84069a566091e41b38072776daf130583997e915375b28cada74afa740ac0842

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 41.0MB
Sample260818-d5ep2adn6y
SHA256 84069a566091e41b38072776daf130583997e915375b28cada74afa740ac0842
MD5 273acc495504ca61dada44a5c3669ec0
SHA1 79408e1187bc287179b7a6c69d92e05efbde6ee9
SHA512 1ca19d7ce32d1a00524b0573c1b35ed2180dbd1f482516d5c98bd29683b8804327b53867e02396f60e1fe6026e7694b9408390c72b5bda2c084256fdb9ab03e2
SSDEEP 786432:P6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YfEIvD:SD
TLSH
T14D976C05F84380B3EA6611714C8FE2BB6A74AB204A128DE7F7CDDA1F7E33AC15636155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
5088	svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe
2396	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABBAABCBBCABBABCBBACAACACACCCBBCBBBABBBABAACBBBCACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe"	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABACABABBCCCABACCCACBBAABACBCABBABABBACCACBCCBBBBBCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe"	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5472	sc.exe
3144	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
3664	cmd.exe
3872	cmd.exe
4492	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2540	schtasks.exe
2104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
2396	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
2396	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
5088	svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe
5088	svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
Token: SeDebugPrivilege	2396	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
Token: SeDebugPrivilege	5088	svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 5076	1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	91
PID 5076 wrote to memory of 2540	5076	cmd.exe	93
PID 2620 wrote to memory of 2944	2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe	94
PID 1788 wrote to memory of 3664	1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	97
PID 3664 wrote to memory of 5472	3664	cmd.exe	99
PID 1788 wrote to memory of 3872	1788	2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	100
PID 3872 wrote to memory of 3144	3872	cmd.exe	102
PID 2620 wrote to memory of 4492	2620	svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe	105
PID 4492 wrote to memory of 2104	4492	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_273acc495504ca61dada44a5c3669ec0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBCBBCBCBCBACCABCBBABBACCAAABABCABCABCABBCACACACBAACCCCBACBBBBCBBCABBCCCCAACCCCABABCCCAAACCBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBCBBCBCBCBACCABCBBABBACCAAABABCABCABCABBCACACACBAACCCCBACBBBBCBBCABBCCCCAACCCCABABCCCAAACCBACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe" start= auto displayName= "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe" start= auto displayName= "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCACCBBABCCAACABCABAAAACBABACCBAABBBBBBCCBACBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABBBACBCCBCACAABACABCCABCBACCCCABACABCBBACBBCBCBBCABACCABBCBBABABABAABBABBCCCCCABCABCBBBBCCABBACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAABBBACBCCBCACAABACABCCABCBACCCCABACABCBBACBBCBCBBCABACCABBCBBABABABAABBABBCCCCCABCABCBBBBCCABBACBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCBBAABCBCCABAABACCBBCABACAAACCCACCBBACABCCBBCCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fcfd59b1484953fb24e5ac42b9e5fcf805e9e929c89eeda0e7256fe92c3f7a66
