13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 12.2MB
Sample260814-ff2vdavejd
SHA256 13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190
MD5 31e6af90dd4c1a40affe6afe80c3dd49
SHA1 a85ada507d1601d4ea8b3e0b5de01ded7d2f3c18
SHA512 9acd0e3ef1284a80f88516654bdde38b27dc41cf1b17a045c6d310be077d202f5532b8ccb980ed861b5242655635c35e03113e6d6435738fd73d4f8d6333bb77
SSDEEP 196608:YxsixsixsixsixsixsixsixsSKWQc0gEYnvLL:tcZEIvH
TLSH
T190D69E02FBC64071E577253148BB92BA4E76BA114A31CA9FA38C592F5F33BC0963535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
4232	svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
3672	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAAACABCACCBBCBBCBAACACABBBCCBAABBACBBBCBCCACACCCCBACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe"	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAABCBAACCCACACACACABACCACBAABABBCCABBCAABCBBCACABBCACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe"	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5080	sc.exe
4336	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1204	cmd.exe
1268	cmd.exe
4820	cmd.exe
3188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1360	schtasks.exe
216	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
4232	svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
4232	svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
3672	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
3672	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
Token: SeDebugPrivilege	4232	svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
Token: SeDebugPrivilege	3672	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4268	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1204	2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 1204 wrote to memory of 1360	1204	cmd.exe	98
PID 4364 wrote to memory of 3012	4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe	100
PID 3012 wrote to memory of 1988	3012	notepad.exe	101
PID 2372 wrote to memory of 1268	2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	105
PID 1268 wrote to memory of 5080	1268	cmd.exe	107
PID 2372 wrote to memory of 4820	2372	2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 4820 wrote to memory of 4336	4820	cmd.exe	110
PID 4364 wrote to memory of 3188	4364	svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe	114
PID 3188 wrote to memory of 216	3188	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_31e6af90dd4c1a40affe6afe80c3dd49_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACACBAABCCBABBCBBACABCBABCAAACABABABABBCBBBCBBBACBCCCACACBAACBACACBACACABCCBABAAAAAABCACAACBAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCABACACBAABCCBABBCBBACABCBABCAAACABABABABBCBBBCBBBACBCCCACACBAACBACACBACACABCCBABAAAAAABCACAACBAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe" start= auto displayName= "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe" start= auto displayName= "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAACCBCBABBCABBCACABBCCCCACCCBCBBACBCCCCBBCCCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBCABBACBBCABABCBABACCCCCCBACBACAABCCBBACCCABBCBACBAABCBAAABABACCABCBBABACBBAAABCBCBBCAAABBCACACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBBCABBACBBCABABCBABACCCCCCBACBACAABCCBBACCCABBCBACBAABCBAAABABACCABCBBABACBBAAABCBCBBCAAABBCACACBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCCAAACCAACCCCCCACCACAACCCCBCCACBCAACACBAABAABBCCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 aa37b4fc12201836082905d4aea3d2172a4dec85a618795a59c5eefe04081a21
MD5 8d944c5e6153c6c2d15d9586b4302fc4
SHA1 03aaa28328f76701c5801fecabbea084e1406c02
SHA512 513aa2ea2cac00235a18e66ae822ffa14fda72b0c142e6a8e05c8faa0dcae005b344be4f4d24f577a880a649f2414eebed8fcb8a96b5c362fd264027e6b28b3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 fd89b1437b0be144022dc3910a446c77d62dc147964d020399ccc6b0d9a2e8ca
MD5 80e6f188b34eafcbd17aa657d69b65b9
SHA1 ce81ff0d24419f4d20d2de7a6cf83994f34fb45a
SHA512 d2cbf191987ffe21549f2198afaa4b55ac0f585e54d2828b046869b7f275fb880437f45b528bcce066f7bed88638c9e306f3af13674bf8d319c4b5c7ac389180
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\User Account Pictures\qap`g`v~dtlq
Size 10B
SHA256 ff11a10f05f4d10de9e73d139a426ce6af2699576d0467e387e75e864250575f
MD5 cc8dee98d01e49e92d558e477af133b4
SHA1 147b7df93ca4fea1a103dd090a37e96ef768c398
SHA512 644777faec6df536b91855b3a39d25262a6127a7c37e6941614dede95e5be2b3a6636fae694ccd8d04f3cc3620b1cab63ff6b26aef49891be01d94965d8014d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\fil\qap`g`v~dtlq
Size 10B
SHA256 38cfa8d187f1db95bb8b491c3a2d88ac81bc0df3d2528f236ac22e5869da7dd9
MD5 e3c10ed8c87ee14bf2caf2ce65ad01ed
SHA1 2697d46051a9dc519705a77bc6f0a66d384e90e0
SHA512 5a041e00ab54cbd162ed123fb45a70de9892f7d3031d6b2084a65e5495c74dab11442765195c826fbfc4b5afe9d319e179d7a619a9d6b683a84d47a1a6b7b2f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 8f2b9b21f0ab90acbbcb4c38a02c24aa844bb723a30b5034fcdeae8ca23a096d
MD5 b8af82dd062c8c2d2f604486356a826b
SHA1 cb62d57b0891c8fd03cc86a52c84ac59ad7dca65
SHA512 5228e03cdec67ddcad10361644035a01f00ad4f1a6f97df135db1a23cde0cb2cde79bdf89e3e8e6ed228a1d78b2eb277f63e919610ddf04545898c5bf0d98836
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 3c2e453d95444013e833fe78adeff66711a81c8115da67871fe31446b54b9f80
MD5 a3f9d654ec0b492167aeaee17a630bbd
SHA1 916a0882f12a363036b15b9586a8c66d5272403a
SHA512 4a4160fafc3bf1f733339a71b12a07526833504c4f092ceebf755f2bb22000c8f6c83249070e39e1ac866af296846a50e28c1aa113dcb2e8fa4c6320685ead0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f588a0a122050bf9691354f736dde760fbdb98c7c3f95878a74d34deebd82d7
MD5 35fd8d6453f9d7874d7d735d97690e9d
SHA1 7849f9f4f15078c42ba3a1a5117c0a65733ce863
SHA512 2e9f781e216581e413d9f7f527fe6af4d45280f6629f3ef6de7446828dd264fe77b3a57dff4bd432400ddfe95df1a254d73ab5691f377d066f627d020c860948
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a83256aaf5c2bbd0ae9856a38829d76a201a4880f92665210ab34e11cda4bc4b
MD5 1219a0635c1295504e15fd4402936673
SHA1 0547e42929207937b42c375cdee339167ffef08b
SHA512 dc3ec2118c94679051f56ca1f4e5218d478196dc559e23bd3cacde332cde9be2d2fd01caaeccd9f86f49d28e463ea99b71d497916e3ada310c6040dbcf5596da
MD5 SHA1 SHA512

