81438ddf613b2ed7bfe1f89afd1b41500cddc020c1d14680a21e1434e0720e80

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 10.2MB
Sample260815-ej9hysycme
SHA256 81438ddf613b2ed7bfe1f89afd1b41500cddc020c1d14680a21e1434e0720e80
MD5 4d594e1a8313b04ea6b8688ef462672c
SHA1 54ac53fdffeca683219d314191be60ef1eab8253
SHA512 9e2d92715e18a3c0c09d1eff3aa98a46147b0c15ec0d9268e4318be870e704f6d7317b1379af5901c34d412c755191150bccae467bd416f16588366a3e7917f9
SSDEEP 98304:1QFQFQFQFQFQFQFQ/KjKWQckVgtev5mnlNLF:0KWQc0gEYnvLF
TLSH
T1DAB65C42FB8984A2E477027148AB82B75B70FD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
2776	svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe
4736	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBABACACBCABBCBAACCCBACCCAAABABCABAAABBBBCBCBBBAAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe"	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCCCCCCCCAACCBCACBABABACCBAABAACABBBBBBBABBCABBBBBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe"	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2564	sc.exe
4052	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3956	cmd.exe
3692	cmd.exe
1984	cmd.exe
3304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3196	schtasks.exe
4136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
4736	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
4736	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
2776	svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe
2776	svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
Token: SeDebugPrivilege	4736	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
Token: SeDebugPrivilege	2776	svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3692	1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 3692 wrote to memory of 3196	3692	cmd.exe	94
PID 3860 wrote to memory of 4676	3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe	95
PID 1188 wrote to memory of 1984	1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 1984 wrote to memory of 2564	1984	cmd.exe	100
PID 1188 wrote to memory of 3304	1188	2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 3304 wrote to memory of 4052	3304	cmd.exe	103
PID 3860 wrote to memory of 3956	3860	svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe	106
PID 3956 wrote to memory of 4136	3956	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4d594e1a8313b04ea6b8688ef462672c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCAABACACABCABCCBCABBBCCABCBCCACBBAACCCBBBBBCCAABABCCCCABABBCBAAABBBBABABBCCCBACBCCBCCCCABCCBCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCCAABACACABCABCCBCABBBCCABCBCCACBBAACCCBBBBBCCAABABCCCCABABBCBAAABBBBABABBCCCBACBCCBCCCCABCCBCCBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe" start= auto displayName= "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe" start= auto displayName= "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAACCACCACACABBCCCCBBBAACBBABABABBAABAAACBBAAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCCACBBABABCCBBABAAACCACCABCABCBCACBCCCABACCACCACCBABBBBBABCAABABABBCABBBABCAAAAACCACBCCBACBBAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCCCACBBABABCCBBABAAACCACCABCABCBCACBCCCABACCACCACCBABBBBBABCAABABABBCABBBABCAAAAACCACBCCBACBBAAAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCBCCBCBBCBBBCBAACCCABBCBBCBCAAAAAABBCAACCBACCCCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 59c4ada6afe217da633d29f2e797c5543fedd23e1bd2fc310b263f3feb5f3304
