30f5ee615e0bca1aadcf8a0a3b812336ed7b500df88238031f9f5059576f8051

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
Size 18.6MB
Sample260810-cl2vsade73
SHA256 30f5ee615e0bca1aadcf8a0a3b812336ed7b500df88238031f9f5059576f8051
MD5 a216c390e6150c79ea1aeefa2e515f1f
SHA1 0be5adcea109666ca66c6732cc03e400c35be28d
SHA512 7be1b3fa76a5aa2c21979e328c2b6fe688fda62ccca53a9863aa92fd70b28ca2f0b94708a0fa4b96ff2b8fede31afbbd01bdbdb3209eed41408dcfae0500871d
SSDEEP 196608:vBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiZKWQc0gEYnvLk:dcZEIvw
TLSH
T15F178C01B7908035F5B319328ABFE339957DB9614F688ACFE388072E5E716E1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
4056	svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe
4212	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCACCBAACCCBCCBCCAACBABACBABACACACABCCBAABAABCBBCCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe"	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCAABBBCBBBBCCACABAACCACABAAABAABCABCBBBACCAAABBCAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe"	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5492	sc.exe
5092	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	cmd.exe
4292	cmd.exe
4308	cmd.exe
2996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4528	schtasks.exe
120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
4212	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
4212	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
4056	svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe
4056	svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
Token: SeDebugPrivilege	5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
Token: SeDebugPrivilege	4212	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
Token: SeDebugPrivilege	4056	svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2996	4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe	92
PID 2996 wrote to memory of 4528	2996	cmd.exe	94
PID 5896 wrote to memory of 2600	5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe	95
PID 4772 wrote to memory of 5360	4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe	98
PID 5360 wrote to memory of 5492	5360	cmd.exe	100
PID 4772 wrote to memory of 4292	4772	2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe	101
PID 4292 wrote to memory of 5092	4292	cmd.exe	103
PID 5896 wrote to memory of 4308	5896	svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe	106
PID 4308 wrote to memory of 120	4308	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a216c390e6150c79ea1aeefa2e515f1f_amadey_elex_hellokitty_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABABCBAAACCBACACBAAAACBABBAAAAABABABBABAABBBAABCBCBAABCAABACBBCAABAAAABACAACBBCCACCCCCCAAABBBACABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACABABCBAAACCBACACBAAAACBABBAAAAABABABBABAABBBAABCBCBAABCAABACBBCAABAAAABACAACBBCCACCCCCCAAABBBACABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe" start= auto displayName= "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe" start= auto