b4d15cae9485dae99b13fc49b1dde9c21f45b8367cc2780958793ac5948226c7

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 22.5MB
Sample260817-d53f4asfkh
SHA256 b4d15cae9485dae99b13fc49b1dde9c21f45b8367cc2780958793ac5948226c7
MD5 52f33c7f1968841f64f6c57d1d8a9c61
SHA1 952d2c351aa81c5db4c93e23ff94a080741f3938
SHA512 e375d49f152f8cb58e335b9b362749e2c6d34e11ee7e52c28ee4102b598c69175d8a12ca3a7dd053d7b903a6f8b882381e16f15d36bb467aeee2cd46c616f9f3
SSDEEP 393216:IO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4m:rhasjhasjhasjhasjhasjhasjhasEEIe
TLSH
T19B375B2CFD9541B2D436827188D7E6FEAA30B9126B015ECFA2C5534E4D37BD26D30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
5520	svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
1088	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCBABBCBCABABCABABACBACABBBBCABCBABBCACABACBCABBBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe"	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACBBAACAABBCBABBABCBABBCCCBACBACBBACBACBCCACABCBBACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe"	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1476	sc.exe
2780	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5580	cmd.exe
3728	cmd.exe
1080	cmd.exe
4756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3896	schtasks.exe
4720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
5520	svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
5520	svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
1088	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
1088	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
Token: SeDebugPrivilege	5520	svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
Token: SeDebugPrivilege	1088	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 5580	5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 5580 wrote to memory of 3896	5580	cmd.exe	93
PID 4736 wrote to memory of 968	4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe	94
PID 5968 wrote to memory of 3728	5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 3728 wrote to memory of 1476	3728	cmd.exe	99
PID 5968 wrote to memory of 1080	5968	2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 1080 wrote to memory of 2780	1080	cmd.exe	102
PID 4736 wrote to memory of 4756	4736	svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe	105
PID 4756 wrote to memory of 4720	4756	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_52f33c7f1968841f64f6c57d1d8a9c61_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABCBABBBCCBBAAAAACBAACCCACCCBABACBBBBBCCBABBCBCBCCBBAAACBBBCBBAACCACBBCCCACAABBABCBBACABBACCCACBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABCBABBBCCBBAAAAACBAACCCACCCBABACBBBBBCCBABBCBCBCCBBAAACBBBCBBAACCACBBCCCACAABBABCBBACABBACCCACBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe" start= auto displayName= "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe" start= auto displayName= "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBCACBCBBCACCCACAAABBBACCBAABACBBAABBCBACACBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABBACABCBCCCABCCCBBCACABABCACCBCBAABBAABBBAACCAACCCAABCCACBBABBBABBCCBBCABCAAABAACCAABBCCBCCAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBABBACABCBCCCABCCCBBCACABABCACCBCBAABBAABBBAACCAACCCAABCCACBBABBBABBCCBBCABCAAABAACCAABBCCBCCAABACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBAABBCBBACCBCCBAACCAABBCACBBABBCACCCCBBCBCCCBCABBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5572ef19cd23e70161b0111192d6c924e32f2aacca9e4a8f616f4c4e996ed479
