6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 30.0MB
Sample260819-e5hblawgmd
SHA256 6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999
MD5 bf07239ee40753220c4cf349d4afaed0
SHA1 5c2239e78a335c359fd3295ef059d29c118ea772
SHA512 8cae4a6061c1e393c86a989e518504fa7d504ccc4ecefacbc18128b0edb7d9ea35c0ed07b18b376534396e11957fda12ee4cd1325a2cfe51f569c2f510094166
SSDEEP 98304:A000k000k000k000k000k000zKjKWQckVgtev5mnlNLv:0KWQc0gEYnvLv
TLSH
T1DE673B09F94340B2D82B01B04CCBD3BF4A70BA258B129EEBF74DC76FA933B916525655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
5240	svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
1672	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACAACACCACBBCCBCCBCCBCABCBBCBBBAAACCBAACACABCACACACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe"	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCBABCACCBCCABCCBBBBABABBBBABACCCCAAAAACAABACBCACBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe"	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5324	sc.exe
4424	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe
4552	cmd.exe
6048	cmd.exe
4588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3460	schtasks.exe
1808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
5240	svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
5240	svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
1672	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
1672	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
Token: SeDebugPrivilege	5240	svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
Token: SeDebugPrivilege	1672	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4588	3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	93
PID 4588 wrote to memory of 3460	4588	cmd.exe	95
PID 4408 wrote to memory of 3308	4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe	96
PID 3688 wrote to memory of 4248	3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	99
PID 4248 wrote to memory of 5324	4248	cmd.exe	101
PID 3688 wrote to memory of 4552	3688	2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	102
PID 4552 wrote to memory of 4424	4552	cmd.exe	104
PID 4408 wrote to memory of 6048	4408	svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bf07239ee40753220c4cf349d4afaed0_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCBACCAAAABCCAACABABCABCABACBBCCAABCAACBBCBBCCACACBBABAABACACACCBABABCBAAAABBACBBBBCBCBBCABBBCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBCCBACCAAAABCCAACABABCABCABACBBCCAABCAACBBCBBCCACACBBABAABACACACCBABABCBAAAABBACBBBBCBCBBCABBBCBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe" start= auto displayName= "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe" start= auto displayName= "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBABBCBBCACBBCCBABBABBCBAACABBBBCCBCAAAABACCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABCCBBAAAACBABABCCBCBCCBBCBCBAAACBCABBBBCACBBCAABACBBCCABAABBABABCBBBAAAABBBCBCCBABBBCBBBCABBCBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABCCBBAAAACBABABCCBCBCCBBCBCBAAACBCABBBBCACBBCAABACBBCCABAABBABABCBBBAAAABBBCBCCBABBBCBBBCABBCBAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCCBACACCAACCACBABBCBACBBCCCABCABACBACBBBCCBCCCCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 02808048e12b1756d6087973d0125bcca01746e5369ef190bb75ba076ec19904
MD5 45c02072078fda80e7a0810d00b03bd7
SHA1 b89453cd034d0f584426e47890f14472162b98de
SHA512 0da186b82ef864122952d6f4fe22dc52d69a49a9e2141fa0aaef908b77b67ba9b570002096ac7894142dd0a96e4d656eda9c4599dad53a0b87e7ec835dfa519d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 2453d77065033dc3b56131d9fb820a01894792664dcd82c26fad7eae93b74e17
MD5 e9a8dc280b81d74feedc1cba1838c000
SHA1 db63eb07f4458b148333f7d01233a533b9a5566e
SHA512 d07a7681fa2db00724f8a823b9a7805d3a0984f80d19bbe525318cb132a88af67a12fa21c8f00eee097031cc4937245258f59fa319c255eab49ea0cff623071a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 6084592e5acc62676d624b8cb3139c1e8dfa4769212fc9726e2956525ab5b997