displayName= "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCAABCACACBABCCABCAACAABBCABACBACABCBBBABCCAACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBAAACBABACACAABCCABCBCCBABAACABACCBBCACBCBCBCABCACACABCCCBABAACBBCCCBABBCAAABCABBABBAACCCCBBCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBBAAACBABACACAABCCABCBCCBABAACABACCBBCACBCBCBCABCACACABCCCBABAACBBCCCBABBCAAABCABBABBAACCCCBBCBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAACCCABABACBBBBACABAABCACBBCACCBCBBCBCACAAABCABABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 015bdb36611a7b4ef32e469867350c469e061575c3359209ec1612ddf94adaf6
MD5 346949584641cf00d4642288cc59cf32
SHA1 c13d88ad817b0645a8c1989e297a0d40f9e155d7
SHA512 f3106dd491ba20e6f2dad84caeac3be55eac2d5bbd74289a5948413c7446722ede50ad9d7abd5a741a88ca465cd3efe44929c78818281fe6f67305f9e8f1f31c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 829e73640d995a04fd04fc2a9ce52a721e0b990d1fdd93bd6f41d136e0e09c92
MD5 f63464c01643489554555593abab2c27
SHA1 6ea33ec60cbe1e60b0ebf4557df79f244c133a9e
SHA512 bc88057241e82cd9472ac60d68427c69cd5b8b69701db665ee7b8d3a2ad0221817bdb1dcfd086d91cd4c9fd849ca3bedba49ef7428832a0f3420d7b3c5afa7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 3a1818961a5c0955895a19f834345eca0b13e6a86d71bd39bc5e8a2dc30447f6
MD5 b45fd0d3389f25e4559f5a9b47a44775
SHA1 c3f160c3a7bcbed49af6ab818142b62046ab0272
SHA512 11e3f7872634722398ebfc36ee920b9e607a1f68dae7be0e442e3e0422afa09302559ef03cd393d17c44b03241bff3a35c0961acaee8090c503eec91b81de5c6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.2MB
SHA256 478f75594bb114e033971ba0eefa80fab83a1334130dba4938581682ac179a8c
MD5 3bca2c0614a6a21c5c7df3018ef7aaae
SHA1 f08ee83a014d1d57e188031bb68cb4224eb7bc70
SHA512 f05536f4dcdeab105cbf108a4be5ef25cacbf4668300d0afcfb7b211688d6d85b62cb73dda1b59a15d03652e84436b587126e8bf6885b6618524150eaafd172a
SSDEEP 196608:vBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiZKWQc0gEYnvLDgZ2jo:dcZEIv+2U
TLSH
T11A179D11B7908035F5B319328ABFE339953CB9614F688ACFE388072E5E716E1A935717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 19f002a67ce83e4dd3ca0f4d7f9e8edf2c817a934e9fcd860865ee76ab91cddb
MD5 19086d2181f3e98853d272eec3929440
SHA1 dfb52d4b1eb2da4a284f11a316243b8d4553dc3a
SHA512 172e15409f448b7d4e42dc991406f880af65385c1873ddb05eb1a83a2637dd30a54b18030fabb964396a885c7e171f001442da74e70e834475bf5b80f5bde66a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 76dbff84bd5755510b331040cbee386284201e3698a773b432a9952ce2291ccb
MD5 3054421c22d94ae28b1e0178ecb0ddf8
SHA1 6083b617afe09733d82ee418017d9cc32cfcd354
SHA512 95c2ebe2635585cd90d34e9f4a57f5ce3cca2050da3ef8808d2e16097100bf6d252c9c2b0d9b49bfeaf738bfefa66d36f942d76efa3883c87553b94df90210c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 2fd2ec888a565e8f26674d2cf49ea1a8fa59f9c12e794ba7329736b8371024c1
MD5 0c2e7f582bc1ca055a35ce0fdbf61aff
SHA1 dc26f952c7444b3b0266c8d70a4803f4499f175e
SHA512 a7c3c3c3a0a0463c929febb17f1c629e65182b28dd4b4c6520faf605619ca24d9c9a96af5100200abb00953ac2ec92793b9f56f70971a3ab16b61f6235b534ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 e870a2d2bc0a91e5198a58eb05ce7c1f346d81a0392488d355b10d278babfb4c
MD5 8cb74dbaf49e81783f5fadb68af6437b
