e428c22290fc3034a90163501d3d35b90dacd02eb74ee2512970302d1816c26c

Analysis

max time kernel
147s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 2.1MB
Sample260810-ckqfcshl21
SHA256 e428c22290fc3034a90163501d3d35b90dacd02eb74ee2512970302d1816c26c
MD5 a9d4e193d909ab34f1b29a13a0e42579
SHA1 5c8fc29220b15d6e383a2dbc4f315af4dbaeeab9
SHA512 baa473fcfa96d4ffeb8b39ee65f1eea56f87491918caf25de00442725669f453ca3e6b4c97ce558fd0d351feff49464983f38a0546d5b3fa272c1d77e01a1425
SSDEEP 49152:U+EB+EB+EB+EB+EB+EB+EB+EB+EWKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjD:rKjKWQckVgtev5mnlNLP
TLSH
T1B6A5C009F98340B1DD2B55B04CCFE3FF8A64BB25C4228E76FB4ECB5B6932B215418665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
5532	svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe
4748	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACBBBAACCCCABCABABBAAAAAAAABACCBABBABCCABBBACCCBABBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe"	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACABCBBCCACAAABACAAABCACBACACBBABACAABBBBCCCCBABAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe"	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4380	sc.exe
4308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6096	cmd.exe
2080	cmd.exe
4648	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
4748	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
4748	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
5532	svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe
5532	svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
Token: SeDebugPrivilege	4748	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
Token: SeDebugPrivilege	5532	svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 6096	4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	93
PID 6096 wrote to memory of 1232	6096	cmd.exe	95
PID 5868 wrote to memory of 2416	5868	svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe	96
PID 4532 wrote to memory of 2080	4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	99
PID 2080 wrote to memory of 4380	2080	cmd.exe	101
PID 4532 wrote to memory of 4648	4532	2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	102
PID 4648 wrote to memory of 4308	4648	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a9d4e193d909ab34f1b29a13a0e42579_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCABCBCABCABBACCBCACCCBCBCBACABCCBBCCACAAAAAACCBBBCCAACBAACABBCACAAABAAACACCBBCABBABBBBAACCCACABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCCABCBCABCABBACCBCACCCBCBCBACABCCBBCCACAAAAAACCBBBCCAACBAACABBCACAAABAAACACCBBCABBABBBBAACCCACABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe" start= auto displayName= "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe" start= auto displayName= "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCCABCCCCCAAACCCCAABCBACBCBABACCABACCCAABACBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACAAABACABBBCBACACAACABCAAACACABACABABCCABBACBABBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b7005f6ee9076ac8b48bb5402a89ce4c0274a841459445677221c1009fd379ac
MD5 05550a0242eb376869141c4723c627b6
SHA1 f67f3317eead45ed32ad99fec90c7be82ea94a78
SHA512 dfe2752edf3398f7f94d5ed1b1a75694a4fc74e47f02363f930a4501ed06184a5b71c0b97d51012501d6f53191aa3b01d84f21b4ceb9f95f6dbd234f21c94a41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WDF\qap`g`v~dtlq
Size 10B
SHA256 dc62a786cd6d4fcd6e950d4c11e69a8be7a539c2ab26d2813390458c41fabcd4
MD5 cfd240685ce657f89ac706be0b16198a
SHA1 10f56704df9a87d773819fda3ad1d527b07052be
SHA512 9650a5d04fff498c04a94a8b1132da9d2166c481574608469a1057534afc40b56b3ca921a28b84d811400d7c3d2746d8fe02c9e7c155aa02008e6107bb5b691e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.7MB
SHA256 57383058122fe7f23dd836bc1b58a1182d899ae3baae1fced7d58f941fe19b89
MD5 793a0c602a67fb360c93b57d3fd16e05