MD5 57f5d956b1568581b7258aa8382c2e04
SHA1 c5965550037c053c50bf3fa6e61b68455fa2e807
SHA512 a2e3a473d60481bf1688281dae4f4c2e47035600af367f918fea1ed06e40acb40e5d86b8883364633c905af9f288ace0dfde03b9c646b176be8a5910c69b97e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsAppRuntime.CBS_5001.184.1607.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 86eec3589e23abe3a03a2bdc2ead168c0aa0e43f9b83a03f02b52609bf08cbcd
MD5 d1a4ef00d8256fcc0bf6c240e82d4076
SHA1 9915197c6d1167df5487a82da898c75a85acfc6c
SHA512 cab53d691990ea60860c6e5c974155679a028f9cc488502fae0e38cefdf205dc376bc60f82dc9f1feb2abfda1105a2d7af490cc0c500b93cda7c14c7a1e347e6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 30.6MB
SHA256 b2accbe075787d90cc7619ce1cbabb6d3d7d5b691646004f18b6c57b56fd5279
MD5 80b383a93eaa69c90993866ad7f3bfa3
SHA1 b30d075b061e895d4e29296a8ff6e15adff3af72
SHA512 3c5274da4b328f28513567a5036a8ba3b48719294c7fea900b9d3972496337456363d0870ae355b55bfd5f3e8d46c80a9e3797adc7356616170c7622209fcbad
SSDEEP 98304:A000k000k000k000k000k000zKjKWQckVgtev5mnlNLigZ2Hb9t+2xx:0KWQc0gEYnvLigZ2jx
TLSH
T1E7673B09F94340B2D82B01B148CBD3BF4A70BA258B128EEBF74DC76FA933B916535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 4f79f2388c917126d70f5167a6d7f3d20e8cb4e0f8b5dba9a44396f70df72229
MD5 ff6367e32796d51d50894c5d3880e0ae
SHA1 7a05432e70f3d876fc21f524d293cee2defef22c
SHA512 394d083fa25a1c51f3175e10913a7182288e818f1748b61325ce02751589c8ea14b2e4d6d9553a0b37e032328d55810d785ba8e87397801e0c09fbeb3b84603b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 7628feea9a015041fb1eb11cc360346bb75f65abc8d3ede65102269d2e2432e8
MD5 36318f658f9b904b67c60faf5e102919
SHA1 edc77f586d66face995477ce1905c3c063e22520
SHA512 2d672612176ac61036246ce08a2e6b6c09436b78a28ed71e1c462e29dc85c8733c7f67101c90b4d908b6e60f3986295d822c1411def4a9f413771658f9ed3e6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 d0ba3f192cfef6391425f95fe8ccf4402835928651707777b0c4e66da074639f
MD5 6b4058b2e0f518ee7b9b1c94a6ae368e
SHA1 42165bde996491b8d04086b3e1f7a086ff1ccbc2
SHA512 0bb6eb6ff8422bf0057dc4631f728d99c4390676606f4a6940cf24c32073b61d3ec4ce7d93a197881e12b6d32dfd08dbabab32490440d8f9ab6ce8ff8dbfc73e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 bd76982068978111a58b25cb46be4b11a948101cf7a306e401a483ef4b751953
MD5 a190f6ffbeb7760cd753137d5a0dac84
SHA1 a8decd0aa62e5d629f26deb61de51c3358b0d8a8
SHA512 021d7c745c378897f120e569cdd8937fa9074cbd9db4feea7d1eeb1b411034557e33cfa94586cc314167b5e9f5107312420989d36d7892d22c6e65b4b903a1a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 46f399248f47cb66105bba92759552dfdee665d5fc364a68125c23a251ea05d6
MD5 0b617f5e343c647bc060b5e1b51acb27
SHA1 480e5d4e6cadf2e78ec30ef54e1323ef900ef042
SHA512 5db206697928832b6be3b2867701d187c3f2153f802afb515cfa18094e3a050247cc84a99c92081dd1e3ae06d565f8112bbfa8cf1febec8107c3cf162af1a194
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 f8fd64d383bdf7dce539ebef4f6819c836699a8345f8500aee3b3cbd3682f30c
MD5 8afc53f9fe39fec8133fe42db2090808
SHA1 dcd10814ad0f8205f556aee3c0051662a4834388
SHA512 3b2fc04cb726270faa9752576a032ca21f6e6cfc9a1bac593623ef1b48e399488745eea5cf2dbbdc79b4f1460f7ce4ba729e82afb90f6e10894f6fc73d79709b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 a178e8f03038aab0d3d228a47e8b17d429bb59eadb527f69dd39f2daf0b69773
MD5 bf050b4d5380f32857213ec41408a4c9
SHA1 24f6f70b478f045199e8b53cdba7731795f8e646
SHA512 17f3cb125aba1483b6c843ecba56131c1ddf6273734f8098e2caae1f823e80e78f59f2be87472b0f52e33bb88952a81e8ea9ba33b4b27ebb4eafa798417e2bbb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\qap`g`v~dtlq
Size 10B
SHA256 43f6412187f13123b36f1ea31de044a40ce0031e8cf5d74eb4a86209bbc7bbb8
MD5 a4c10d2e82496df7f9cb2f34f408a79d
SHA1 38e83c583a30e88b3fe2b7c069a9125feb12092d
SHA512 e581943c7494e1c5e0847a1493ca528d540f60e3736ef12f6d3bdb0e83d9376f2d0bba740dd61713e05cc97206f4dee19825f28cac4c4af27bb55510b457e991
