cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 20.0MB
Sample260819-esaqzsyscs
SHA256 cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359
MD5 d7f6da9ca184a55fffe52993b40ce7ea
SHA1 7dd654edbca14ac5414b7022afd89157ea5c619e
SHA512 cffbf10ae2b6dc0b92249abdf9da4207ec271dc13b58928d462e906b01b9a3c0c2ba3a5af700062e7c78a053ba1cfddf28d5080c5da8888f8f5ec62b0991eddf
SSDEEP 98304:/YYxYYxYYxYYxYYxYYxYYxYYJKjKWQckVgtev5mnlNLe:EKWQc0gEYnvLe
TLSH
T196275C45F94380B2D81B01B10CCBD3BF4B70BA158B129EEBF78D876EA933BD06625655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
4916	svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
4028	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAACBABBBBCAACBCACACBAACCACACABAABBBCAABCCACBAAABABCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe"	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAACBBCBAACCCCBACCACCBCBCBAACABAACCBACACCBCBBCBBAAACCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe"	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2724	sc.exe
1852	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3104	cmd.exe
1056	cmd.exe
3508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
4916	svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
4916	svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
4028	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
4028	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
Token: SeDebugPrivilege	4916	svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
Token: SeDebugPrivilege	4028	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1676	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3104	4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 3104 wrote to memory of 3268	3104	cmd.exe	103
PID 2024 wrote to memory of 5024	2024	svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe	104
PID 5024 wrote to memory of 3476	5024	notepad.exe	105
PID 4052 wrote to memory of 1056	4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	109
PID 1056 wrote to memory of 2724	1056	cmd.exe	111
PID 4052 wrote to memory of 3508	4052	2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	112
PID 3508 wrote to memory of 1852	3508	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d7f6da9ca184a55fffe52993b40ce7ea_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBCBBABBCBACABACAAACABBBCACBABCCCACAABAABCAACBCBBABABBCAABBCBBCCACCABAAACACBABAAABACAAACABBACAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBCBBABBCBACABACAAACABBBCACBABCCCACAABAABCAACBCBBABABBCAABBCBBCCACCABAAACACBABAAABACAAACABBACAAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe" start= auto displayName= "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe" start= auto displayName= "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCCBCCABBCBBCABBABCACBAACACBACCBCCCCCACAACCCABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3476