Submit Download

NewStep.exe

Path C:\Users\Admin\Downloads\NewStep.exe
Size 3.3MB
SHA256 61936fdaa3cbc1634e4651e492e4a09765b850b399704144f049a0c20e177dff
MD5 6812e05785f6187ddd4eb25465899761
SHA1 e885773827f2debb898125b00334f56c59d16dcd
SHA512 e9cfb8a42176c775c18c7665af69c0bf2bf6e2d7fa8bf091ef562ffb01552f2c3a801a765f7aadf6cfcf7c81958f9c32dae387b9e8b82b516bbf60cac274a9a1
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglnW1PszNsQy+ES+E2+ES+ES+E9qatglnW1PszNsQy+En:o0W1PszC0W1PszC9
TLSH
T1FDF58E02FA874071E57721714CAB92BA4E75BA114E31CAAFE38C9A2F5F33BC0553535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 86803d105a33db78e0fee86b8984fdd6e784aa52df472575453755ac98d77cd8
MD5 fa33f336d8711ee500ca0b71a30da215
SHA1 55d3de0c7aa6f3d97922fa39f3413514d90ea209
SHA512 f194f3090e17f15b9420015cb90af4daaa17f9422ac531a5e7698fd7176e70667155593938e2e39bb3446544761484d2ded5f3a4129bd201ee21cff5c4fccba8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c8c9116fc348386d04ba06b9eae6aeae19831c5bd32206952b9db2f69100255
MD5 835b33233acef910460ef027b3634011
SHA1 8a7ccf2a3943bff1f6c9f4fab0de231e7f813dcd
SHA512 fceaa32818c348f0cbd7a88512888de5e77a7c52e08a3e10ef37dec158154495ede63c5a52355d74cc637906848892c4a83a76864c8d7810fc04ee7f35e5e708
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 922368e545e1ed8509f8a49d3680fca61a3c6e47c9fc29abd4344cc0441c038b
MD5 f49ba4ce9d567e505a7f5389feb3d753
SHA1 beef5cb112519070728c882a4f340ae7d2db0362
SHA512 f4627cbb98eafd579c5728f5c115cb8af93e14d1ab1162b06767f4f74d2384a4b607801b44368e045937f64a6072f516123bd0a6f3866b487a78275a83bbd4ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3bec483811559c3bed49939026ddb97c71f5f5c83ef2c48dddf21f8e8420221
MD5 b9ae30b15829ce5421c7a32cbd82793d
SHA1 f834f074b45e8775bf773b2aa6cd3d1dbaa6f5c4
SHA512 55bd8e294c7a9146537545008b53548371cf6a223a73716a7d40372c2cd82fba7aa75323712cf25cc4379608d5f317fe8ed41b881250f5ce86acee7320f446c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 62b897c75508340a2b5f213c1cfcf90b0022d8919b437eaa0133c3a6b1f399db
MD5 a122726727f7a9eec512ba084ddc4e79
SHA1 70da93c1d43d022d8d88d3ba89b58148f204070f
SHA512 8c1939ce3c92bdcbea949805dfc3921e5405361c1ce4b68192e0e2833f0c44ab59cd5857633f53890b177c03f7b60aa716c797a90ac27853bf5749507b8910f3
MD5 SHA1 SHA512

