6f79ae041aeffac54727862a6f42a2507df7e4a387d56104a82f063
MD5 5b4064a7ba5b6a9d2d9e1bfcc0905b4c
SHA1 4b2dfc254f9baecbf7ff94a216b3dac83218b27b
SHA512 088a2dfca4d404314f105e183a0aafaa1af8926b4d89cab85552087e21bdd3c5b36687f88e86edace1fb4f6d4ad286056dfa353b3f53a9c8b91fb7ad52697eaf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 6305bf7e66f5705642389edb4ee3df31174351e3c60bea8753e5a93e9da92f2b
MD5 734ce93fe7be9cdc51128a3172413512
SHA1 335536e62285a1e78ccfcb0ef5a2d8deec5ba466
SHA512 c6cd3f43f74453ff904adcb3331d3cae3234e278e3b42dade9890f1ee59b07b40afc0c6b8981324081629c573acb7fdc0ae659ca302f693eb860dff1df85dab4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f282e078b6620e268f25b5074f4eebff1b37ba13034401fb33e76c953488b346
MD5 a03c0d1ee7d65361ddbb38a08235b2ef
SHA1 a67f2553c9dd2235c0629f8ea267c1d48ea66f5b
SHA512 7671fecea7b973490b0d1a5d74438cd4f961f33ee322f91e3f1933146e4af943c4c3180d8c530e9a839922f5860aa3d654d16144aec9a49b7db9cbabc2857041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 4863d86a43c97ea38c1f8bf94f1f9d3f8c40d2f788a7d8544081bb5f38815b9e
MD5 f458f8e2e4ba5f767c577d85ef326631
SHA1 a828c0b27f626dc060a343b4b725c81171c4257f
SHA512 bcf975bbfd9b82ea06d7ec98fd772417946d9d9b81af7f2813b35dc420cd42d77a0961960952dc4b66374f4a32b0078e57cdf86029c777fe54f184b373c934d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\qap`g`v~dtlq
Size 10B
SHA256 c49c2223217b7b3843328fcac971b76e75fca7228d6628df62230a7392bf8cef
MD5 01723f719cb44542e9588007888dcb9a
SHA1 978bb1ea83853ab85dce83509bb5fd871470d114
SHA512 9fd4d789dc9236c5ca34a304fb4f6616c15c2addda296cb0af529040cb12926cba517f294fbbfb9f6069994eb4f8621700050080f82d4bbca43b8a7b06b60102
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 36baddf52f32769f0335ce8d2a9a72241ca178c536585a5519b48afa27f58323
MD5 cbf63d7cfb693044f65956fc1cb2e92f
SHA1 d81cd8ecfaff485dceccd72cfb2c80d128bcb428
SHA512 81e1b329a70f292a42334e3ba9be2d761d2cb4f13ecadd12c9a664cc3e5712224dcdac49de2c4ac90c6d77cb974b3830f7929bea096b85e83c7aebbf43068908
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 49fd1d0b5c03c28e7dd76fbd51de268509ded70eaf924fae7cc26aceed488d34
MD5 17c0e779c0aa7a031c2203f2504a55c2
SHA1 93f2fa4b239c86c6c8cb501d8017ee692a364513
SHA512 dfbd6140adfad78a342a3e4ed16d65b413f9178ef95ed6d58219dcd39648d5615018b4e95bedbf6d5235ebdfd5b28507640b654aef1ee4370b84cda9a0617b59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 476a76798529971202b2e62018cb25c7bfc6a2123664cc34709f8a7738448815
MD5 e958b771fc0757a530e62e7c522f2437
SHA1 276f0e8957d3d9ad9730a160e895a994d356c454
SHA512 1920be0d41c4356360d8fbac14ec2cb2599e931039ceefab311251f269c4bb6c7e9564e712a2b5917cbf37b590be19a36cad3493f8349d10212559e065b05447
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 e7acbd89468cca0cf4d396ebd3ea47959975c697c9cc666e5a6c105653156d31
MD5 b21782757019174b9c31b4a2962b74ed
SHA1 26a9d175848e837a5ca004e5d13c6185035426e6
SHA512 47715e6fa9dae4d62177246cdad5e1280024d3ed16af12853d45ff3b08ebb845e24cb9948b601d15f977720413eacaa85c1d0b5ae331049012b518a73cb834e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 308f875cb8d800cdb5b8d375bd0070c4ac77ae3d76765582c9aad18cf0a1aef3
MD5 e135c43feea18d1002b06de210d7c17f
SHA1 3527e60c97d98db03cacef4a0a8d89e4d12df28e
SHA512 165784afa74e615ebb6d30dd44781bf0cdaf23c87684a6ecd1b4dd288649315d64e71cea60f480eb746a0b4bf2f30901a7aab16f5bfdd8cda40358631d528c84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 9759786dfc25d0924fb2dafd6c9219ebde850c66c0eed688d9d0505a1a9768ce
MD5 5a9b47d764ee137152542154225db0d5
