f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Size 47.7MB
Sample260907-d3dd7aee56
SHA256 f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576
MD5 505f63f53ee06e1f737d225324912e40
SHA1 2ed3c958af735f89899a98aab1c068d4da88a1e8
SHA512 e38bfa3757303ba8d7e116b7384ee335a62611ed5184b2a7c925f79ddb6bf9ad0a3dd8e61be7f86ee64597189d884d78548623048eb996ffe897ad68ca585a1d
SSDEEP 196608:dKWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvLRFIF0wue:8cZEIv4cZEIv4cZEIv4cZEIvVe
TLSH
T132B74C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
4148	svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe
2092	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBCCCBABAACCCCCBACCBABBCBBCABCBABBCABCAAACACABBBCACAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe"	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBBBCAACCCCACACBABBBBBBCCCBCABABABCCBBBBBCBACACBABAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe"	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2392	sc.exe
4520	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe
4872	cmd.exe
4688	cmd.exe
4680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
2092	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
2092	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
4148	svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe
4148	svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
Token: SeDebugPrivilege	3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
Token: SeDebugPrivilege	2092	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
Token: SeDebugPrivilege	4148	svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 4660	2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	99
PID 4660 wrote to memory of 2480	4660	cmd.exe	101
PID 3928 wrote to memory of 4712	3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe	103
PID 4712 wrote to memory of 1828	4712	notepad.exe	104
PID 2872 wrote to memory of 4872	2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	108
PID 4872 wrote to memory of 2392	4872	cmd.exe	110
PID 2872 wrote to memory of 4688	2872	2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe	111
PID 4688 wrote to memory of 4520	4688	cmd.exe	114
PID 3928 wrote to memory of 4680	3928	svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe	116
PID 4680 wrote to memory of 1480	4680	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_505f63f53ee06e1f737d225324912e40_amadey_elex_glassworm_hellokitty_hijackloader_luca-steal.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBCBABBBBCCCAAACBABCACBABBABCABAACAABCCBCABBAAAACAAABAABCAAAACAAACAAABACAABBCBBAABBBBACCBABBBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABBCBABBBBCCCAAACBABCACBABBABCABAACAABCCBCABBAAAACAAABAABCAAAACAAACAAABACAABBCBBAABBBBACCBABBBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe" start= auto displayName= "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe" start= auto displayName= "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCCBABACBBBCBBCABBCCCBBAACBCCBCBACCACBBBAACBCCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAACACBABCBCACBBACBCCBABCCBBBCABBAACAABBBCCBCABCABCBACAABCCABAACBCBBAABACBBAACCBAAABABACAACCBCCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCAACACBABCBCACBBACBCCBABCCBBBCABBAACAABBBCCBCABCABCBACAABCCABAACBCBBAABACBBAACCBAAABABACAACCBCCBACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCBBBBCABCCCBAACCBACAACABBBAABAACCCBABABAAACCCCCABBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e079ae9dd2db39de90f743d0c6e248a706ee4a711fe15602a3a7ffe718d988c3
