deba8c411362c0fe763700bb0c4386b7108732263ff9d5039edbda9d8e4756be

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 5.6MB
Sample260815-ceyjsadc68
SHA256 deba8c411362c0fe763700bb0c4386b7108732263ff9d5039edbda9d8e4756be
MD5 06158801fe631022cf503d6d5404c00b
SHA1 39fdfe63ba6acb70a7c047d151f8ed979fa4a542
SHA512 c2026aa58ec871906a4c41a227f4e79ef6c4ed85c77b148954c1521c4db1d4fb1c736f0f792af5ef6a4cf226575c98fec2d0c5e35eb044ed000392772dabef2a
SSDEEP 49152:U+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+Ee:a88888888VKjKWQckVgtev5mnlNLV
TLSH
T1FD467D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
5488	svchost_CBBCBCBACAABCCBBACBBBBBAABCCCAACACAACAABACACBABCCAABCAC.exe
2900	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAACAABABAACCACABAABAABACCACACABAAACBBBBABACBCCCACCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe"	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACBACBCBACABACCBCCBBCAABAABBCCCBBAAACCCBACBCABABCCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBCBACAABCCBBACBBBBBAABCCCAACACAACAABACACBABCCAABCAC.exe"	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4680	sc.exe
4420	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
2864	cmd.exe
6040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCBACAABCCBBACBBBBBAABCCCAACACAACAABACACBABCCAABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
2900	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
2900	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
Token: SeDebugPrivilege	2900	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 4428	4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 4428 wrote to memory of 1964	4428	cmd.exe	94
PID 2880 wrote to memory of 4192	2880	svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe	95
PID 4864 wrote to memory of 2864	4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 2864 wrote to memory of 4680	2864	cmd.exe	100
PID 4864 wrote to memory of 6040	4864	2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 6040 wrote to memory of 4420	6040	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_06158801fe631022cf503d6d5404c00b_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACAACBBCBABCACCABABBCACBCCBABCCBABBCCABBBBAACBCCAAACCACBBCABBCABCCACCBBCBCBABBCBABCCCCBBCCCCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACAACBBCBABCACCABABBCACBCCBABCCBABBCCABBBBAACBCCAAACCACBBCABBCABCCACCBBCBCBABBCBABCCCCBBCCCCCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe" start= auto displayName= "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe" start= auto displayName= "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABAABBAACACCACBBCCCCACBBCBCAACCCBCAABCBABCBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBACAABCCBBACBBBBBAABCCCAACACAACAABACACBABCCAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCBACAABCCBBACBBBBBAABCCCAACACAACAABACACBABCCAABCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1321609578d46a6d990bacf55cffb9c126b16612f4288faaa34fdef7c511a14b
MD5 45355c15a1893711014e4914e1dd6fd5
SHA1 f4fa41fd78a9bc6009524f444f060710cc2f5fa4
SHA512 89a4c654ea9420f4438e3e971a95958ccbb9d84e7207624021eb3e2fbde6ebce62f93140873a17a5025f39c3157751887242bee4b4fb53cf8a240625de0768f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4eed4ff84a534674cdb7839fe511bc18156a73100c3e18de4a29340f7b09ddb4
MD5 8052806c3a81683f6e3b1aab459470b3
SHA1 f463ae8f27a229ce8f3a94f387f2db2cca7a259b
SHA512 db4f94ea52888bc9bffe6adf90776e9158f8300418725f6847f40b4ef2a7d11a2dfdc9d777e08365ff31ded2eee9e10fddaf4ca9ff12174bf851829a1cd8294a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 90c0e845982ab75997c75083f482486b73cae4b430904754d9135103b4e4dae4
MD5 0b781ea0aed3e88bd592673c9839848a
SHA1 c33ce2f43f5b2947aa79dea1655f8ed8565a3d25
SHA512 f578ca003579356e7896c84746e02126fbf50f05c81a99119803a4c0992a5b80b72e4054b983f07fd521e2a5fb40958515f4d6308481fadb737d4ff9576c3fff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0e9dfa6dd159e319933150fa35d7cb94683f04a78bac51436d0faac50e1fb3d
MD5 9232980050d6a04414bae73640937bef
SHA1 b4f2acfbf8666f72f253d9dfb4151e61e4d0d159
SHA512 b3074d85cb462a7db7b05a9ca6cb0482240050b110471008869893bb8b3937654269122ffb744d04cc94dc8adfeb36e5e2b68c2122dc57d9fead9d236f88aeaf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0c61190e6d67f8543bc8bddaf9375c14acfc0a4cc897908fb0a4994af84f39aa
MD5 04db4fb1613e40948dc93e96d6776ece
SHA1 cdf94da8d035c0101fbe234702f994a687b52908
SHA512 b14b99fcf82a398222e80de6f2922134a316de121b3bfbf32ff3b10af10cd5de2877e712af47474dee2b51716a6fdab5b0e940312f70eeff7dd7869874e68640
MD5 SHA1 SHA512