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBBCCCBCBCBBCCACBABCBAACCCACBAAABCABCACACCAAACACBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 20.4MB
SHA256 fb6d41b84917849fc9847621a1d355936bc4b76cc8f7e6f9c35c256d9ec91156
MD5 3ea79fb626a1089a04efe154302be25e
SHA1 18423626e3fe16cfcca4cde5d635a9fcae8ca081
SHA512 22d2433df78fd247e584cf0342820e6dfc8222a2993eb72d7cc54e9cd22d349bdc10efcf21a70567debbdbd69f6297ceb008ddceb8a2164d5f5cdcb35828dbc9
SSDEEP 98304:/YYxYYxYYxYYxYYxYYxYYxYYJKjKWQckVgtev5mnlNLJpio:EKWQc0gEYnvLt
TLSH
T19D275C45F94380B2D82B01B14CCBD3BF4B70BA118B129EEBF78D876EA9337D06625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 51a4defded0dcfd1bcef53b4f401009af3dbcb743f3911ec5d876d08cdca4704
MD5 29fb3f002625338ef3592467593c986a
SHA1 c5827f90482faeac441ae736ed66bf61be48ff8f
SHA512 8465a9976d820b1e903c05ead6feb9dcd35243f9d72d02b451a343214f8d275cb7f6fdefe0d50736839638e4c4c9bb7fe9921f915910e8ce610a66ec8bf2e372
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 c2f35f020493545c2d4adeef1562fadefb932262aac7b7a37bc7b36924bfc6b5
MD5 698615df70d5e97c2eaf9b1769e1250d
SHA1 a33c73479ca42750dd698522d866788f20c6b884
SHA512 761e60914f5f056fa6e1d79fd1c629e54c1af336fb99ab63f1c820af50b2cfc15bd23f76f844025de90f7c902e6b7e8b07294c3212515afe86f755c5f620f7b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 67e4940522435f2a9b6b692cc9abc0752c7b537ad0d908e5986280a8684d87b8
MD5 804a1f5667ab7b691e828aac1b2dd2c0
SHA1 6c03889036527b57cce42ea648fb7e72561fdc6e
SHA512 4565250941e5cd67b54c0fae49dee5a441e420a24de8c23216c9e2c4387c20e6de35152ecaae1abf7d26e6930f49b6f639f64c9fafece3fecfe7728a93424152
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 8c80013983faa0ba6398b9448ac2aff33cb29aebc08fe12299d97eebcbfafe10
MD5 c082edf58930ebaf9441413ab9881af6
SHA1 9711b17eabd12ed884bd1540706c94fc4b58489b
SHA512 d571f3a63df64609a462fe677cc8ed2ff2dbc1bbd9947d1045eb3f1c4b8b8f81692153606ee96b9cb0ddacb526156f715968f063c47d9cb8799492bc4f8874b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cs\qap`g`v~dtlq
Size 10B
SHA256 9e68ec9cf3bc153deae8dfaf961b423756b63eca0a50a88f01efe8ccb31510d9
MD5 99ca64842e1a4ecc3bbab623e3557d14
SHA1 37db14ebc53771daac2c03d1d2f1f5518344ab83
SHA512 aef5304a6272c48ade55d686ceab11c3cd4dedf02d9bd08518a481a476b3e5d19bbb69695f87851e58758e0afbc5f767764185491cc000d834d63a833b6a11a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 06f7aafe4580b205b10d254e533d6433bc71860d56d2286415ec69b872d715fa
MD5 03a09fb0d23b17e344d8047a9c01b50e
SHA1 bef2d47b2e6efd4c595abf9f6c7c9f702498d0b9
SHA512 dfa6049940a300c9b402d797b0f3a21112470f9c49b0936d24532534771c9d12e70dd02883634f13b218f6ebb30bf45a6c43b36149d69a3dd3ec71a4ba418731
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 bc15236b127025d8f4efe026a8429800ea35bb69be7302f9183e7634324fc877
MD5 79860bc6941ee4c2a950e08e520044fe
SHA1 c2125b4cbb24e07fa51fe45647229a7116b54649
SHA512 90b7f9f7a909ac9a76b880d939865c9de13c061aa6affccd6998adebce9f0ce2f8086b1a6ab7fb6666eb12435aca74805475fcf3c14fedc16bfddeebced6c95e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c6370290cedcc222ee4858fa9fbf006120e723cc596944799a4535e311ae9bf
MD5 5c40ec6c5d41632d74723a8446b29891
SHA1 1d7c2dd90288d54b41cdce815fedb8dcace5c23f
SHA512 e2093bdb2ef363e2a6d21dc2a72765b51caf23553a7dcfa1e162f27ae4ab047577aa496d890f8da823d8c715fd0a6238f9d5ecaafdbebd8277316bca869233c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c076d2e0551e6907ad3b1466d22eca42b12a93cfa503f5e576187f08a4b03b8f
MD5 85341d3f3951f5dd21288ac0c9c50c7f
SHA1 20a1cdfe7f6465b90738f0a04dec5b5b4085751b
SHA512 731c863277934a6977290acbc3ba0ab262b075243f045dae0cac0bf59812a3029428b8c38bc703c4c8e7942e9da6f46630b0b72e8d28eadb45a101b0b3155829
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bdfdce60e477a2e6d6405f3e2820be9fb36ac63ef886699ae48ced1a13641ef5
MD5 c804784bfb4b1859e8096b8db4936f06
SHA1 e703235adc6755453a028315c1743583911c2b2b
SHA512 74a345ced59e4305a2f85becde3c7b5c4f6e0bdc3499b911bddf17c5c7995f155d8fcd346c7798b1c472d6d189d22e92d512a5c6e1819d00b27a696500fde04a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 67d66388536aa87facc76a8fda8938a64dbeac80036a51159a7c62979054f723
MD5 fb93aad50167bf0a2009fb93860f464f
SHA1 f871a3690bda757a13ad66e73b8a30ebbb5a84cf
SHA512 16aa1dab8ba322ab98983a29d6623d357fa61e1baa66b43c97d9df4cef702af4f081f4793b27bc2381462910721692c3522781f77a9f4e6f32e9e1a7b850f290
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27976e4de7aebe49e35a03a8620845f08b2e45de6b8df2f203d5fac7b3495eaa
MD5 543daef26770cb09050f91b70d317ed4
SHA1 fa39d150f52c45b1ad6e6e33b6f171b5d187565b
SHA512 51b5de8af8b558205c0096ccb76ccc14a3ec76b31249901432ceeaee429cac1a339f6d37edc7f7a1aca3610457b1d6e4831916af0ed02d8090ca88e1f5bee933
MD5 SHA1 SHA512