MD5 446ee6ecf3cf9ecd6883fedbd9eb0318
SHA1 8040ec934c61f77732680914ff38970a21d903ed
SHA512 a50776d649c9f928a877f31730e6183921820ce4a12dfa915ebc56397181fbc070756a59a24f5d331a651c53af7c5961f3f2ed374f4ec48894eef891a64458e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 fc64ab7cb7720819a76db3febbd21d71c2260502ef0c915b5d01b701d3d57850
MD5 568ddff359cba87e041d6a292c130cd3
SHA1 7267c3ee0508a65e5f941fd60dd4c09731af3e87
SHA512 84cf2bc7726d7e3e7134d5ba8a4aa19442210c810af39999034d2fcc027f86df353666c208072f67f6dd276272587f71eb1e19c56d8f0eb30e70104bdaf4210f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\qap`g`v~dtlq
Size 10B
SHA256 46557193703736d82f3d0b1678f7609a04cb4caf02381c72d62cb175afba808c
MD5 482f064d7a95306773cf44dd93737d30
SHA1 19ea4843aededf2177fbacdeeca3af6b802f0231
SHA512 d3984fc18bac1457bb67d488051fc610c7814f2433b6a71728caa956b1b6f41c11b7fd636b1ec9d3eb2e8c066c161d4fbef1e3d1e7461793f0fd849b877f5387
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 4038ebe2d95eb71601a3f03d5645c4df8948b48a3bfff0fd2616b00d236f9aa0
MD5 f05816f34208fbc1013909bf412250e1
SHA1 54af741e02c8b6935b4c699cbb5dc7cbee2fbd3b
SHA512 ba885d38f1b4b526fe09fe3008868af3c6ccb635b311c3ead1301c3b123c850ca3a8f77d9cdab3f7bef41db5170f894d52266378829519e0eb74b3ad479725d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 18167e8596301e368da19136d79bd4d77799aa8f06ff12dde3874fc72907056f
MD5 7152e900b25b1897dd6903d53e694050
SHA1 47cb76045e0cf6ae42fe3c06772e046432dcf022
SHA512 ccd708a7503f5e0762c4b64745513f848019c2dc79107867065c1ec919a1f847d08fe4c4bbf5889c93d3b74a8c80d3145c73098c86f549400794feda28bcc7ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\mk-MK\qap`g`v~dtlq
Size 10B
SHA256 4715d812da82a1dd1175d02466c0579834aa51f0a7d760c4b682c480a1485e2e
MD5 12624439a77c7e8099f0f5346a533b6c
SHA1 b9976c4af893c8159d0b5258ee17a9ad19863a17
SHA512 fe329383687218170cd254f3b6764d4a8f43e7746bc52c9478bc749b385987ffbdfdbdbe1f675e64425b05d4a9b9cf791aa34bb43c4a96df9f9086b086b5ff8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\doomed\qap`g`v~dtlq
Size 10B
SHA256 aa0418043046a0afb898c80a10af855156b00f2d1f0f3a0cf034dc2f17ae3024
MD5 bc324e9e23ca466385a91c1d9d7d2c2a
SHA1 22dca7d4151c9cb7cc9046bf77302cf87789ad12
SHA512 79deebaec532fda53e9c785689a1e1e0fb0a1907c49b6a9c42199a354877ca923b6e1f218c9f778e85eb707dcad5091457b8ceaf8eb6bb1e1b4d2bc55d6f7f86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 9e8f1b3aebefa5bd8d14889a482064e2e9f684fcb72e31af79946120b031b87e
MD5 ef76926ca53f61a6d780779929d2c11f
SHA1 05e98f083b8eaafbd31cbddf493b9d780c04a7e2
SHA512 e76e186f6dcd0f414b54de11e876a66f3d6eb73bfc1f3075ce75689c360ab144b0f8bb60d5f3fe16696feb6a66509107971ff2240c3de12eb8ad54771f504797
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32c769b56b39f0e2f29043892784a88dd0bf858bcc44b0d868bcb96bce567138
MD5 abd7b655c1ccffa1aa2641c24aeb86f6
SHA1 5033eab4bcc7592f372e7dba9e12358ba195c71a
SHA512 73e9748c73d2d40f04b640f7036d68cab62994fb06d467ac8c496172c5647b8dd8045e4b0ff6feb73775d451e16c5f50fefad0ba579052d2eef24032d5658f4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3125aca10b358c81914e63e4abcd7ecd5b9afba679cee43214a1af2fa5ff144c
MD5 c277a35d6166c9dbd4cdbb5c786ed43d
SHA1 ae5e766c35852374a3c29c8329bc1771f71f1d11
