370f5ec5bfdcacc323686efd0d1e9c6c4f442b78295f9d033fe038d59661956b

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 8.0MB
Sample260905-ntzk6stdpa
SHA256 370f5ec5bfdcacc323686efd0d1e9c6c4f442b78295f9d033fe038d59661956b
MD5 4ad73ad20618c06d4515bd104c85e218
SHA1 5b8de12c2a064dfd65806d91cc76086e1f589f83
SHA512 e30e99f9fdcc437a294068208c1ee16d6370b5be2136092683c6afdd74e982c5b4fd6996fb4d606d3dce868a61822829ebf0c401e16086dcd99671b9757de204
SSDEEP 98304:sa8aa8aa8aa8aa4KjKWQckVgtev5mnlNL:pKWQc0gEYnvL
TLSH
T119868D49F94650B2D82701B14CDFD2FF4670BD208F128AEBF689E32E6933BD05636695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
2564	svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
5428	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACABBCBCCACCCCACABCCCBBCBCABCCACBBBCBBBBABCCCBBACCBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe"	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCABBAAABACABCCBCCCABACBBABBBABCBABCABCBAACAABCCBACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe"	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
5148	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1408	cmd.exe
3160	cmd.exe
6040	cmd.exe
3060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe
5172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
2564	svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
2564	svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
5428	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
5428	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
Token: SeDebugPrivilege	2564	svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
Token: SeDebugPrivilege	5428	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1408	612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	92
PID 1408 wrote to memory of 2716	1408	cmd.exe	94
PID 396 wrote to memory of 5524	396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe	95
PID 612 wrote to memory of 3160	612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	98
PID 3160 wrote to memory of 2980	3160	cmd.exe	100
PID 612 wrote to memory of 6040	612	2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	101
PID 6040 wrote to memory of 5148	6040	cmd.exe	103
PID 396 wrote to memory of 3060	396	svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe	106
PID 3060 wrote to memory of 5172	3060	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4ad73ad20618c06d4515bd104c85e218_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABACCACCCACABCABABCAABBCCCACBBCCCCBABABBBCAACABACCBCCBAAACAACCBBCCBCCBCCACBABBBCAABBBABACCBCCBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACABACCACCCACABCABABCAABBCCCACBBCCCCBABABBBCAACABACCBCCBAAACAACCBBCCBCCBCCACBABBBCAABBBABACCBCCBCABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe" start= auto displayName= "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe" start= auto displayName= "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABACCACBBCABABBCCCCBBBCCBACBCCABBCBBCBCBBCABABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCAABBBAACCCCCCCABCCBAACACBBBACCBBAABBCACBACBCBCBABABBBAAACCCBAACBBABBABBCCBCBCBACBBBACABCBBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCAABBBAACCCCCCCABCCBAACACBBBACCBBAABBCACBACBCBCBABABBBAAACCCBAACBBABBABBCCBCBCBACBBBACABCBBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACACCAABBBCBBCCBCBAABBABAAAACACAACABCCBBBBCCBBCABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a889e7b06c699669e5ee496738adc70289e9220286f13e568c0f179cd72e8296
MD5 80e11365bd4baae5aae95ea4d17b5fe2
SHA1 c59ad4358835e42b2fff111955163659c42a6c3b
SHA512 ac626f67ecacf5622bffe05162290c948b6f9d567b7c5a01390ab7388b7debb93c10398bab7ff3d19963df86603f0004a49f90fe824e094b8253c28e3f542213
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WwanSvc\qap`g`v~dtlq
Size 10B
SHA256 dbab0dfb732441dcbdd9475f97e7f89d2635fc56a1828a1acb1e1fad89b29fb1
MD5 bbebc732592e185eddf6892f702d6ee7
SHA1 cb06f7b7913ec68335655e3fdce3a827d761dd3d
SHA512 ee00cd074c6616f2e5e82964a991f358039cd814f2efe675bb5761d15b2458db9001ac54ddb872a75be892318490d7cadac8a09546a9259471c8071c2a8036b5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 8.6MB
SHA256 5432be81c907ee634571175485450986f6a9fed6af4c6cc3f08d9105399eda66
MD5 0dec6128133bb613ff91ef99646ed6e0
SHA1 62fcbd3d84fcf447c9483e6f77df6545cecb2bca
SHA512 35531c0813503bfb6b04823652098b4dd2598914a742bf03828cfceb90f96b1d6ea6eb60d456f00d37a5f3b13a24cc62e43f3bbae02d43e249931708b727ad74
SSDEEP 98304:sa8aa8aa8aa8aa4KjKWQckVgtev5mnlNLCgZ2Hb9t+2xY:pKWQc0gEYnvLCgZ2jY
TLSH
T1BA968E49F94240B2D93701714CDFD2FB4670BE208F128AFBF689E72E6A33AD05636655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 8c0ca462e8768b721768efa9f4c9cd56c78287018aeb5e5b35101597c504d480
