3223cef68af9bf7328422613c2be65553155b7d5e280ef689beaa9cd02574628

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 11.8MB
Sample260815-pawkvawajc
SHA256 3223cef68af9bf7328422613c2be65553155b7d5e280ef689beaa9cd02574628
MD5 c3a5e6f89cd5d6734493205bc61c1e7c
SHA1 22f0b9ea79422d16f9cd2b271d205905b8110a1f
SHA512 23b21df0991361cae105739df54c898c06a9a9bd4344e18ba643548dd7505e1702e8db95e855070da5ac62d6f947b9d440ad34661a62cb6bcc0b83ce46142b48
SSDEEP 98304:1SvSvSvSvSvSvSvSvSJKjKWQckVgtev5mnlNL+:VKWQc0gEYnvL+
TLSH
T1E7C65D41FB8984A2E477027148AB82B75B70BD154F12D6EFB388936E5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
5024	svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
4240	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBBACCABBABCCCACABCACABBBBAACBCCABCCBBBBABCABCACBBBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe"	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBCABCAAAACCABACCABCBACBCCBBCBAACCCCBCBBACAAABBCABBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe"	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4880	sc.exe
2624	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2076	cmd.exe
1904	cmd.exe
4512	cmd.exe
5052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2324	schtasks.exe
1956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
5024	svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
5024	svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
4240	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
4240	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
Token: SeDebugPrivilege	5024	svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
Token: SeDebugPrivilege	4240	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 2076	4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	96
PID 2076 wrote to memory of 2324	2076	cmd.exe	98
PID 636 wrote to memory of 3608	636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe	99
PID 3608 wrote to memory of 4156	3608	notepad.exe	100
PID 4328 wrote to memory of 1904	4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	104
PID 1904 wrote to memory of 4880	1904	cmd.exe	106
PID 4328 wrote to memory of 4512	4328	2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	107
PID 4512 wrote to memory of 2624	4512	cmd.exe	109
PID 636 wrote to memory of 5052	636	svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe	113
PID 5052 wrote to memory of 1956	5052	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c3a5e6f89cd5d6734493205bc61c1e7c_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBABCACCBACBABCBABCCABACCBBACCAACCBCACCCCACCABBBABABACACBABBABBCBBBCBCAAAAACCCBCBCAABBABCBACAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBABCACCBACBABCBABCCABACCBBACCAACCBCACCCCACCABBBABABACACBABBABBCBBBCBCAAAAACCCBCBCAABBABCBACAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe" start= auto displayName= "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe" start= auto displayName= "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCBCABACCCCBCAAABCCACCCAAABBABAAABACCBBBCAACACABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBACBBCCBCAABAACCCAABBBAABBCCBBAACAACCCCCACCCACBABBCACBBCCACACAABAAABABBAAAACBAAABCABABABBACCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACBBACBBCCBCAABAACCCAABBBAABBCCBBAACAACCCCCACCCACBABBCACBBCCACACAABAAABABBAAAACBAAABCABABABBACCBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBAABACCACCACCCCAACCABBCCCAABCBBBAAACAACCBAAAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0c52d8eda19d7abcd3741cc6fa56aa0d6419bb10b3a50a191d38162f967b0f9e
MD5 acb80fa89a14187ec6bda98cc0c12390
SHA1 78f2862c21078d9435a36e9b74b22aa34918bb60