MD5 6df7886e15ce41de9da9b460aabd5b5a
SHA1 1a3caf7ad2671047adfa7b106ea166b1abbe5ce6
SHA512 0ae8102ca3ffe6cbf86917e235a2962069f57e1ea81c0aedb1ea1518d1ef8af6d093a22dd3dafda71e9c5fb04d86569a3647d4d2a88edeb8ad3f62983cc6376d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 8ff0c41059366b87fa7057d05c3202d2e7db4fbc36acfbb5c0847acb867ec508
MD5 104fa0eea152fdb3167fedf759cb5a75
SHA1 555b1e9091ba893eb5f0f7ec9c30ded84b91153d
SHA512 565363d40ba7aab7c44180894eeb56c99b3b5a8a9324bd3997b27fc97178a2838dcd1787f34b64feb09986a9509710966955db0143f1dc103c98324d5caaabf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 dbb4a9d6e68b30e560cb4904c68d224eab89a1081005c33a7c23b92702bb45dc
MD5 d8c9d59bc4be499e081bffcf0d0e34c9
SHA1 6b384ca3a7feff9e0ddd752124f79cb408bc5fa9
SHA512 ce458dcf00ccf0ee982e8786c006bb26ff42a2494a4467261aedbd7de30d133a21d734e2b73f49019b60b298a84ebf048815464ecbdb1b0c74628c690dd121ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 96171daa176831a84b8b327abecd1a68ac32750c9de93f90188239930e7454be
MD5 c501114b22072c4ef6d2f38c59806a8c
SHA1 e5ceac20e0a204694cf4c0932b4f2de8cb178a60
SHA512 0aef6768a964c5af3e9a949f4b20070cc80a84ca08e128000158f71b125ab2a5c5db678f94839213d1714ad10b6d4230f93ab5c06990e4e64eb322923cf324de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 64b3a9107afe1685d152fb8e01df0774d8989602a457e74b8178fc6023f4ef89
MD5 b63c0417729582e6fd06e7df20442aea
SHA1 c9a6fc4adde20845f5f1f5f73b649d247c359044
SHA512 2319818a08ba31fa8f5f22176a10eba334531aaab36ee199ed33233b13c784e90c2a8847ed704a6ee2fe9f20f22c004aa735c940927c4083c18c03954dc44379
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 23.1MB
SHA256 8b9eb3892613335947aa9d905f3968a43a993a97f388facf6bea8a2ea842b6fa
MD5 e03473ec668d95a87298e3a4b4b8ba85
SHA1 fbeee8e43ce185e9d11407596d0401cc6191a693
SHA512 6f7f6f96c3f46d00d07479653952df2de40967759f80668b9a4949c327af293b312c24040462a9abb52bcf09faf4fafeca793957c4aae66b28d7adb5de41a39a
SSDEEP 393216:IO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO42:rhasjhasjhasjhasjhasjhasjhasEEIu
TLSH
T1B8375B2CFD9541B2D436827188D7E6FEAA30B9126B015ECFA2C5530E4D37BD26D31E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 dc9be16e3b10d7db98708057281a1ef1af9287cdddf05835f7d8d1efd01e0019
MD5 30a4e425c740d120f7aa1999a76d3615
SHA1 e7156a3cfb060e8020f9e34a43fe983661ca7aeb
SHA512 b895aebc81f63ac93f1b7bed6dedabaf8029fb7e3411e951ccea674a718123639b5db88cfb0f5ed6a56539f1ab639dd38ebb66c6c2bb4c625f4bf5e64e5e92ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 28f9a61c7165bcf3675edcc51119d9ce04e50743e107044ea8a17f1f5ee27f9d
MD5 68411513889311f76fc27483beea81d8
SHA1 49fbf4335a41f5e5d6bb3ef7558a3cd985707592
SHA512 c935279dd06afe76470b4e090bd911b6441120c5227aba558f3741dbcc5c50427af4e24cad616aeee0e675de288b4be0fde587c5694814a25c0b05301a02df1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 48900cf9a13b5e0b7dea07f907dfd331d6115f5633a5db939d4af9238c97a580
MD5 5685fb1f4ee23131245220e5e4d58ef2
SHA1 c66993b7a815c4a18cefb0ed4f52f9a077a388f1