SHA1 efeb58b2f92d1a298e33fd1dcab17f1ff59c7179
SHA512 80e82f799ec949a4d3ef1863fc5b1fa6d414d3205513fcac43a4effbe193a2cbb4a9a7a698b6e8937b40a4a09c2c2fa6e8f0a0213c5bdf4f8e10ccf57ebe78b9
SSDEEP 49152:U+EB+EB+EB+EB+EB+EB+EB+EB+EWKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjGgo:rKjKWQckVgtev5mnlNLCgZ2Hb9t+2xp
TLSH
T113D5E025F8824071E97A01B14CCBE3BE4E74FB2486118D7AF7CDCB1F7A32A51553A266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 30658265fb3033fc6dadfc317d06eea91944bcca352e41d3446cc3cf4c6c8fc2
MD5 762c019d40e773ce3679bc32d8879c07
SHA1 8cd5ccc2e1b6c06a3309080ce5530df915307b36
SHA512 650a0c878a99254d729902e99e6c9ebda6023463f234a80491510784b2300239a50666701ef71ed865b1f7d77a7fd42f5aaef75e828e7360ffe4d20f6857576b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 69fd3f9337f787263027ce74aa373b1b5155c6a549a6bb11466a3b11aff521d5
MD5 0b15fe5d8620024d00824ea238f1342a
SHA1 9fcacb27c2d315c624137020dc0e793eee00e2b9
SHA512 4d1d3b5d0f92e54041e0c3433356c4ecc07cc91572500a5c6f7480f46abe2dce64d470d3bf2b33db1bcfd75d504a28dbebb6e37e75f5acca360338c2f4849226
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\RoamingTiles\qap`g`v~dtlq
Size 10B
SHA256 23b4af7dc690022a97df0542bc81430bfed9f55c0c4a31eb4596b2c9d99d2683
MD5 75bee90e14b96806fdc340703710f812
SHA1 94dfec0015dec4fd7cc43dd96c8f9914728ad1fe
SHA512 3e23e1cb43f6c922e7073c414240957595a4475df58633cfc9ac38a1f44c1aa31a6a890390eef46f7895e5bad5fa023eaedfb488133356f3c5e9eac63ebbf12f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\LocalState\qap`g`v~dtlq
Size 10B
SHA256 dfc1060620d4580c20e80b8e1c5a77b44116d1f28cbb040f8f96334b77fdb0de
MD5 7b31db06b518b49e3e205200f408d113
SHA1 b74f8295c5114667b570bd647059f4f83ccdd497
SHA512 16b3ee1d214d9cd4b1b4af4ed72391bfa5ce3206169a2069e202f54c4eaae5b02d42126a6e6689d84bc785a934ee7d9b9678a801a96c536e203043e68411d34a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7edec18a17194e5a8c6a0a59089a4fdbb38a971589dfa7d770f5d49d044a7672
MD5 728744b18c9f1cf72c03e426d2d30262
SHA1 129b7fc1e5a11bd3a815c77ff6673741bafaa68f
SHA512 10a0d1b772afff0318840e98d4d836c75a12419f82dd6f7d3b0686196122efff6947e956e01b3ad700a95ff00d1beb2ab65142c5d95e510231c70748405b0fa6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae2bd1852f363ea197f4c0747f72eec53ffcc4462aea54c345106e37e09fccac
MD5 903d95434ac1e925f563fe0aa6d69e75
SHA1 f21072e1d978a25088e9b3364b2f233f6c0291db
SHA512 072ee6c924d9b7d6af20c89d1379ca5e26e02335d5e017cd71186bd61272b7f533ab0cfe8a4a3aa9a07f640fe27ee136aea8a86f8ccfccc06018ac139cda244c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f518fe10b3407a5a446a9855d1e7596634d8e10c9b32026aee99ec9e35c6d873
MD5 acc2acec5198ed9c9b12a30773d88635
SHA1 3f391083042b66bbec0f134b31f055f88a38315f
SHA512 60545e9afe46a523428542aecaef00d8de38f2f18bb1b13d0f02fbf29c93daf68334ee16dd5d336a108ec3d397d88758dc1fec5bb18ad0a9dceb609c88ca8f77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 117e01dee4a3047b1763b89540dab2e2165351c0e9c7c87b1fa6d7182e6a180e
MD5 9a1e0b8138e89c81364094d207f5bb94
SHA1 058f9a352e74834b7d1708f0acdbaf1e82a0bf7b
SHA512 78fab57c7f8bdba8876734a6abee9606159f4b5ca27356136ef41bfdbcb4cca025eceb5e6592f6d7e8ae968758cb151da00065d112498614da207495b63e8771
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 565d3d4e38d70d5e88dda4c5f77de822be578677f104c721d423093c808c889a
MD5 3e5ecbce125e07c37fb6d02bc4c3e001
SHA1 7fcfaa0bdf63fafc34364d4aba23ab38e6c582f9
SHA512 0c061e29c14de9d10750a43f73e46891455c00406f9dce6e4089c1d68c65eb89e127f55207b6f2d58613d1119b9f4e7d9a02bf8faedb8262f9a47401f14015cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fdb72c5aea10c8af4a0110e843eecaac818db5b675f6b68802816f185187ee96
MD5 23df0e6cc99277e80652e60ef5d0fa8c
SHA1 8869166701ec55a3b5b5d1426df5d91ad44aba1f
SHA512 cfc00ca9ad3b59c5e7b232eb7283b819af25fe06c8527a48487eebdde5a6d25e4203428f89fd3cb595105b5f9ff9c36154457e89594f4101ad27029ca2bf985b
MD5 SHA1 SHA512