MD5 832cbfad8323bb7606a1c2bb90e9523a
SHA1 1b7dc003c14d6adfaa807f838c97e93723c796a6
SHA512 e3daa5921db46bdd639abc70262a5c46a77707d4ea63cdd415fd2637f65be83d5c2a4a64e85dea3df249d37d0abc153b297679160e7f62b553d69bb01e61f443
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 a7daf09f79d5964407f5ca41cfee52fc8a1dcaa4114180ed5f5f5c2e703886be
MD5 94de433371639eeabad5af7fe94385d1
SHA1 ea6fb7fd2563be69087dcd70f44e6a5dcad406cb
SHA512 dc4e3a1ed636c3d21d4a4d85ffce35b6d8ecf0221f3027f70361b2403f7c7e8b14979b5455174483493409d471374ed3f6570394afa9d5ddaa93dec55e152578
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 151ad9e60f5dfe84b3bb939608a39b1ddefa09ad3948be5449715c845f3fbb9b
MD5 8487996867078a3541050df5f28a11d8
SHA1 947cdd08964a9f5076fff8fe97fd60b3650bc17b
SHA512 a76b732b0131e965dccc77be7e9f6f411a9b9a967eddf5a92aeeab23fc838f9a7eb4de34402a1c65203ab89089b83ccf1f1d1bbd579aa41e0ab54bf84f686d34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\qap`g`v~dtlq
Size 10B
SHA256 819c1f13f398b1192ae656fe7c563b53607077274f5a0e9a2db4bd116e4010d9
MD5 cd235a7a3ecd8c9248dfd9d7d45107b9
SHA1 49500a79e3887285b8267935e805788e7c761e3b
SHA512 5e1ad468ea1851cd94449b3051f88a21f3ee90987017e779013b7bf4a0455d5c08243f70af07354f7a909d36f66eeafb19dcc7e2a63f2cefb159ff85a1978f57
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 41.6MB
SHA256 550fb176f51d00a418b213f6fe9ba28b28149bee06b6b94968f77d6f499cc786
MD5 e94d3f456e04294665b25eb7d4fc587a
SHA1 c42b443cc7e1b90ea1f5933f6ad24892fc80c8c4
SHA512 4be874e4a6918d9ba9bba70af3b1e7d53b51028bbd18e4efbc4885d10744956e2b97ba346f1162e9b5e3645698adb2f4c8164982f9e0fe2db24bc4322a7cdc61
SSDEEP 786432:P6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YfEIvHH:Sn
TLSH
T14AA76D05F84380B3EA6601714C9FE2BB6A74AB204B128DE7F7CDDA1F7E32AC15636155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 9afdd04830f4430480e246ca6e382f2525182ed210f8cdc775d560202ebd243d
MD5 7d5688d51da0cfb96a4dbe71ade533b4
SHA1 d4062b3f1e4ee8b08ae87154e4283cb9e3c36a9d
SHA512 30fd605984f81663ee92ccb8c0b1765a927b11986ee2aea62c4cc963b31aa1a5ef51be193dd22d3e28c98349dc8e859ea017795176e54e3d51542acff9254491
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 cbd8b8b1440850b926949f9fb13fab28d2fd3d1d260cca96ec296e505d854654
MD5 fd8cfae6557c3e2086bf5452d0139258
SHA1 1ca0790892a2766cf98db603b5d2849bc83b24e7
SHA512 456634aced6e6225c9831e14e232561fb2c544001990679a58eb3dbebb4cf55276f0644dae85fcb12ebd9fc73689e8b0115a1b4d249befe8a3ef456caa7f3f1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 50a44d5f50c5fa93b63d0168e0fe0183b267eca14ed26241392273362ca38ce2
MD5 6042b784b06da70e71dd8ce30ee99fe9
SHA1 5e43ca7599fce8670ddba6cd69082d98f6d8788b
SHA512 d049961ec5a4553adae6ea3997a68f9b3d72e508917bb782c1f4d53c52b372a2596365fddfc6c8cd16d04b2186e5991ce46b73df5f6518fbe66a765943788ef9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 41413eaeea779c4f38b0ca0a2f2e731149a806d7154097a1278c4d4749da5539
MD5 943c9437d31aeae3cc906566da074bee
SHA1 a579d4429e07943afbe558ae19ffb23bd7df6f90
SHA512 878f7c60c80ade861a0b3057434f269c4a249574055ed0548f1112200be8894d65b4c0d46d378af4d957c0aeafb53a4736fd7d06b6bc7bb1a686dca2d40f061f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 043bb07e34b9e60be1b45d5d7870ff838dbced635848d1f02f416c168320c6d3
MD5 f9fef58d9b751a0fba43910967fdb564
SHA1 1f299c5b59e8ac105a4dd5ada321ee699d24a0bd