Submit Download

svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCCCCCABBCCBBBBABABCBAAABABCABCCCAAABCBAACCACCBBCBA.exe
Size 12.2MB
SHA256 13717ef41a623d69ad7f77c1643bdf3d1244c0c2013629a19aa1ba08f1d15190
MD5 31e6af90dd4c1a40affe6afe80c3dd49
SHA1 a85ada507d1601d4ea8b3e0b5de01ded7d2f3c18
SHA512 9acd0e3ef1284a80f88516654bdde38b27dc41cf1b17a045c6d310be077d202f5532b8ccb980ed861b5242655635c35e03113e6d6435738fd73d4f8d6333bb77
SSDEEP 196608:YxsixsixsixsixsixsixsixsSKWQc0gEYnvLL:tcZEIvH
TLSH
T190D69E02FBC64071E577253148BB92BA4E76BA114A31CA9FA38C592F5F33BC0963535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 cc6cc7d29f292933a139bfcc6b32656a44584a29cb604de8a7fd51c78157fadb
MD5 7afd9559e1773a65e29d0ce0c9101153
SHA1 c0b879ea6f34e031b30fa61a0dd15dd19fb2499c
SHA512 1b524822b7cebed1dc20fab4a4304240cc1b7366ddbf7d43498e7195e5cecc2125998dd77d1864a41624e01a9ab3db2bdee069d4295294c915a42e37bdb535b9
TLSH
T12701DB40ECF99833FD33BA9F521D5B4648F4B79FBC585A14138D42286F94D328D458D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 b2a3380fff5481f8decaaeaf04efcf58b92b8d9b729506594bdc54d3b8edf6af
MD5 ee4cfb0628bc7f2915a3abd475e8706a
SHA1 119daf3061c99d5f350f8c3e662f86964f0653be
SHA512 c94c425bbb1528a143df1afae73fd3630802e27e1815aa042d2e67fb2b77d3b6b2951a008a22bbbe2800a77d92e6c25455f785c7a6592076cd34f4c2a1f9a66c
TLSH
T10611D640E8F99833FD33B99F521D5B4648B4B79FBC585A10138842286E94D328E458D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 937dffe61a9c92b9cfa960d6437cfbe0676acbee65246ea6d4d4c21450f4288f
MD5 c2a050e00d35efc3dffd93329234c3db
SHA1 11a1be0eb5d16cbfd33180174295a9fb2dd2d10f
SHA512 a1d5772a4dd013e0dc713539658436e8a9af7f3dbfb4557707a7a5148896839c64bcb18b9bb292ef1bd0f0b1d84920b916e02c1f7f2632757930fad952dce9a5
TLSH
T13821D614E8F5CC33E933A9CF521DEB8648B4779FEC585A00138D82286FD9D328D498E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2372-2498-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2372-10-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2372-49-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2372-73-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2372-23-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3012-79-0x00007FFD50110000-0x00007FFD50305000-memory.dmp

Download

memory/3012-77-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/3672-2500-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3672-3007-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4232-2433-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/4232-101-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/4364-100-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4364-74-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4364-50-0x0000000000960000-0x0000000000981000-memory.dmp

Download