SHA512 607c002e20877543e0b846b30a0a63b60d06a58b6533915e5906a01716babf9e2f9d7380c69e3cc508ce231274940385df412cf8db5b824dc679770bc853163a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 2a931e0b9e008206ff8099792ed5f6c52adff73ccc1fda395dec611d8b8b040d
MD5 4dbbc082427d54a4b4dbd5b22bb7844a
SHA1 ef514651b073d015bf285bfede62499126d2ab82
SHA512 232f933a2631e55832ea348842214c1d3a07e3aedd9fb06d29e9adb1b627dd2bf51581559d4b243b0b14ff13010e4a73ab1fcbd6b99bca8c6dc7c6aea8392d47
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\nl\qap`g`v~dtlq
Size 10B
SHA256 f1879f778d923a03b25af888c9b77c186c4345c32771c9ffa56d7570e19793a9
MD5 4970b74bebd2464b3d27f7e33c32c11d
SHA1 ad10967138556f292812f7b1fd3e95d2992c8861
SHA512 a34d4d2fabf23380b03cd6f50a2dbc8ae0a3887f8479733a5d62d892a448dd04e852e0be3ab7c0574cc78c5d577e49ae3947f4d2990eec2f27f28cb523be1349
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bg\qap`g`v~dtlq
Size 10B
SHA256 b5837d0c75afe26dcb8f674a2595f0a8e586d3977f6b01a9d2340eb4af47474a
MD5 3a23bf5cb1866582dbfd3064435aa29a
SHA1 c653bbdfa409c028563a26f8fbd4d45071327e8b
SHA512 01ce85da2fd4a107ea4e31b8c22a7e1ae6598e89efed4d0789ef253404eab175c273270f683f2aef4dcc47d99d2da112833d8a01be5d456511860d48b7a52e5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 322652f8ca286a4d7a9d5d1b0a4593807fadcc75d2199749b48a169d124e1030
MD5 65e6dd2717f393333b5e80ba709b763a
SHA1 0e0abc319186989dc75ba3559fbd28579ec746b1
SHA512 4022640399643798a29a8c8d6e3bd766e1350bc3f1b77095efbeece58c6a8946a9a07b046c2951591b67f430856cbd1a491636aa7f0b62e602e16dce2efa6e63
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\qap`g`v~dtlq
Size 10B
SHA256 230760438fa432d7aac2a4433146a2045ca729aec97b4ff23ded35cc016f0e31
MD5 6ad0dc57d69cf342acd83732a8daf44f
SHA1 b5a442295a1f2964e9b6a82b4644ff1acde5d025
SHA512 f3d968ec0fca15f46070bd1c5c3f1345f002cbd1bf33b2861ee37fc71f7b3bfb3453f2fb345d743c9c97766ca0a7470ac633157d65ade6242f965e8e59c675db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee858e220b68311855fce91e20acb9760b1fd0e1ed67876ff2fe15389d46b3aa
MD5 e086a8f245e6674632368a045216c570
SHA1 9cc917e313fcbe9003aca245fb89a6c8989a66aa
SHA512 7d3fb38180ad5d5ba3c99d391770f3c1e287cc01db77ceb98ef5c66d8c33db0d2b0a498918ae14d7741d1a9ef06eefac92894a52b9591339cd01295f65948baa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 733c96a4119619940be12285c60b0aa9fafc5d3f3a1dec8286b7a300b22078b5
MD5 036631291dc8d62d108bcb00db8ff9a8
SHA1 6774d7c2fba40f3af26938caa3fe230675678f13
SHA512 d4c0088124db452ccce12768b373a549936aa0b02e2b43399dc8f956ee48b9424335541b79698e5d90ae1362b3ebcbaa0333f052c170b6a91ca80a44556a90f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa9d977ae5e4960ee76e877c17b23757c0b7f8a57ff2930574c891a3c496db27
MD5 3182353fa59424c1a0de33434a520ff2
SHA1 758d3e19e6825570d21115c471d3b7f5498dd458
SHA512 08ccf1f91353f045509e82ddb5d241d93dad2c1735353530d707adee3177d1a2677b76795523b3d5a56846c20169cbc17b6b8d7c070d524bc37d1b31518aebaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c72d38fd53b416d8290369be8e7963b50306215f73e622b67bc63220d2a9ae5f
MD5 3034bd61bc1994635de108b5e7866d10
SHA1 2a683ff81b13415e36e674c85e310e4d9a1eabfa
SHA512 6d327ab1e634ffa42264ddc48020179a2354842d34f37fd4c4af26da4fd24f99709f5805339179492e531cde1d867e15702d41a8f10c01f81af2865ee989d51c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a5576d479da16080dcb72c0e5c8eb1ed1e36f5cb5b46d613dbea1355ace52576