SHA512 d86f670d239f695ca37260de50f39b4d090bb59a4d0fe7f5218436ff2bfad71bba23d213d7cf97a7f280b6222f832523ee91f964088b27c8cdeef92c93ab9fdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 f909f13b4ce53539ecb8ec34350d459da473bbd07e393c75dfe887a6a31bffe1
MD5 caa1a4ea65f0f57ddcf812e220a248f8
SHA1 319392e9c3bab759d6a0fd0cce6077e95328e53b
SHA512 0b058744f36965a426d65080d881e598a284b9e58cfb94e9331b0c33ce9fbe3df5dc75c535a97fb8cc89cd1caa5f13282e8fe469413ac56730c1eb407c85572c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 038930128ba31d90996be09f982aebf8222f0d1075bde78b67cb13af86031f0a
MD5 1cae445ae333dde31bce8f7d12a7926d
SHA1 9c3ce04896a7f290fb508d58ebc5a1a3198b4e05
SHA512 5a7c8c10a18a20b2ee438e2ea719d996534e23fab2552d054c7ca02a2ef34353a3392e647dc50c94bade20997173048e4f74e0e24df77acea8ed7e10593641f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1\qap`g`v~dtlq
Size 10B
SHA256 ff925ce0644a605e4f8395abc117526f0a4cf42971e4fd889063fcbb42d4f411
MD5 c0e2b5d62f540c8676473a7667221350
SHA1 fd66b5fc0268c2651ad57442f965b6f39e108070
SHA512 63cd45f7f019000656a0eeea43825a7fc92b2eff32021ed84cb8ab81a8a6ae407f83c8b71527cc8709a168b6aaa895841b39aa04bf29c3be00763584d6c43091
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 7d01a08009a8bb5808b7a6c484caf5b673d00d399e6c6d86974b5c86cd45e769
MD5 666cd9e22e20eeb3dddcc8259b617b99
SHA1 511c157d7af29ed2528259a62d2b9aa8d2ad03f0
SHA512 68267d5470974c31f37c0d8272eb12ae0ff76fec4fb4def06635720f62a3be94486917ba68114fce7e585a81ec7dab3e9052bcaaead4eff82acd855ce406de19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\qap`g`v~dtlq
Size 10B
SHA256 f3bbc7f1a251a4133457ff25bca7d72baab697eace23fa227b1baac2a85dfa32
MD5 a88404361511e3d96e4691e986d98f56
SHA1 4e2d62a3b11746d5cde046df3238263c6a1347f7
SHA512 f9dd63c040826e9c26fc0cd57bca481f56d0e80af97274b17bde98d41913ee01c03cfd479ad0a83c03024918fda218ead266dd6b045f39cc2ac9036647199967
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sq\qap`g`v~dtlq
Size 10B
SHA256 fc8046ce739a92899b22099f25b6fc58767673f7d57b1982b4a6d19d7e81cb5d
MD5 a252ef5c370c7cabb8c6be69934416e8
SHA1 dd494f7a271c1d44ea98ed501694ccfd608732cd
SHA512 4ccc716a683ba68ae494dcd141a66c933e9bf51261263cb1af096c5257a8a03c04bc746802479cb250ea23f63aded1e5e49721023f7d226e53d955859f69c3f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\qap`g`v~dtlq
Size 10B
SHA256 79710daca2b66fb48d9fe70c13675699a70ab5e3493691901a8b9197c1fdc786
MD5 7a072d342bbb387d0830f151c6087957
SHA1 1416234c9497d5669a15be760616b3b99d114136
SHA512 8dee63e78b2155fa4757cc6799701665ef1fb6c96c0b5e558ff3da0bd1602eda75e5efb3a8585de8c47a33c8b9a95a5971617938bc6d141d43f145d614584db0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a693c5817136354e1edb8ff5f9aa2d9ece0ef4b586a81b9d8ba409f107c33e47
MD5 ac53f44bd9978dc2dc14a86b65e583fe
SHA1 033e6b0d08c33cb61959c527636174f88dc91a93
SHA512 57caaa7402755a45b9897d2be6980ef9d83a26a772c54fcc8f73b8ea66b1f2cdf7ce6c3f7e6faac80bab62c2ff14f2f09af390b24d946e586c7c6af2128b9be9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bdd632eb56ce7ee5f86a830181458750489a0efd6d1ae48c09db17a6fdd000d
MD5 f95c27c48e5bc6f48fdbc99129fd5091
SHA1 fe71e14ee04cef92dca9a3d26b8d740ac1f055bd
SHA512 f55b56f3b48698b211dc555b20484c68701d3b6a2671e09308a9bad605db460ce2ac3979564dd474e8758096790bb6056b85e32ef8a92d2f021a9ebe5f3992d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c7a2cb6060756bf9a2eaf282543704226c13f8ca7cccbac46ad8cd757c5746d
MD5 c6c3944dfd5384d4ccb3f9f141fe5732
SHA1 f4fac5db30323ddf6e2617dace098c6138755e07