Submit Download

svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCAACBCCAABCBCBAACCCACAAABAAABABCCCCCAAAABABBACCCBCA.exe
Size 2.1MB
SHA256 e428c22290fc3034a90163501d3d35b90dacd02eb74ee2512970302d1816c26c
MD5 a9d4e193d909ab34f1b29a13a0e42579
SHA1 5c8fc29220b15d6e383a2dbc4f315af4dbaeeab9
SHA512 baa473fcfa96d4ffeb8b39ee65f1eea56f87491918caf25de00442725669f453ca3e6b4c97ce558fd0d351feff49464983f38a0546d5b3fa272c1d77e01a1425
SSDEEP 49152:U+EB+EB+EB+EB+EB+EB+EB+EB+EWKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjD:rKjKWQckVgtev5mnlNLP
TLSH
T1B6A5C009F98340B1DD2B55B04CCFE3FF8A64BB25C4228E76FB4ECB5B6932B215418665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6fd27a2918b00d135b6af2a33b36a1c1b799dfe74e5308a594945a3a7123e9da
MD5 7b6e5098510432743664179f4312dffe
SHA1 777ec7d680a5c4b0a1ec40e6de4f6b412f3e7e42
SHA512 2eb69d5907cce722fb015339439185f6a32b8833bb38aba318b7eb3fb4007fa1b5d4a5e58cdf951f2cd214d75384a4b3bf7c6f6a54a44096524e046abc1bd667
TLSH
T1A411C16094F9D893F93268CB95199BE30CE4769BE83C6E1423098318BFD5C34CF558E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 dabf0488732a3e98ae886993e5f1e883f3d1b90739b629467f9467adaccf7ce8
MD5 3704fcbd8d951df22b461e90d78276bf
SHA1 9f9780733657df710d49d6cec612e639bf2f6bce
SHA512 1b12e6627f124c38f4f0ef5a7b077de3cd09496f0558e78ff440707031f27bd841316e7c1e1f72707764faaec9322d1ee0e22d5b5e8057e890c86dc52590a4c4
TLSH
T17721C36094F9CC93F93268CB9519DBE30CE4769BE83C6E1423099318BED9C34CF55892
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4532-0-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4532-7-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/4748-3097-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/5532-64-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5868-33-0x0000000000310000-0x0000000000331000-memory.dmp

Download