SHA1 785535c3da7be04ed29210d66fc2fcd6d92adc4e
SHA512 b964031f7b4dd3887d602edd8b92e0af9d67fab4e6cf66e55dc6cb32c677c38faafca4d145cabf3c9028fe62a35585e50b681144e54a9fcfc8b96d2b592e5d93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\tr\qap`g`v~dtlq
Size 10B
SHA256 d71e780781b3ecff4feaa81da6c662c3a36c518ca6182fd702d651d50929be2f
MD5 81adb2ccca5d6addca779048eb56f1ce
SHA1 5ef8501931e66dde2c97732219bdccb84b723a89
SHA512 e4b97dff9c7d2a6e1f92ae9c3518362bb997d9205e16d828ba62423384701ab5d1342be3675d67d52d5f21a5fd007343cbdeb0a4b09407b31b5ab274aced2cf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9xv10wby.Admin\qap`g`v~dtlq
Size 10B
SHA256 4f9103473930dc84be9a1a73333a8ac476b88e78264bf5a8dfcdb91840dace80
MD5 5414d307bd8519745601a3f59b338fc9
SHA1 120f4d78b767c2d1775e41944200bf75bc7b6f62
SHA512 c4ff22a6e4ca57dbd60f5918e658c2fe8ccaea0c67b506ec29009ffeb645bd342357dcada4fe37f894f9e412577f86c117c871315de360fdfdc19cfa758668ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c82626af1f857505e102153d1953aa55bd531d2c9c3b80ab129cc698db14669
MD5 be9f457d5dfa7ec3512c1e8533575a6a
SHA1 a06ae4c5a96d31553d3a46cd4c9dddb2ec1be07d
SHA512 8ee89231f9a784d60021460cbdea254eb1c3884f91a33a345c7e95101fc84a30d9ab10cb780f0f8eba22e4aac3e469d0b39779993cf21449c81329b27ddb2f69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5abeefe6a7b80c7618218304a92c8514cd0e3871d5d1b2f042b50ebddf869126
MD5 7bd0920d9ed0c17230ec1d59dee19a4b
SHA1 0d0904449f3d9043484a7d9d96aa50a345196524
SHA512 dd9d1cdc62ee3243b7272385a94d4a5aa72e40b4a623eb623a71cdcbdc23d569eebdcc826764af29f7412bc58d150448e76b540fbc360eee145242ed6078b5a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e981afba898ebbeb516eaf88f61e57b7ef8fe882374fdd0f35b44fe8bf0332ab
MD5 ce50d8b2d6d7d0ecc687da304a0c7da7
SHA1 23a7152f7ee5059188523fe7a0692f5ae94da044
SHA512 4a1124cee10b4125db02230a6d6bd7c6edfa5b684d4b2d18c7794a1df215fabeb1abc91b3adf3f2083d4c9781d308eea21313ba819e0516848f98c7bb2db71bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc44c8ea051e16de2a988373dcaf0807321b46eb92bb3ac2182127f4b5bedef1
MD5 8177ba790f99351f0d952eb33799cccd
SHA1 a9496183fcdac88392aae3f788690760e7b5ffb2
SHA512 4f37fbc9aef27bf93755fb012380c8e7d6b0f30892eddf9b3650ae1a2291aa5ca3cceff686a676145096a542f2db4970567c3dbecb1855b655ade6543a8843d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d206d2a019f8fef179e2a8910fe009f75ffdad102c205e71328c0759b1e670d
MD5 886f23e71c1b086424d3c4dea66cb716
SHA1 4912e25cdc71b8346b30221e52daefac65bc0cd2
SHA512 5113b9dd85558a1e77b8cae1ccacedc33f2fc3ea63588880189ef487a82212b5c1a7c0d2eb24cb15f9b394b684af0a7c7f14987a84d32cde17ed96351f1101ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ab545de758bf6e7e21d2ab79cb19ffee0a68c237310e725896cfcdd8b847a13
MD5 202f04a04ff85d4be72436c21ebc1582
SHA1 c7126b81d2623b9bcb58906425d05ac630eb9872
SHA512 20ca9c7bfbf332c0620d376cdfd626e0ccea49258b97982327bde3fe427247c233fb5813b9c9b2f2e16369d4ce741f66dd1d29a023fac05b58c9dc22292b63b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7124a6b99b71f5ad24b2d38cfde3fc6ecae033819337cdc3b2e3ebe90f91273d
MD5 a4c7bdc5318c49fab2a335f36c6e761c
SHA1 fa834cab06afe4c5fea37019de2d6b492a7f9601