SHA512 65956271a4fc8ab27e512c804de269f700c93a3e4460ee1759ac9607d141dbf77d990f77cafa85418bbe854e07539c6dbcc5215d768a7b1c3d734da6335170c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d17925436cca92fb7030693448f0b8c25668a043ba865c59f14938a7035958ac
MD5 eeecdae3a2c7fb6c5b15d5b865f60af3
SHA1 e28832ce1975a4e8df287badf4918b199277f714
SHA512 121a97e85d02878fdb702f5dcba232e28569e294f7b2bff39a9af131737b373a938bd00093a1d72171db29f317f79c531f9d833c4fc289f2e105e9b42b38eae1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c7d0b81bee53c0cb5393af2d66d3ae77ac47cfa31a4608a20cb5d922e2def28
MD5 2bfcbf51e292ec96d98d936ea6c56bf3
SHA1 c340a59c70aa5f4bca806f4e4f4e3d94cfe439e1
SHA512 d0d03f91c297fdaffee256ecc3bc0f8423550f50c731cd777670c8d5d4c8911736f91c04f0cfd81c78bed3125a47d3f22ef5d8ad8bd17bb42fca5c192ccc69c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 420eab0c931017896cb50691b1003b9f11f8acc55bc22d5ff40b106da3389a2e
MD5 cfa457c9a334a6377622327cfab7c138
SHA1 d84cd67d9594576aaab9f57302443ff72ffbea05
SHA512 0d6b54b52fad70d1873652df1adbea696885714d122cd4ed120fb30f70a303516c5ad2f0f66258a8c070c70d0e67a0e1ede768cd913a1eaccc04b3882e3c71b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f0013d1fd40b74cda46ac75c1a66b7dbc070af04880c7f31f4a971f4c087a0b
MD5 fcd9f5ba607e4c313bb27ada491810a3
SHA1 a6e10d251f8d1cc1ea11d0a9ca20994e4ddbde34
SHA512 f7572f3ccd1e0bd5f49f8d3bd4366cab05e188723e9d9b63f87169b57d31c5034eddc332389e0e892390d91a26d4968076089904889ce54f1cb46da1ead7a347
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 96c0c8c31dc86e7e10be25420e5cf825597092b5699b4c418bf5bea1405ac0aa
MD5 6e901e009285bd4c1ce1cbf6da0f778b
SHA1 61f5bfe83dc896a840a85c92e5014bf2b0454866
SHA512 f6c4964a4e11048682e7781ddbf8b74c1eba6dc8f327d25d97d413ff8f998b53a97d6bbf89f45c79dc1bbc79d4f5c955e06adf84169bdacc047f38fb412db510
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 445cbbc1f1c269026dd3f4fd0a0f7c11340baf25ec3f780551e023954e9ee548
MD5 64c0e5ce3b4a0cbb334913d0543d90c1
SHA1 a5be6d93e020bc4260c74a60b8a258fd8ac10c05
SHA512 c5b7eca305af5d0863acbaf8e6f85df5d730d196cb2a9480991c785c4e227bcc72d511156ee310acd30ae4f27ba697c1f1f0d317cbf6e393056e737d1ddc5cd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 52fe87d345ee9b3e9d17c7bda245a847c7b6f1651497c59ffae77e4f13411bea
MD5 a12bf0cc36e419a4b7598b9f6457aa14
SHA1 d959db477410b1b63ea5f7693898eb3cd72e0ce2
SHA512 b03e418ba8fbbb06d940e1c85f2c6b59c677069fc03abb4739f247b32258f1cbed2ee0de7df932996578e779f11647b3b85fb26d0f9e477e7b7f9367c567b942
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 abff8b62ab8e2d33eb11be291f41bc6522e945a2e625f2a3a4db9efb17c10bdc
MD5 bbf4994219e166e2cfaf888ce0e72799
SHA1 8e92ecb0853a6e1999a1db2fe78ace23e6b1bdf2
SHA512 c1d1d94b1fbef64bc81b55753eb510b01be44edf5f6afc026321a153fcad8bdeec14f99e9b643b1702e3c40ae5e68b6aa12dc57cfae1ecf1cafeb0be7f99fde4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 be9bde20950fa16dbe2c2ad7cdc2e3679108fe9ffe37f29a58752cb77f48076c
MD5 07dbc2e3d8e8a5625916cd82c75e3b48
SHA1 0f319b5e1752aa5ee65713b1261c7bb8d02a3537
SHA512 ddbec9a210e3f45fcefc7b2129df5cbff93228f787435508edd0dee8a6dea53bf557ccadcc518c55b3f7e11c5956f9109d9df9051ec09e4c5b986b92c84f3ccd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ad11e910212e10c059c02bb064482f10212a84b245d1f0acbde6b10402ec4bc
MD5 ec44f2ac739fac54e58f6e2a3eb496ce
SHA1 026a7a22586e132b64a54fc76b299223b0a1671c