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 17.7MB
SHA256 b4b2b44523239e7a1d023ca24ffb72282495d454c401fd7a901c8dd2efa5cac6
MD5 0edb53900eef4463a44597d3bd7fa377
SHA1 cc4230a6c62e8c502b70ce0a7a5fe17621828eba
SHA512 84d554b4b98091cc3c8e1b28399a79b0805f6dabc7bdbd822b8e06a7c31c1e5fceb069b081f33dd7cac7940fb53efa99cf53716aacb53336f84122178aeb73a4
SSDEEP 196608:RKWQc0gEYnvLPKWQc0gEYnvLPKWQc0gEYnvLxa6eWBMt:4cZEIvqcZEIvqcZEIvta6eWBk
TLSH
T125178D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 28.8MB
SHA256 1fe0f08a65b1492da4132f467b744339fb9bc49fe8be004cf43333d63c9776ff
MD5 ac629d584bfd5eea3cffb22aaa1be2bc
SHA1 2e292984603331925f7d428da35b635d13491438
SHA512 e07e829c1715d38ed984fd695b24c01f6773077f683bf2327fff39199697bdf34b95437d2152499b960271234bfaa93a6ecd43f12c4032fe02b0508ad8564b32
SSDEEP 393216:4cZEIvqcZEIvqcZEIvqcZEIvqcZEIvta6eWBE:dEIvTEIvTEIvTEIvTEIvQWBE
TLSH
T1C9677D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 34.4MB
SHA256 772ad780c08f3762363dfcffe90260684a003aa05872192cd7c53d661c64940b
MD5 c3c8d1c59cd491f83bcc27089199983d
SHA1 c2b9581d92e0b8b6bb785ef4263131ef597cf3f7
SHA512 4b2ce118c6d82ff38061c8e94887b9f3b3d11483f43c3e08f2e38fcb7705477c650ea7ebcebecd663b942841c0af044592112360ad4d8920429af88cb73b84ef
SSDEEP 393216:4cZEIvqcZEIvqcZEIvqcZEIvqcZEIvqcZEIvta6eWBc:dEIvTEIvTEIvTEIvTEIvTEIvQWBc
TLSH
T121877D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 35.1MB
SHA256 20b289f8ec55732a9fd91e24f8f8c4e046b8dd327265f8001125d1a921c05012
MD5 649c47a0f0dc20547c178183708e8b2f
SHA1 66329456a0f4fe2c1b9a07ca17df8627908d295e
SHA512 4a28381629b674809ef55b2b1a3b692b03c2657706dea5777a45db8d7ee8081fba16f69232ac251ea7b6a9ee2fd07352190519abf6ff9955f092b38e1eed1808
SSDEEP 393216:4cZEIvqcZEIvqcZEIvqcZEIvqcZEIvqcZEIv:dEIvTEIvTEIvTEIvTEIvTEIv
TLSH
T136877C82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 128KB
SHA256 84032b490f435fbe81112511dedc2ad24c036c0d4d4e9ddcf839e5b6b0cf40b6
MD5 e162d07054c99c026317f09a14c233e0
SHA1 984cfcccf240518aa80acfacfad173840f4349bd
SHA512 5e118190e44cbef7340a8af810fd5b7ac7797e8b57903d35f376003a89a47cf2eede13548a69b92cf2fb1ab64976c4277d8633e8eff903a10d15d3c23a5415ef
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoeXI8fNukQ2xgd:m+dTTUFgEs3XojAdZLVy
TLSH
T176D35B09F94740B5DA2B90B049DBD2BFC660BA1587128DEBFB8DC75B6D23BE06039315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 56.6MB
SHA256 49f2f41fbe774a9cbe9cd7ddde429022a4930e57a34145c4e8ede2528cd504be
MD5 716a24198e180ffba4b362866baa4444
SHA1 6237c8da7760cc118e97715ba3fc124c2ee82797
SHA512 3bfa3f9bca2057839ea13e133f5288d84485e8c391bb44cc787cd5f903334221cae84c5122a91ee6a8c9a66915a6141d907c15b1cb3655dfacc2f455720cb68d
SSDEEP 786432:dEIvTEIvTEIvTEIvTEIvTEIvTEIvTEIvTEIvTEIvQWBs:pLLLLLLLLLQZ
TLSH
T14ED77D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7ad0f8bd43041f97bb09b443cc7a30e026f13643be18378c6fe87a1f9c589db2
MD5 a3c1dd3e91dfe1c739337e8484408754
SHA1 dd065496f41e8094d4c787df04f9f6fe91ae24d5
SHA512 8ead7a30940a3c384d9bd99fb5e1d76945b3692451be874a953cf6465685b19b4ce7c6841bf9bfd63fdd7128fc676360b61118eaab721e758ed799aa78e16321
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1adaae063a67a3f38bbcf7f227a764f2b5686aabecccd986801d7fedf483d4e4
MD5 ee905bbe4a392a7fc2520e297cf467d1
SHA1 ab07c9fcad30264d79e711aa7d490b96fcb3954d
SHA512 57de0e58a617b725a7242dd653f02ddfc3066e7295229360548730171a1fd7ed592e391f45c00517a4cc3fc5389125b3388f36ee712faf0af855b3e4a65bece8
MD5 SHA1 SHA512