SHA1 bca8e6257ce4f91026acfbab2a9d30b401686df3
SHA512 6941b9a456b0d716437520af3f3c276fc53a3292d3c9074fcf2d8cce7bba13976ade18e871d1b242b0bddc895fe48d5076da891b10fdb15b37caba38b3edf256
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\qap`g`v~dtlq
Size 10B
SHA256 800762c477cd8c47ed7bd6f85604e1ec4721fac13b8a2c9c0b0f4b4b3008504a
MD5 c7bc2016234a0c66fbac79eae0341677
SHA1 c49e06c1eda415122c3b45ffd2e949c974286115
SHA512 812d4f12ad141161681b9996e52f0945a91376f1b2d5336141759761dcf1e4199ceaaab8e59773f1151a8972fa69199b546d6f34cb7b447a7595bd385bff3279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\amd64\qap`g`v~dtlq
Size 10B
SHA256 2c327ac58f749b435b89dae9982500cb5d94f0465c9a81888984f535da676223
MD5 f5f9f3717ca8249c682f028baeee3c66
SHA1 844f954200941ce0b5986f60b1e8034f8cb67b0f
SHA512 42f8971c7b27bc682b5215ae6840217327415b18253bfc5d60ffb703cf63e3673e77fc651f85354c6b55646d4aba13e4605445cdc88d309e3afd2a15d836222d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\qap`g`v~dtlq
Size 10B
SHA256 4d56dd81accb5996891c3a64680bb2bfa6ad991190ab1ccccc2a212c3389062e
MD5 ed4cc85df31a6fcec45bf8467cfce5df
SHA1 4162af7faf945d90d62815c420c4c0d80780276c
SHA512 ef441c9f9f45f86da65173895b93dff15b16ef9174eeb8ab3acfcc298ca18d22f0794b754dad59ba23bf13e690b3d92a144efdbb1fa61e412322f3b5ee186459
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\xh-ZA\qap`g`v~dtlq
Size 10B
SHA256 ec292d6009c6e4613f4029f31fd8351cf3592713c7a3f5964ca525f46588552b
MD5 159fd06a3a9cd1d8c975b4ee43c5363d
SHA1 804c642841627b145c83df53e5018c3adffa084f
SHA512 2928e6532ba3408658951e7d4f40836fd19a9d267a47e86ed81713d07f4f453a692347ac4f2cf6ad735fa3fd3b5d7c1cf0e94926211a884ceb3f1628949a9124
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 ca15a6b99f613b6d94fd3a9f8e6256ad7c15c75a7c8f2724e33bd4a5f5526ff8
MD5 c928a6cec180338363f6da05e98bdb57
SHA1 197f73a44492c3a59b535f4c917e18313779b0cc
SHA512 73f90650747e20f2be5bb58242bf5c32ab42cbbba9e9fc358ab4f80bfa3495f1e2a452071698d8c2613e929ce8c349362b3d1453243d59164c537d535ba47f6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d620e09b1a614faa00572505cd8f0d65c0e7c91dd07e9a06fbfe52bb29a398dc
MD5 3a78918eee3bdc48dd456a6d86e3bb3f
SHA1 494e979fd61f1d2606f554f125f219d515c1cf04
SHA512 c7036e89f26224426f3381c79614b72a0d43e70dbbc62079125c80f4e526fbdd9fa5b61ed90c4acd063ec49c1c45165d62cc32a69f6738895f3182e68737a4c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7365a66e8ed3112ba6a2d48f0bc35c68bee1e96102bdd9517d5f26c89867a4d2
MD5 bf0bbdc11e52756651c9a8563c4d3c48
SHA1 46a4b9f75aea211bde0d4f4a042bc9b6114a10b4
SHA512 8989b35355d38813b65f3d3baf2577b351fd043bc3ae1c7b4e296f8d8159cb197786eb8e8e7e98b1d6c177e6d4add6a3bb3341c6f65d8a7cdbbf5e9ad34bd3c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c30d4fe05a44ad0c53edc179ba8b9e6b08b5287cd5a1d4db1dd6dd1b0ff2e0de
MD5 c5e3bf803b4d8eaf8b5a46602d4f0f72
SHA1 fc6c990f16cdb64b10fa8f6b10539cd66b9f4546
SHA512 a61b201a1bc48e736c3c6339a551b754813ec256b5979ecddea31f780aad82684af191ec8a3e131e25eebc37fb99412d41622b712420965ce46e25e52073c500
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68daa8508a1bc4d2f73999e50626daee4c0e4f6506c27690342e1d7e0c2839df
MD5 5c25c809207cc6bfaf88cb4dccb88015
SHA1 2df24d7210367cce2c804956d686c36a2b6b169d
SHA512 49935ab41b0ed9489fad4f66a7badc961d03001ebd207ac2799c532218ea934ab7feba07e7bef87f806975165b0bbc7557a7422e647c4dfcbb3834fc8957d037
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f93b46110eab78b1df4477c55708551dc687ac9ade8d46abd136d01e6157b78e
MD5 3beeed99cd769e6071c08c7c6c617824