MD5 d5d16798cbd6f1f12413544a8eb187dc
SHA1 07bc52d7efd7dc2a2bc9dcbe0b2a8017ad28432c
SHA512 779228f2b424bcb849b030c5fa6b9697071310005c37c2a9638119d37002ddb5fd037679b88b3307850deb65750b973bf6be88fc42fa60b2cc372ab30c9687ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 ed9176a80c60ea30db87c0d3894121308136024cc3a19a7b222918c1b9b18276
MD5 f7b14cacdd7590e1de8269fdc82363b4
SHA1 9b1b2be2d18f0cd953e296b0c1c28eb8ded1b211
SHA512 e8e3e80c4a39fb0a5b38175c7c6e0da5b03466de57e682c481e620301107e3911f5cc3839c7abc4591e8e6b4e07bd30150b2c33c3402f641d2f6407b4977d25a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 e5a3b660780f2323b21a8704538e0d3bcb1cfc006deb1402b59ba50e1c3dd9e9
MD5 dc9e45ac4b1b516648123f53eef1f9c0
SHA1 9a108d117ee004e77049f289a9da3c04a992cff3
SHA512 b7acbb7d1c5f17256dac997c0466eb48fc660c57ee4b04650ec6b2a3f26554ca6fb51a6c321997736344bf352a1389cb4515284f93c51b8f4fa028cd8a52913c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\USOShared\Logs\System\qap`g`v~dtlq
Size 10B
SHA256 8a7dc9beecab09841fddc67d5e6ba18a0a01c64f2633469ff26c0dfd0cf48b70
MD5 a82017d1ec5bb5641d56fa814c5a8225
SHA1 d999871b0cbd191c96a90ec6515de6f20cc4a462
SHA512 070ac7d4386fe2f859419274d7096a049679c8b51276050c8a22c4ad2059b1d5a47714366b1978dfe99b377e0559a89ff6dcaaaeffbd482b7bd88ab558ef1d65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 67ae26bfc2f6ab4b7d24c821c6800879d5aaabc1698416208dad75b57a67995d
MD5 14e930ab878eac64af43b5a70e31e012
SHA1 df41615a0e4250cc86ac0fece70caba4f4bcb705
SHA512 1c4b44991cb315709af61887899807f873ef17a358a6890338d74fb4e826815bec060d5060b8776a04f67fb6af9c8c53ec39a6fd4f0346fd986f4194eb2163c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 0d28f1f3b105ea4262d7c887bc9ef7554d1971bb385b679682db138b71769ae8
MD5 0c6eb006a39387a14648bdb98d8b8148
SHA1 8fcc5d6a1130950fadb6942598a6a67d3a33e672
SHA512 e489bc3b4b6761c56d48ce40cdcd091b73540ea5f7a509be470f581c46c1dade770e003122e931613aaefa166c8d4366cc928ccc4d9b36837508e9ff19bf05bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\qap`g`v~dtlq
Size 10B
SHA256 55691639e71ad18557b3efc54e8f02e4900c0287242fe75b5eb30101cf138170
MD5 9f6b0841146764fb692415335f2c72b8
SHA1 ed26674b515af43fe992641b9902c5cb995d8077
SHA512 ce0f0a2e900a66fdfc0de4e0dbc3747e0794a8c76b5331c3bfa91e4454aebbacc9b884e6db785ff8d0a3378ac7e2bfc79bc029049641c23726eb17819d7dbe83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6df6f1800e7122a28c6142fc1754dc48501e4bea4876f184f6cf9133be84c0b5
MD5 afebc5b383da6d63707b4a26fe60fd43
SHA1 a1c3cac9e2eeee74c3c0d7f0c04e46629d736655
SHA512 692eb1181714a51aface2f545f2e5a3916d4809f788347d7f09db8f4370a0cfa07eaa4711c804834e62530d03900d29cb1dc9713bfdcea7d8eb4ba8798dc04af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 731d09db764cece69228148b39ed24ab2e61c8ee5f0a2b6f203a113648173356
MD5 c089c0f3a94206a18c3187f3133b6cf4
SHA1 b5c729e45b2bfb33ae7f16f15e7da8c56aed518f
SHA512 42f560cb3ba52c97443c7e13b174bf74c80163bcbeef8867c63a28edf515769ec5bd322ebe42f296bc3e85626d9cf3c3f6e216832a43c43698476af28df4df53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c07c504a7c2bed6512858957303881fff92bfb2c73509f5cc8e136695422d9ee
MD5 235668886bfb36b631606ced0416fa16
SHA1 2a4c86fab60a3a0dc8f70d328e2f4181d51ac72b
SHA512 883a1a21fafb73c90eaaf0d987ad80705d6d51540c328cec2ca03e18a6391a3eb6c0e815337d79e5d7ace0bf390467105c0848d6d52bda72f1e9197dea162bec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5587f055f344f33b848e940956c7ab7d7c7510af07fef5a6c3bc4bd1943ece7f
MD5 b477249cf8b6623d98946b4baa9d3aec
SHA1 ca60c1a6fec9f72dc0b70dfd5a2e9dff1efbe6a1
SHA512 2caf8b45212efbf078fa1c7eda774d2538665bef2a890d2b3f315a4906b9e23604668f75b7ef2f0ecb1f588b93e4d40609f126670d3a06dff2a1183048036acf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b5d78286bad7301e3e70be6aa889e8311546860e9a42b5cd5e39a60f0265fe9
MD5 8a87881543bf7c9938ac74680c50399a
SHA1 98bf6b76eb28bb09e2f1fa99376633313ac23bbd
SHA512 0e8161cdfdd33aa2477c996b14d507f4bfdf56a8f509d9480d106ef1af9703de0767ce2f1408730bc3477e7de9c745ada4f1a78830772d7be4bf0bbdebd2c0b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 982c1d777a8aaee33a0fd89bc61b9dc7cf276e90cd70f206286d05ebda328544
MD5 aee68d78ed3dc1c7d470634b7587e699
SHA1 8c462a747a211d4edcc9b97c00307ff25ee77e61
SHA512 17dd2f908991a8b0526411bb397421583b418c9eaea6cdef34a2ae3a85c6d194e3986e0298638eaa417d6b492aec1955d2daa4a324e0c337a1c01eb70575b8d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f46b245f903efea123b22093904d597808584fb1c76bcf82a12258dbded7f65e
MD5 a8f010bfc30365c17fb594ed8974e315
SHA1 0b39eb840ce4101a176389e90ef45615136c3413
SHA512 f757d9b7c1f6c8685dfb0956bf8b340ce6c3974535280ada70858df038f52c6a572fb2b068842896cc8c406be6fdff4e819df33fee74b75802eeb1ea218249b4
MD5 SHA1 SHA512