SHA512 6c58e6417c4ff264e7e7c4805096154fa6d3e1c2b2ab1b6b7b74d333e93d950f8a2bd446cb6962cb85c3ba46ec17d58bb29f5dce15c5c7bde9533e4bf46be2f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ff76515cfcaa1449ed9576d6eb6354bb766d8a49cbdc1c08c706aa090a2aa64b
MD5 67d00a8b6c6ea680321919b255ed888e
SHA1 5d66ec2177e0a216c3b6bf9ebf343c9627bc0823
SHA512 8a217cf372c461c1b1e6bd472f7b12be2fe26043842a7c32e2c9e76f6d042f23d23901d8fe8a8e0955d2b340a715d150a5232632fa7ca1a8613593085093c0b1
MD5 SHA1 SHA512

Submit Download

svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACBCBCABBABACBCACACCBBCAABAACBCCBACAABCACBBACCABCCCA.exe
Size 47.7MB
SHA256 f1d3f55e445725afb09dde539b18ccd3d93c3668cf137fe01262fefc127dc576
MD5 505f63f53ee06e1f737d225324912e40
SHA1 2ed3c958af735f89899a98aab1c068d4da88a1e8
SHA512 e38bfa3757303ba8d7e116b7384ee335a62611ed5184b2a7c925f79ddb6bf9ad0a3dd8e61be7f86ee64597189d884d78548623048eb996ffe897ad68ca585a1d
SSDEEP 196608:dKWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvL1KWQc0gEYnvLRFIF0wue:8cZEIv4cZEIv4cZEIv4cZEIvVe
TLSH
T132B74C09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5B6923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d079840226e07494cfd40204ce1cb4b22b67ba41229f11fe743488c3df9e5ab9
MD5 520b831a1a0a3a808dcad0f998008e71
SHA1 e9f3e0067acb73d1c70fb21011be958916e98d53
SHA512 e24b06d30cd8f706f51085732a8e80f073a9e3eb4e524fc45b2ab32fe02f96d64d0ffa72e116bc2d0ff6867f8437ae1d9023e700cc0ca55f4a14b5cb05c96e32
TLSH
T14711EEA1E0A5D823F1312CCBAA1AEB570CD43BAAA998EB185355831DA7198374D160E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 19175abf89b31453897b33890718e604ca53e833e6d6aea629fe6d545fd30d9d
MD5 6d9631d5482e16b1834b3c66955e014c
SHA1 7ea9bbd0b4ec2fa736a5b64a3c8b1f923d3e9224
SHA512 3173fd245d179312ab61b54d5fc2f437e02b55e8af08912e2ac559ce7a95a337f9e7aec9ecfe5c8adf849c60ffac605b5f5c7b9cf936405f4f7c52e14d59be7e
TLSH
T14721D1A0E0A5D423F5312CCBEA19EB971CD43B9AA958EB186355431D6719C374D160E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4ab1b14dafde567e912787683f8df9bbf91f5cabae17db6499e0a5a8104383f9
MD5 80a8eb2b2e97f64e5ace23477bff689e
SHA1 dee5220ab760fc6ea71b7c5412a2072c4d3fa475
SHA512 b66acec3228c777bc5bcb41c9dfc991797ad10a3e1d7e6a66159e560be064e9cb0f0362b875c7cb0ae46f9a38765c648533c0629627f1075328d0ebadbddb3b6
TLSH
T1AE21BFB1E0A5C873F1211CCBEE19EB970C943BABED9CDB1852598318A7598374D160E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2092-1232-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/2092-3040-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/2872-76-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/2872-71-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/2872-50-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/2872-23-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/2872-10-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/2872-2285-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3928-67-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/3928-43-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/3928-91-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/3928-1231-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/4148-3038-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/4148-85-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/4712-77-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download