SHA512 3b502500c692aaf4da692184f3b9d746ec8636baf7648f243cc875c4f9bd8afbec9b189f09d417a63a5342b32cd44ce3f385bca425a63ddf7cc3e9b7ee6099c2
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 12.3MB
SHA256 ef0ddde7b8a94f1f9c8a425c10b6f993842f7080b18213eb5c9c7bce8c764502
MD5 c56b053720e7ef88ddad0dc8161b66f8
SHA1 7c54761d704f62f9ac57eaf5de9b4e7501ace591
SHA512 8644ec581051a5e58bd5dbf91526b29b041e0f899e174ba7297c142da2f37906ce62197bac394b21dc6411896d5d2d3c713c3afc33aed9a08a0b6fd3b4fe7814
SSDEEP 98304:1SvSvSvSvSvSvSvSvSJKjKWQckVgtev5mnlNLppiF:VKWQc0gEYnvLs
TLSH
T100D64C42FBC984A2E477027148AB82B75A70BD154F12D6DFB388936D5D337C0AB32766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\qap`g`v~dtlq
Size 10B
SHA256 2ad6ebbf25c2a82e14392c8c278fe9f4cb209a583a47c2853a9740dfbcccfc6d
MD5 65a0c0d53863bdf4ee3daed6075e109f
SHA1 53ef59167dfe820da9dfd19b6877a956a3c8dcfd
SHA512 f111776fe950d8e45f04a0e906d48cdfba02c7933b303ddddbf277c566770706ef3d83d64e26a4e59008dcab0b355adcef4740f711868fb4c09fe5f7fe5e7518
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 fb593225ed44e2403824986b5b63e07b098581614881977f8b51082d70c8f861
MD5 9bd899788bafd5ffb5701b126bc80478
SHA1 ff5a12542744885be09e1e456c406669385e971b
SHA512 4f830d8e287183f280a3224e4f4db4b12262b3a3658dc2fcfea822bee8cd3fdaa0e2992fd69bacd3eb8bd47b8557f1c474b69636cc6760312da462be6d1bc373
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 0f9634b50333acf6ded2c637927de9be1aae76abd4fff84810759d6aad160771
MD5 a14240052523e765448c6ae32cfcf40d
SHA1 b20c899eb540263b3ca74dcf19e656e71d7fc567
SHA512 1119d4bf187d12628092d1cea5f6e55819d16dc282b34c3c61d19dd91bdbe40eaf08f7f7439e5d64e821727f99cbe7314aa0c3eec5497e8586399eb7f5c9f3b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 c85c3cf20e0d339759a7e11ae74b0b2add03d03ada18f87c119227e4ef1ebcca
MD5 d559133181c39c009dbfc8e30ad82f3b
SHA1 1c80aead8f1519aa37d0011aac388e3d64fdfbf4
SHA512 8df8c61038aac80be6d8fd3ec232201f523271beaa14e89d4ecc2cf9b46e63912f6f1384b262be6509b5ba8b9b9e9b04c34b2cfcea929e3275e245834f35822e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 f9a6b9b51b74af335abd20bac031ce4985559c0c42adcfe5b32bace4db7a8c02
MD5 0531743a8a33c6dbc7fd750715340723
SHA1 f0d33d7a30714c19dd44e9678133949e215c1a12
SHA512 496a76b724a6227b1c7f626de7a6c4845e322a1653fa044a91e4add5656c065cf7caa2b6241594bda625c5249d83f9916a9552056074cb3cd752df486d0537c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\qap`g`v~dtlq
Size 10B
SHA256 da1905d8c8a33fd3628d0e6ff1a3bc38a7e83407f17203cea44ec0e5f218d486
MD5 fe24175a5505fe600e0b180e91266025
SHA1 5b451c04537dcca1d3d2230afe74ca8adcbe63c9
SHA512 689f4eb6ed3f45ae78ac896bd090531c4b4049105700c2296cd6f5de751793b6c14d376ac1627ff80c5036b79a19836c14ba516df5ce561e74fb3bc336505602
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0cda5764253bfdcd8faea4b9f57b694adc94d835434f1d16782a7e975f394749
MD5 315c35cd6ed691d789abcda582c539f6
SHA1 38f48a1d28d7c46dfb2387f5546e4e391b8e61cf
SHA512 098fa54514e0c4823db795e7f176ccbccde573859976543418aac29617981d9c9251b018317cd0d06b844d3e627456766720e0f848fbda8e5659592893a3193f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 741d738a70f9fac16a979498edd2f42e91ba5ee8b64a8c7d65221b34e1b91955
MD5 a24b86bfa3d96ef26afc98e14b896d4a
SHA1 db528335b70b50fee2fa8a00d3e662c0505b83e4
SHA512 0a0638f78d929ab023faaa5d331ce71c3a1cb29f9f843906e48af34abde81a8909d8a3bcaddeb9f61a87f161f8c1bb4b48b3df5c8c792f80b437112a061d51b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f67b8625cd23f20ca375dcd8ca7424566fb3fc41e4b89d804ff1e56c694a33b6
MD5 ba1b4e7753c4a782b80c0e07f401ac5d
SHA1 afd52bad56bf5c236cf41eccaf5f81d37ce3fe6a