Submit Download

svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBABCBCBCAAABCBBACBACBCBACCAAABBCAABABCCAABCAACACCAC.exe
Size 8.0MB
SHA256 370f5ec5bfdcacc323686efd0d1e9c6c4f442b78295f9d033fe038d59661956b
MD5 4ad73ad20618c06d4515bd104c85e218
SHA1 5b8de12c2a064dfd65806d91cc76086e1f589f83
SHA512 e30e99f9fdcc437a294068208c1ee16d6370b5be2136092683c6afdd74e982c5b4fd6996fb4d606d3dce868a61822829ebf0c401e16086dcd99671b9757de204
SSDEEP 98304:sa8aa8aa8aa8aa4KjKWQckVgtev5mnlNL:pKWQc0gEYnvL
TLSH
T119868D49F94650B2D82701B14CDFD2FF4670BD208F128AEBF689E32E6933BD05636695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0cf1891c395b9e54bbec942129f66e0a94186367365afc426609da42c6b5056e
MD5 0b7bcc7d251162ed5dd717daa08a42f5
SHA1 06b4c55a0b490b94c20b35768885207e974294f8
SHA512 705f82338e4d4a55e467ebbcb3371331f9227c548e01f9c5cb14db371d3246c52ed49d571f4e47b5168cb7011441dfb1acf44d02441c37d806bc20c46e1eef21
TLSH
T1D3214722F0A4CC93E232A8DB9625DBC74DB83B9B9C5CAB40130D4608B75CC359D158E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 88343616cb3b077589e87f4f0f70adb1832eeb74a020b7ae07bc8802e38dd2fb
MD5 40d57339950180bbfd31bea5fa5fa635
SHA1 82c2e7b0013658c4b8bc86f3dd4a24de5055f9c8
SHA512 fd0e7edd16d577b06896d3cb203d20ec7d13c9cc7c3f444edd5e0243b6f122a40f3da753f2ea6a81933140835831017d5b6c0df6a03e50e8469d34755f42a302
TLSH
T1E4113A22F0A5CC93E231B9DB8225DBC74DF83B5B9C19AB5413094618770CC36AD158E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6ef31d70f56bf341d8fcd5d4955b4aa189fd8be61f9312c1db4a68eb59c1e5cf
MD5 cc31aa0e7f745d1a39d9301d24eb0a20
SHA1 6c0b9700a2460f6e58444173db4e60aa9eb474ab
SHA512 a838c5a2785aadcad0490a322d66df3dce8bd5e2be372d3636c4a76637afccac255f077ef01ae47bedf1ac593b9e8d03a158eed748e65b89e79759c40d060958
TLSH
T139215E62F0A4CC93E13178DB5225DBC74DF83B9B9C18AB5413094618775CC35DE15CE6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-33-0x0000000000640000-0x0000000000661000-memory.dmp

Download

memory/612-6-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/2564-76-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/5428-920-0x0000000000640000-0x0000000000661000-memory.dmp

Download