MD5 902baa9ed3bbda4be8286ffcea758bb8
SHA1 ad3a83cd5c38a0dc3c4f5b55e90c0455ece3d70a
SHA512 9da31286b1b2299d113e5e87ce44dad763a81d5da0864e4e7c3beee49ca727075e9cde6d8dc54c1715e51e797900f2a503c587170693d52b356623dd23fcf4d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 768d625cd68116f98cb27bb4c3550a7647e6f26a4b6e7c31700d7705a868fc5f
MD5 806d321861ccf1603d108f2154774886
SHA1 23d85634243e8f4e25a12d9eb2a93419961314b0
SHA512 7cb86e0073924daecd25963a292cc786f4a523a414f193e8d6774f1746f88ed04c644a02612b6d0e294bd12a0df11b1ce19e742d2c1dab242199555696b8b276
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\qap`g`v~dtlq
Size 10B
SHA256 a43eb7b76028eaa29e77fd1424ee701d24ff8a6ebc3fc6fc792d2e5b4e33065a
MD5 4bca05323ace92d91daa737a98af8ded
SHA1 b8d16bc8a994b4e9a77bc34f3085c329d18d1487
SHA512 bb59c7f93b82f7a9fb7e4d2dd7044c1a835c4a62331d0ef0a07bf0ad0f3fbfd2516a210459d7fffa0492b6140f08586228b515fd1a78af61b0692cf393e7f156
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 fd5aba6527c2b408cf6a104cb5390f5f2c9337af3779f4f5bdee4b9f47fcb520
MD5 60669efceb563a0726ea178e901c46eb
SHA1 0cd1332a591565c3f4795d8c6c3d35a66cac9037
SHA512 e0a995c32c724cbfd96f1d1f404a0ba4586128b73295ca0ea9403d1ab5385469967e0279e0770f2dc9931f701f710e3139d9b0d12935b9ad9033eab229952c63
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.8MB
SHA256 8ebfc425e1ed653bd5694bf8697a0eb2c2b556004e6801e9bdfe0d0e29f0c15f
MD5 acdf69140931bbbd1ff78b40819db0ac
SHA1 f93d3c0f7554a3f44bd2ed85e0caa2d57c2721c4
SHA512 0bea3a29527fbcfc564ffa629cd972c0f89b3064c6c62a3098ac5c295cb1220163f8ba0f93a4d6bc159720e6672e6db28969027d21f5e975ab66db205b1b8ff4
SSDEEP 98304:1QFQFQFQFQFQFQFQ/KjKWQckVgtev5mnlNLUgZ2Hb9t+2xW:0KWQc0gEYnvLUgZ2jW
TLSH
T106B65D42FA8984B2E477027148AB82B75B70FD154F12D6EFB388936D5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 6c3e5ead77f4422aae6a09e5f90aa549316a549961ed376480f5f3cfb64ceb1c
MD5 ff7daef3e3ca50350e77c7bf912c02c8
SHA1 a8a5a92c37afb0b7ec146966364061bd4d01015c
SHA512 7228047ccf73eb79b022e09b8c775662baece91eb59024e1e84d9efc2471fa08fd0e95d837bbe5f011dc76f9331e1f4d9b16a38874fcc07ef6af1ab4f3ba99ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0635d9f15471ebbcca6ff28ee7d30f5605b51f2bd7cf89a151c1716f7a272f22
MD5 c122d039d20b2f92db2e1d2856182861
SHA1 fdac33e49f4606c26f3a030dd00c10a91e7b2052
SHA512 87489ede1920584c849753c86617ad0aa8ccce8be6aa4dedb6073afdddbb06636b083815db23a2f3dc00bc722e7ac2b4595477fa37f34c8f1fbf482fc1952600
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\qap`g`v~dtlq
Size 10B
SHA256 cc09c04e19c6d8e318311c590acd8c6604161c157b77c06460fa1ccd8d0398cd
MD5 e341978a488b7799901fdaf196e666d5
SHA1 c22b1a3c1180ff5103215869c71a8f9b072d7e6c
SHA512 5362b59bbd6dffbe89bda887a01e53bb2e0b2c26f9589e3f705074693db9cedf9c43640d549b1cd39da31ba1f6bdbc1d4eef52873daff332a7f1733b78836063
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ec3e09c027ea244c6a1644e5de79006a03acc09d16cd5ae0794ce942dc89f465
MD5 78813ae586b50847b7ee8c7fa6ec0b53
SHA1 4753eeab94c71e9eb63c79331377318675a0fa23
SHA512 17214af8bf991796139c28b48c56f7d8191a62ac6a2c649fe54b47cae616a4bc63ee47272ba35f575de1487af8c632afa05ab26267e4a518adea413edeb87c61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\LocalState\qap`g`v~dtlq
Size 10B