SHA1 6dcc712435f0d5239d316cc50ec121bdae31e496
SHA512 93eb99266ff499cbda879af796347084a68b38565b5fc8b085d29b2550dc6f03bc3ad6d13e2a8aa381fe49145a954b376ed5910f11b7712dda26c205e666e11f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 408ca73730a99537aff4bd2c19659a4bd0afa8b976c6924e4ec57f005205d1d7
MD5 4da51c79b08363566e77c71196733c4c
SHA1 9a3739a712b8d2f010b831948bc5725013d6b94c
SHA512 9700fde7e8162c086a7f4214b9a15a70c3f4061ca1353dd72937b92358aedfdcc339ad5e61e9574827248d2190c44a0577a9d4ed6d92465d797ec6adad899cc6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 1089ee8030e1564a2aa8e96ee746ee1c7b786319956c1713872abb1577f0f2f3
MD5 46eadaee16ac0a6822ad50d526b3bd80
SHA1 5e326321bc69ca2a98dd9bddd4449ba34c9d4567
SHA512 226becfc295878e57a93e7b1f8624887ebcc4f366f9afcb745abcde2dd82cb90c68a55adf466e0b984f2a1b687ec034062219da706cf6bb05f5ee1609f9003f8
MD5 SHA1 SHA512

Submit Download

svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBBABACBBCAAACCCCBAABCCCACBCBCCACCCCCBAABCBCBABAAABAA.exe
Size 25.3MB
SHA256 0f31645a7577d62f970d377c7029a96ae7eedf5641a0a4b143d10dc20975d47b
MD5 6ede80ba5f6af4ee0c37ca5889c46f98
SHA1 5cf7bc616bc9dd960d317a71a0437596d416d655
SHA512 50055cff40cbc53abb1d224d6aec29046ca8582f7beceb0d61df006bd123a86c8e8770bde3d3c6fedb743e62e7b12f6387e705c488f24d2f5a1f192782b5a492
SSDEEP 98304:yVVV4VVV4VVV4VVV4VVV4VVV4VVV4VVVBKjKWQckVgtev5mnlNL8:0KWQc0gEYnvL8
TLSH
T168474B45FA8A80B2E47702704CABC2BB5A30BD154F12D6EFF349935E5D33BD0AA31665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6e3e2ccb33c3ad3e1afbba36576434e9ff16fc48dc677e028ade5bed56c51bbd
MD5 e31fca5d9b079ff85edd993425db9b9a
SHA1 6597df1ed8c2f9ec44e64e1c1b977e567b44c4cf
SHA512 e7a279cdaa30d3addd3eb2fb1afdb39abaa79c551f0f02140a80b71c6366472da21cce054aa34fb244f2f71748d53df348f6755acf5669eb7db947f5277d99d5
TLSH
T1F5212954F8F4C873EC32ACCF4329DBC209B8779B587C6A54234941287A98E308F594EA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f0acc86d26e538a38c2ed39a3c722175a5d75f660f6700a85e7b7e5da9018af8
MD5 5d9c72dd5be723790ea6ea24c537bc05
SHA1 a599bb339d7416d48045811c8fdddd7a0cbf9917
SHA512 5d184e338edf52f1b23a23eede0003606683a4b0b5bbf76c800489f6ccd185d52a82702a029358541425d7895be8c17a8c4fd707d4b6cd366ee4a193fa14e70e
TLSH
T109214965F8E0CC73E832ACCF523DDBD209B877DB986C6940534D81287A98E318E184E9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 436cd13c277e67d1704dea88074c7b34eb77d947e9a16e977436ae992a20363b
MD5 a11009836f7f58d6371b9d1b218f65bf
SHA1 8c17d3e48d423b89810e4ed2bb52420245002eba
SHA512 82d1111afe580689a2d8a760c46f14f5affdd1eafa4dc4755bf3a9691f94fd8072e2c33389533515a6b68cace3d7edad7ee80a4ae15da46ef656327e3b8c8a23
TLSH
T11B112B54F8F5C873EC32ACCF4239CBD20DB8779B586C6A14234941287A98E309E594EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-21-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1288-10-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1288-69-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1288-47-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/1288-93-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/2892-91-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2892-46-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2892-68-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3688-3886-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3688-1596-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4724-3579-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/4724-82-0x0000000000980000-0x00000000009A1000-memory.dmp

Download