MD5 468985b7c61fc6146c20a22c0fdce1c8
SHA1 115c7f246d54d2eeb26f8648bab79f0f53ef5955
SHA512 bdd5de069a6c62f85d12be526966d1b495014cc11a84f56f347c42c879de59f8fe68074c27ff13d16e0201870d612fd0c54604177f924833c4e2adede72366c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f56e96ef8356a442ced222218fa2f129b7f37cbcb25fd0f67e95e4a88d9d836a
MD5 824f5f7afa8b3fb1c96f43142098eac2
SHA1 88df8dc3ec2c77420606dfe8bf2cc4561af29edc
SHA512 5eb03ac91c6876ad9c37adbedb483e58d11f40c131a5e515deab3fad22d42cb7525812e12591bb5e69112aa5ae70463d17da161cb2d4d08554c33019661b96ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 22779969d88345276a596af45e64ce995322512a90875be623a12d2e0003aca1
MD5 a6b3e6ac408583308251637e41b847bf
SHA1 b8d143e67b4970f677f2f5139da06d5ff92e95e5
SHA512 b12777b7d8268c39953fe9411c70901edae2b5c57aebdc9db03a09f6ef2dc1463193279f836ed28f6269c098c27e69a0822647eb3cfeee847312d57d740df10c
MD5 SHA1 SHA512

Submit Download

svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAACACAAACABBACAABCBCCCBBCBBBABBACBAABCBBCCACCBAABAC.exe
Size 22.5MB
SHA256 b4d15cae9485dae99b13fc49b1dde9c21f45b8367cc2780958793ac5948226c7
MD5 52f33c7f1968841f64f6c57d1d8a9c61
SHA1 952d2c351aa81c5db4c93e23ff94a080741f3938
SHA512 e375d49f152f8cb58e335b9b362749e2c6d34e11ee7e52c28ee4102b598c69175d8a12ca3a7dd053d7b903a6f8b882381e16f15d36bb467aeee2cd46c616f9f3
SSDEEP 393216:IO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4q78UhasAO4m:rhasjhasjhasjhasjhasjhasjhasEEIe
TLSH
T19B375B2CFD9541B2D436827188D7E6FEAA30B9126B015ECFA2C5534E4D37BD26D30E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 761468de6276e59e512ebb99a3cdbd348e3e0956504669fec03b9849b020598d
MD5 f9a2987fb5abb7f788e3a5aaff39ba9b
SHA1 07b6a16ff9682a492f8e8c1e9a647a9b287e4fdf
SHA512 87d6b3fa30d437f59c8f5772c0fd406dc1fec03f6bedb8fc843e37591414e9cbdc61eb377d3696c279b2631bd8ae1775686afff693380c18cb824080bb08e2bd
TLSH
T16321BC90F495CC77E833A8DF572ACAE2089837ABA95CA92013094318EE95C238D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5658af40a500b670a2f869a9d98af7026e0fb0b8387176464d6d5cec60a7a8c2
MD5 8fd941e1ef107ab028673586fb28fb1b
SHA1 1cefcc68ccf992975a180f9421a76a41a1299968
SHA512 cacf02bc19b4f9447a19a0ffe841a0b6b76167afa9d0f38a6f3933099c3224caa293507a6da08e7a20242c13df9cca3b7281da0e0e2c5468474aa6b27a7d552c
TLSH
T1F611AB90E4E5D867EC3379DF572ACAE20CD837ABAA18FE241304431CEB95C234D254E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2659f5a4acf992adec28d684208645bc582a74506997853951e6d5ddaf9de6f1
MD5 fc504424b77bfe7467f840ed586cbdf7
SHA1 4e71c1254d28174265a3775b3f5f062e915c7cea
SHA512 019fe7c2652b3c6ea8ee0c1f7e5b254b2240ea85fd61b54ff6e3827cd87e02649f9c2f147e36c145b124fb239bcd1fe54e16434d11846a0b6ca92318afd350db
TLSH
T1BD21AA90E4D5C867EC3279DF572ACAD20CD837ABAA58AA241208531DEA95C234D254E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-655-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/1088-3786-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4736-30-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/5520-78-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/5968-6-0x0000000000630000-0x0000000000651000-memory.dmp

Download