SHA512 d055215bc530dd46fa40fb96a3efb03a321415280d2cf5547d49425f3929ab0e69c4751f18d08685bbc38659089ecc2cea667054b0c2100bc66faaeaf8259b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0c3abaddd23319c4173462d9ce9ed78a8a4ca0b33663f4f86457e51e62bd4411
MD5 492fcc9c6016ca8d4b2eb934bad0c0dc
SHA1 508e1e217114781285a1f759f39a61a2900c8038
SHA512 4df891bc7b065b90fdd7c20ab598ead08075e069637d0a5934adef58a65c0f45fe27ef60cced439b05f01d552bf52d83b1c642d6fdee92de13e809a490f747f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdacb13daf1215e43db0f68dafb78c808e6819db5a9dd8c098b54366c40c25fe
MD5 3ea79f2b5613128db5230a46a65bdc60
SHA1 e8948e173171fb8cde0856d8e1117651f0ac3896
SHA512 3297114c7b16122a9ab49ec8664b5737533382b8e196aa099ec3c428119be3782d20412091dc1e1aa569b688fc921c6788afc2bf9f267de4f35cee170422f147
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4704a7f49e755d0b97a38dcb1a76dc9285e2947932033a61369ae1501e71f1ca
MD5 3fc18c218e79b186122c5cc641ba52ed
SHA1 b24965fd89655f0bf54d7f993a5d647adec2f027
SHA512 f75b895d6602077bf2c4c5c2648799b1c538af2aaf8084f7c7fe870dbc267679012e6272e00e1385f487254d760ccadc12235defe9797ac46857fa5d1e2a79ef
MD5 SHA1 SHA512

Submit Download

svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACBABCCAABABCBCBABABABCBBAABCACCCACCACAACCAACBABCABA.exe
Size 41.0MB
SHA256 84069a566091e41b38072776daf130583997e915375b28cada74afa740ac0842
MD5 273acc495504ca61dada44a5c3669ec0
SHA1 79408e1187bc287179b7a6c69d92e05efbde6ee9
SHA512 1ca19d7ce32d1a00524b0573c1b35ed2180dbd1f482516d5c98bd29683b8804327b53867e02396f60e1fe6026e7694b9408390c72b5bda2c084256fdb9ab03e2
SSDEEP 786432:P6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YO6Y6Y6Y6YfEIvD:SD
TLSH
T14D976C05F84380B3EA6611714C8FE2BB6A74AB204A128DE7F7CDDA1F7E33AC15636155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d11e395604d6d769bfb479850cebceff1587fd35ef0c6c4c4e0eeab05d223d9c
MD5 a01ccf186fe409452ab77a4119f9f99f
SHA1 dbe08d2c31fbcbb0d584f59910f310c522a7df5a
SHA512 1f90a9e1d6f569971d2dfded104207d98eb287f5d36775ea6a03225eabe0a607a7d15f58919660546c5a642226893e56e1564572aceb28fbd367304d94b462b6
TLSH
T14521A754F8B6C873F93329DB952DDAD20CA436BFBD5CAA18230942186FD5836CD154D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0558d86f1b3579f50687ccf061653bb91cc823ee34820bff4bc80e6bf25517f8
MD5 54881f12d0809d15cdf7e348a603a8fe
SHA1 d0029de7981a9b40e4aa56eb087f2e74d139aae7
SHA512 c5ba6a4f5bc32f33e7d16c0d9d7a245506395c89f0d0f88ec7551a9ccd43ded3519d70336f4f681d9bd3b46285a805f8d3e2bba1cad7fdefae636f8559464b93
TLSH
T16F21A664F4A6C8B3FA3369DF952DDAD208A437BFAD5CAA08230D42186FD5836CD154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5321b4c5f5944b3bcccec4ec2d71b80167484bd6545d5258835797dcf548514b
MD5 079eab55a05978154731a084d440bdb0
SHA1 2acc61d6d81bb4b36a75a160f6d28d2bcdce7e77
SHA512 e1307ef5b36d6ea4f64f552840fcfd90006e43ecd4ff702e82255371bbb6a40a1722bc66828dbead1b7d94eb496db3c790a2310c7cda62a7b4107c24f4e717bf
TLSH
T1A011C854F4B6D873FA2329DB952DDAD20CA436BFBD5CAA18230942186FD5836CD114D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1788-6-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/2396-1352-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/2396-3613-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/2620-33-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5088-3257-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/5088-63-0x0000000000670000-0x0000000000691000-memory.dmp

Download