SHA256 7f3088e7cd1c337fa5741a392ab14ac99e266d0e827dfcf8e92fcf6974a2608b
MD5 b805f055c950b1d37f71b046214eaed5
SHA1 6aa4a182b72f185e170efe536f1684d2c48fee8b
SHA512 f18f622e3296954481fadbe04063cef6a239f235d4998c1abb799d1d552bdf68fe55c771acc20f3d274d75b7ee19a792ae405faadc06fa88cc7b4dd0b64f0e27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b275325015779b3144685c679539858644641d74b90abc3f2be138ab7cbe3643
MD5 68756cd38a6586594e59627bc75bfdd5
SHA1 85915a23a70fdea6dcbe1e69805a8d49e951124e
SHA512 e8a41944f7e6491910dcf8f67a8a46f78329af52c3ad70eb686475c657257cbfeae870c25a72357474a50b670c731ed9c5a655cf29c1ebc7e3fa1c19f629a656
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c35f68dba41bf08ac6a5e0320b7ab531a829bb2e3c4e4366789f89a6ad697fc5
MD5 842ab719e9b4db3b7b87ad4e94518ee7
SHA1 f4b45807c1f7798076769fa6f715f411f80e47bb
SHA512 75dd36c83682a1ba3af99112719de60ce2595122264bb8b5232a9dc64ab2415252dc6564578ad437fcd05fcef82c2f0133319a243e6c64d538aabd32b44d6733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4db2aff0d5c25e661b345fe04c560e861bb9bd7b320547eb39ff3697529c536
MD5 b04f6edc210bd08b7e32b59db1dd8ca4
SHA1 96ab41c3ad2d5e8b62cef90bb3d269b86c9f27a7
SHA512 77a9d5ec5e869b3968bdcb883f5586234cfc71d9929c4d71a061b001b4a15a3efe79b17a542589bf66bcdae512f849072359c9b97d6db4880bbd1dd5fce56a0e
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCBACBCBCCBCBBAACBCAACAABAABBCBCBACCACCACBAACBCACBC.exe
Size 10.2MB
SHA256 81438ddf613b2ed7bfe1f89afd1b41500cddc020c1d14680a21e1434e0720e80
MD5 4d594e1a8313b04ea6b8688ef462672c
SHA1 54ac53fdffeca683219d314191be60ef1eab8253
SHA512 9e2d92715e18a3c0c09d1eff3aa98a46147b0c15ec0d9268e4318be870e704f6d7317b1379af5901c34d412c755191150bccae467bd416f16588366a3e7917f9
SSDEEP 98304:1QFQFQFQFQFQFQFQ/KjKWQckVgtev5mnlNLF:0KWQc0gEYnvLF
TLSH
T1DAB65C42FB8984A2E477027148AB82B75B70FD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 809122eecf64c3c2eca3e5f9b5ad6e4924e9c639bae41929a775bfbfdd769f62
MD5 1be592830ec85002ca8319d54de46134
SHA1 d73a4d7704c6ca34487f14d1d76ca0dc595aca78
SHA512 a699b2dbf6c1fd3b0ce6d10ec2b85ca9597fff8ac33f5fb304a916b7d39546a4ad4f0e58a9bb70f63e3d63cea376c508b7c522ba6f3f61900e539acf358d34f0
TLSH
T1CF115062F8E6DC66F93368DF5E299BD20CB43BDF5C586E04130D9218A399D324D590E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a7ea3800be59dc0b134120467593bde54e44b301dbdfecae688ba7dccf407df5
MD5 5122e7b3b5be995e7e7d33f5868dabab
SHA1 854368be7385b6c774055ef92ca7cb0947035b1d
SHA512 e94c5e46418df4fae30e57f399bee71b039bc32e96a6b06c438306df2d68f4920515dbeffb195512a3da582f4ca3b41f3b988e35ba38edf28d117d2e73cc6d2c
TLSH
T15A217162F8E6CC63F93368DF5E299BD30CB83B9F5C586E14230C9219A399D324D594E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 18dacf11c21eaa0133b553edf0049aac4578c7dc146bf90dc533109db929a29a
MD5 fd5ca5728fff815a3ad31ca3b792e614
SHA1 949511bf85c29aad0a10f4685a710d68d5bab1eb
SHA512 be265716a378762931e23f3ae3ecc09c9abbf58f6c61ca523bfc53855a0cf570f0f9a68599bdb23fd8634083e8aeac9cad9f92e00132fde18e501e575f05315e
TLSH
T1D4119052F8E69C63F83368DB1E298BC30CB43BCF58186F14230C5218E395D324D590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1188-6-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/2776-68-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/3860-33-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/4736-434-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download