Submit Download

svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBAAACABACCCACCACAABBBBBAAACABAACCACCBAACCCBCCBCAABACC.exe
Size 5.6MB
SHA256 deba8c411362c0fe763700bb0c4386b7108732263ff9d5039edbda9d8e4756be
MD5 06158801fe631022cf503d6d5404c00b
SHA1 39fdfe63ba6acb70a7c047d151f8ed979fa4a542
SHA512 c2026aa58ec871906a4c41a227f4e79ef6c4ed85c77b148954c1521c4db1d4fb1c736f0f792af5ef6a4cf226575c98fec2d0c5e35eb044ed000392772dabef2a
SSDEEP 49152:U+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+E84qatgl/+Ee:a88888888VKjKWQckVgtev5mnlNLV
TLSH
T1FD467D82FB8985A2E4670231486B82B75B70FC155F12E6DF7388636D5E337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6de14d5ac298456ae6cd8f0d8e5e9c0fd38da95619eeb30a9c47f65aee2f0893
MD5 af28f21443aee1377320732dde84a267
SHA1 9b052a8dbf522a1444ee94c92659fbb0ecab6ed7
SHA512 441a99bb9a233269c189bd99301c401e9fa10cc3897e3ab4cdf2d8315cced39c344b74beafa629166c819c29b18ce142cdcc1511c6e7b9d9dc2e97978befbf88
TLSH
T11211C469E5F99C23F9336CCB961D9B9748B43E9FAC2C6E5412084219E7A9C318D1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2880-70-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2880-48-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2880-94-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/4864-49-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4864-71-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4864-23-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4864-0-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4864-12-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/5488-85-0x00000000004F0000-0x0000000000511000-memory.dmp

Download