SHA512 0d372d32cb0506a4097d9bfb9cd4a906463ea7d5d2556e8661142e0a2c6ffc2d527be66f906257b3370f96b11a70c5ccbbd1cf1dbb6025822f2ad041364bba93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f0b06a94d0e0704778f32bdfbe1f3f2e3c99eab17f678dfe9c7040ccde1a28d3
MD5 54c20658bb50788158884ef2c862c094
SHA1 5c82582de025de81c7098bfa1d0f5fa255b50777
SHA512 d16a43ed95b360f0485fec84a5f6d1276644fe37a48ad6b5ad573f19d687ad8705bf4a70ff8a5561380270cdb1481e43e9968d77de186eacb4bbd1f055560fc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Links\qap`g`v~dtlq
Size 10B
SHA256 4a500bffaf824cad1e305cffbcc35c740140600e946a2d1575466b736b6c4526
MD5 201aa80fb7a90b1b776a71aa3515e115
SHA1 6233121416a84c04115f21db8cceaa4f121afbdb
SHA512 7683ab2f5b2c166b93dd80c6f54df88c2ce3a1dcd5c5f5f947c157faed9dc50878a6f6a6928b6ff864cefbdd9afe3f4c7f5db33b110198aedda1dad49bce3db0
MD5 SHA1 SHA512

Submit Download

svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAABBBACABAAAABCAAAACBAAACBACCBAAAABCABACCBCBABCCBBC.exe
Size 18.6MB
SHA256 30f5ee615e0bca1aadcf8a0a3b812336ed7b500df88238031f9f5059576f8051
MD5 a216c390e6150c79ea1aeefa2e515f1f
SHA1 0be5adcea109666ca66c6732cc03e400c35be28d
SHA512 7be1b3fa76a5aa2c21979e328c2b6fe688fda62ccca53a9863aa92fd70b28ca2f0b94708a0fa4b96ff2b8fede31afbbd01bdbdb3209eed41408dcfae0500871d
SSDEEP 196608:vBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiCBBBiZKWQc0gEYnvLk:dcZEIvw
TLSH
T15F178C01B7908035F5B319328ABFE339957DB9614F688ACFE388072E5E716E1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 574165ab561411a4b18cb1527ec40b79e317796d87d3cffacf10646912c5545b
MD5 87e19e59c4f15743aa0f506cad8b19fb
SHA1 695fcbf5ee97061f203adacf09eedb61fe6ca71e
SHA512 a675cfbc37a35fca57aa51df741c6158cfddd5854db8fec0d24d4c2c456282277dc3a053d4b0d23c5ad519d57e3889abaceadacc5e30a59afd3bfa42744c95cc
TLSH
T18021C656A4B9D817E933ACCB961ADA720CE836CBAC7C6E54620503187AC9C30CF594A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a7e20ed35ecd879c4290db0f8d77a339e2e9d6f756f4a36187ff6456d6a5bd5b
MD5 e3aff3abaeadbe51b4c87457712783d7
SHA1 40a134f54e45162d67d8b20651df9ba5e2285e8c
SHA512 380d957877ac271c85c64d838f3c6265e0ba868025996d85a5c3bb45a6e4a45e9048babbc4575e1dff2eb32289eca5c626dc54efcdb022300df03d8377ddcc0f
TLSH
T11821D656B4B8DC63E933ACCB9625DAB20CE836DBAC7C6E44520943187BD9C31CF594E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9edb529e45dbd2cb559f81d2ada884a7395a7c43ab87d0aeb315a878636b7728
MD5 81f7f4a8b150b9c23c5d0aa03c373832
SHA1 d4cdfca001d4a9b018f1923de03d6f9dcf30a4eb
SHA512 e11a16c0f475bd187fd85e57d7245d4b4b18c54359d33231ee55650f0aef446ef463624c69c4a4357c65a84955d7114e9db052fc6e3840b6a0a1c2abf06a3f12
TLSH
T1D911E756E4B9D817E9336CCB9629DA730CE436CB6C7C6E54630503187AD9C30CF554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4056-63-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/4056-3930-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/4212-1819-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/4212-3932-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/4772-6-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/5896-32-0x0000000000070000-0x0000000000091000-memory.dmp

Download