SHA512 8b01ff2c744573b27155e1ee27a4756f54eeba3f1022c537fd9a9268834b6984ed504d875af31c20dff49d6e1120b2e26d3dbc869c2fd56ba57d47bbd277af45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d677343ccacb8cdaa2f9b6d816a39d5a1c114e12c947828719d41b7a5987829
MD5 f2f47250dd287dfc4241aeb9cc6787f8
SHA1 94bce1c1bd08a4340071c093fafcb311e1e41911
SHA512 e6c73a16a2f282f0a84b3ca08c51811ea2e35cd08a0b40fba76e2fa318d317e5aba15bd55cd22fdd1f9ace8c3d850e3ed57e2765d9b9b19594edc0961770121d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35f891d0e83d3ef90ea72d5a6b82732dcd71b1d8cf260f8d5a17f465e1b9d4b3
MD5 2dac9ffe3354da76b5638b45457ce791
SHA1 6e3bd1cc14f5e4ec37710ba7d57f8656092e64d9
SHA512 380ed41b24d758cbd2e3a0c5c9030c19f5bb6a88957cf51891f341ba8de76eacacb4bee60a2ffb5e5e8cad1aed9d02d3cceb98a4c1145e2be4e9199ea6057d05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bdcf27cad4465ebc012bdf884a1f533944615aa704dc3f974c52ce77e356c8b1
MD5 6262b8f0e1e2d8748dae41a55894a4b4
SHA1 dc3b73dca55c79c65ecb8aa723a9c81555e52743
SHA512 438772750d94fc3e6e8db2560da5c25e275caecbb16738b71cd9c7e16b1b21468fc39dedd961b3694aebb84ff1e76fe6309a7e7aaa04a94a2ca61470360baa8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5252460423a5ea2f3eafeabd9aec8c0af6bf96f72ae58752f90e90c475162d95
MD5 fd87092047fcbb1c4730dfbebdcba53b
SHA1 fee3d69e669ae1c38a13eda2b050939562ec82c2
SHA512 3ccf73bdce206d8e1d90f6b1fa07d283bd1d66a903f8c8bee1e56789bb54a1420e7f1292641b1f7a8ecc1ba179c196c8c3d29ce7b3162b5f0bc58708a1359831
MD5 SHA1 SHA512

Submit Download

svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCCACBACCABBACBBCAACACAACCABACAABABCBACBCCCCACBCABA.exe
Size 11.8MB
SHA256 3223cef68af9bf7328422613c2be65553155b7d5e280ef689beaa9cd02574628
MD5 c3a5e6f89cd5d6734493205bc61c1e7c
SHA1 22f0b9ea79422d16f9cd2b271d205905b8110a1f
SHA512 23b21df0991361cae105739df54c898c06a9a9bd4344e18ba643548dd7505e1702e8db95e855070da5ac62d6f947b9d440ad34661a62cb6bcc0b83ce46142b48
SSDEEP 98304:1SvSvSvSvSvSvSvSvSJKjKWQckVgtev5mnlNL+:VKWQc0gEYnvL+
TLSH
T1E7C65D41FB8984A2E477027148AB82B75B70BD154F12D6EFB388936E5D337C0AB32765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1e513fab21071b2a9da45928b48f6af39ecb96bd730255aa66c969ac13465a72
MD5 186231241baec62b47f3ec7b48ffc7bf
SHA1 2b4f447558803fd3efb16fd27bd69b016bc08fd6
SHA512 867e839f426b75da8ea7156a04654ae3ae8a835ca99d62d9edb257063ecb11939b971fb92c541f5ec7be48c737cd20c7f891df98a5098e479373d90088573e3b
TLSH
T17821A575D4E4C863FA636C8FA65D9BC30DB43DEFEC6C5E0422098619B7848318E194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0ca494e500c24dea50bfa25f99a5c161155c7d76aa9d9e7d3410d205d72c2344
MD5 560908615188a438aed8b245a0cff8b8
SHA1 ad81ceb4f4ad32599a1dbb7f2de07467fced2d49
SHA512 f65f7ba5f1b094e866d4ca7b9377a55c904cc12640605466b31b4b1e84f15b2c926279ca8213ea1be81ed526fedcda1b1f9fa3ac0650f9714e12efb1e1bab103
TLSH
T13211BF75D4B59873FA732C8FA65E9B831DB43DEFAC686E042209861DB7488304E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0d990b033fa2b15411c69b6a1974807b52940cca24884ef67bab9f3050a914fb
MD5 937700e7cde759ac1a6dd524ea2ee849
SHA1 574d8f871cbda39e85508569b849518e75355632
SHA512 26b8da6d12995bfd46720fb2967d07d54f06e6bd3863e29108116e555b2d73eb63cb59f4ce2c356aa375801485264e05c812fe6a9016606fd035968e85c0f770
TLSH
T1C921C275E4F58873FA732C8FA65D9BC30DB43DEFEC686E0422098219B7448344E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-36-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/3608-60-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/4240-2365-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4240-3016-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/4328-6-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5024-77-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/5024-2364-0x0000000000360000-0x0000000000381000-memory.dmp

Download