Submit Download

svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACAAACCBBAAAABCCABABCCBBCCCBCAABBBBBBBAABBAABCBCACAAAB.exe
Size 20.0MB
SHA256 cf7dd24247731fa12b9a3779056c363ad11875e7ce6ccbfb6a2bd5a6392d1359
MD5 d7f6da9ca184a55fffe52993b40ce7ea
SHA1 7dd654edbca14ac5414b7022afd89157ea5c619e
SHA512 cffbf10ae2b6dc0b92249abdf9da4207ec271dc13b58928d462e906b01b9a3c0c2ba3a5af700062e7c78a053ba1cfddf28d5080c5da8888f8f5ec62b0991eddf
SSDEEP 98304:/YYxYYxYYxYYxYYxYYxYYxYYJKjKWQckVgtev5mnlNLe:EKWQc0gEYnvLe
TLSH
T196275C45F94380B2D81B01B10CCBD3BF4B70BA158B129EEBF78D876EA933BD06625655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 418b9139ebf12bfa1aba4e7f9abe67cee9236667f1b4eb18aaee6afe377d9bd5
MD5 4fe1b196f509c7bcab61bfa92fa20aac
SHA1 3635a19464b07b7b631e674ad03bb333cdb65d54
SHA512 e398f4709b33e0ee9fe227af02280656a8c7391cb4faea9d98ea0a3657927e966999d21e55f750251f70d8c1821993b6e6b48dd1e0bf33a444ce19a57222714a
TLSH
T1C0110821A4F5DC5BF93368CA612DDFA28CA4324F686C9A04134D63186785C71CE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2deecdbd05bd77b42ca5ba5c95d6dbe044ab46b85d9bd810d56f782564236a92
MD5 008844d44aa7834ef0041b4cfaa9600d
SHA1 adaff7750cd56d9a5fed4d413a3c6343d32b6c62
SHA512 fedfe2fa30560c25d81f1b9f1eb5b2553f76abbc5142ed0af91ee8c9b901e674109d8b9356d72c5cc1c1e5b290f650fe942bae5a21b8c23f47ae656325b5fe8d
TLSH
T12C21C56194B5C85BF933688A662DDFE28CA8364F686C9A0413496218A7C5CB1CF198E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 c6774baae67fd8de5cb30c93266265339e67524275b07f67b0114d401085d9fe
MD5 8dd6582a807ba959aa1d85e781d278a4
SHA1 6ffda80309a013efa2d632959fcbb16bc72d7412
SHA512 7d72b6038889aa2f39bc5bfdb741f90aeb181e090fb0cf060c0eb359931dbaba609727758ea02d2d0ce487a6e31821a69c492d1703adf49ca86e21c395fb5d0f
MD5 SHA1 SHA512

Submit Download

memory/2024-36-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/4028-528-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/4052-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4052-7-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4916-1072-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4916-79-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/5024-59-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download