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\qap`g`v~dtlq
Size 10B
SHA256 643ab8b41841dcf34b32be0ff5820b4e7160f5e951facd15abf97ced16c88a9e
MD5 6ca2c763eeb9a8ebf34bb9b514f2f0f6
SHA1 cb33c2ccc9e7052b4fb02e75ef3f8cf656127626
SHA512 8764af5e8ae4328451274f57b20167320b266ddf3a7a053d25b1e95ecd5d6e9f03bd053b8e91a6c6891b50b7c310b7e636009c5d14ca3adf4285ade5a7d2b71a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de819e5cbaa4fc4a020450d386c6740cf149ef0e8e01f547297ac2f6a53b37f8
MD5 6adf810ff7b6498ca80afccacf2e491b
SHA1 d6f3bb030e55cdb2190fc5f10ea1042a6f93855a
SHA512 1d7c0a9d08073296ddb426f388ce8734360240d77f92f50cf1b4b89f2dc71c93137f454aefe012cd315d105c8530f079440ef59b848dc9c99ce5150077db310d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eff9ce8db1c092f33032e6d709b45750b7845e325ccb8f31c0e82d2ccd5e5a06
MD5 4976aa4bf550722fee5e04c6695307ef
SHA1 b67744cf912f603486c88dff200360fba2b66565
SHA512 86c3345097ea140319f312d6ed39b82ec5e16fda9496fb298308c63d8d8e952f7db73b190bb96cc932e099e04164851eda2bb9c81b72f1507437f1dcbb778cb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d94aa01388bfa17bb17b282ec3fb9193b59d391f1507ebce937fdfacc9b3092
MD5 1f0e0c7a2bba4e636ffa1b4526b34086
SHA1 e8f113f7ec1224ee4fbf6ac154eb3798b0fb7d38
SHA512 60ff332047dc230ba38da035fa77ae9db273e4b3e47decc9f142715dee16b3742c6f16d2696e5f3ecffb6ab0421fcc78d62e775ff50659fdff9b56a14c161d05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5db9ce3a30348a00f22636ff9f22ba81a60a1ca5867dfef39056aefc06b3203
MD5 728c7e2ebe543026f13ffe155c1b6fd3
SHA1 4e702a2ded900ef285cf17741828212642b007ce
SHA512 e375a4f31d5c34b218ebebc80937428dc7326802838e2ff3f52b18952cd5f864e57b9602a7c6758ec441c3d057ff288d829298b06d14e45b6d323dc6b8af9b9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 90e1db192b48e768ca0ed2e6001724a203f577a07898be9e00b88d07098db60e
MD5 88bb76e6c548748e7bb1478cd1bfeb76
SHA1 b057ecc6e0e52cd0d8b4979c38d7e1a259b8243a
SHA512 f5b6589fb1df7f4d874de958bcc9705cd833fbb893ff0878d0c289a7bfa8424b08a69b23a66e48ea7bc9fb31db86dc3160513b99fb74e1e5b8a1d00ecc6ba398
MD5 SHA1 SHA512

Submit Download

svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCAABACCAABBCCABABABABABABCBBCBACBABCCAACACBBCAACC.exe
Size 30.0MB
SHA256 6d5853af9108c303e063365c4aab95eb11ac1f0aaf898784ef3ad9e0d1070999
MD5 bf07239ee40753220c4cf349d4afaed0
SHA1 5c2239e78a335c359fd3295ef059d29c118ea772
SHA512 8cae4a6061c1e393c86a989e518504fa7d504ccc4ecefacbc18128b0edb7d9ea35c0ed07b18b376534396e11957fda12ee4cd1325a2cfe51f569c2f510094166
SSDEEP 98304:A000k000k000k000k000k000zKjKWQckVgtev5mnlNLv:0KWQc0gEYnvLv
TLSH
T1DE673B09F94340B2D82B01B04CCBD3BF4A70BA258B129EEBF74DC76FA933B916525655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 648f1f6a957854f5f067db3377ac6b654f15fda3d11e2df0eeb116b8bd0bfd23
MD5 2ccd38276883dc6eb094d5674e7440d7
SHA1 6cea61888adc7974fc74721cd35f39ecac122fa1
SHA512 af4010402e7f7d01ec3b2887cae7b9c3d951cb36403f9e931e3f9c052e15dae928219bf46b782dfa552463fe5d0a85a5be5c452df110f139cbf894f9ed06a0c6
TLSH
T159110410A4F58C7BF93264CF523EAB928CA4335FAC9CEA04134DE1186745DB2DE194D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8e84ca092d7f1f34bf41e4c1fa62fba9ffbf8db24f97bf456f279bd7b05e4a7e
MD5 09ac07dfbce968398b50845575209c9e
SHA1 bafe8183c49399088676b7295019fe20de8c30e9
SHA512 090790070ac8ca438e97dc3d4977322f87e793aa67c412886288f72642bf40316084fdcb4daa669da392f793603bbc8184d987419b7b62903b043544f62a137e
TLSH
T19C21CB60A4F5CC77F93264CF523EEA4288A4375F9C9CEA14134DE1186789CB2DE1D4D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-438-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/1672-3172-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3688-6-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4408-32-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4408-22-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/5240-78-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download