0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 10.5MB
Sample260810-df7phsdg47
SHA256 0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a
MD5 1b87ac30ad9cf75861a011e818685742
SHA1 d19da9953478273041c6d3be3159f7467af8b47d
SHA512 0c5ec20d504b1bbc94a8d1ae573d19141d7550c8f6c8e8a0adc1630e2a62e8a46e30fed42710bcd273e373b73aa4407e61f078628fdda76f5121ffe8fc3c3a27
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wqu:uKjKWQckVgtev5mnlNL4
TLSH
T175B67D14FAF60C62E1BB11B11DF6E67A0C31BB7A8128D55DF99E874F7833B8044167A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
5180	svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe
1908	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBAABCBAAAABBCBBBCCCBCCABAABBCAABCCACCCACBBBBAAACBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe"	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCAACABCCAAACAABCCBBAAAABBAAABCBCACCBABCBACAACACCABBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe"	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3616	sc.exe
2572	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1532	cmd.exe
4848	cmd.exe
1704	cmd.exe
4632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe
4508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
1908	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
1908	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
5180	svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe
5180	svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
Token: SeDebugPrivilege	1908	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
Token: SeDebugPrivilege	5180	svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1532	2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 1532 wrote to memory of 2856	1532	cmd.exe	94
PID 4628 wrote to memory of 2832	4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe	95
PID 2636 wrote to memory of 4848	2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 4848 wrote to memory of 3616	4848	cmd.exe	100
PID 2636 wrote to memory of 1704	2636	2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 1704 wrote to memory of 2572	1704	cmd.exe	103
PID 4628 wrote to memory of 4632	4628	svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe	106
PID 4632 wrote to memory of 4508	4632	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1b87ac30ad9cf75861a011e818685742_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBCBAACBCBABBCCACACACCBABABABABCABBBAAABACCBBACCCAACBABCBBABBACBBBCBACACACBCBAAAABCBCCBCCBCABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCCCBCBAACBCBABBCCACACACCBABABABABCABBBAAABACCBBACCCAACBABCBBABBACBBBCBACACACBCBAAAABCBCCBCCBCABCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe" start= auto displayName= "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe" start= auto displayName= "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACBBBCCBCBCCBBCCCACBBACBACBACBACBCCBAACCBBCCBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCCBACBABCCBCBCBCCBBCABAAABBBBACCBBBCCCCAABCBACCABABBAABAAABCCBABABCCBACACCABBBAACBCABACCABAACABACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBCCBACBABCCBCBCBCCBBCABAAABBBBACCBBBCCCCAABCBACCABABBAABAAABCCBABABCCBACACCABBBAACBCABACCABAACABACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCAAAAACCCABBABCACACBACBBBBABAACABBCBCCCAACCCACBBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3f70566ae8e1983301349a3d1a88b21d9b3fe4db075e48284ed9b89c8324ea9c
MD5 dcc30d5ecd7206ef0f45231de0e9c613
SHA1 5aa8f3f2c499ba9863f8ddd604b37f30951003c3
SHA512 466300256b2bc92cf4767de5b85420f033acfd92eeb0bda9751ae607c743ab3a0f1a9e29e298375ea6ab880ce0a736f87869dc79b5227eb0c1292cea755f8903
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\FeedbackHub\qap`g`v~dtlq
Size 10B
SHA256 6fbbfb86e825bc01437bcc1053a750cc2581d5a900428df7be104306fe25f13f
MD5 e512abfb9f669b67f04a741e1dbd1ccc
SHA1 9aedf9a5a5ef3db66b0159161c26e70a161dbc3c
SHA512 43a1c1631c06563db11dfae674b694492c52511b28dbc07d77d6efb1367c195fe1a353524a13e47ca693f3fe9a47419e1988753014544ef389fc9257e08c3931
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 11.1MB
SHA256 a75d1f10fffe10c6d88a394a2f5970688bc87cdbd46aea234a7deb6138e07226
MD5 ad32742ccff5f91ad8162ec25dbbd93c
SHA1 30c4a52bdf61d0a1de89caedbb1c0233026d625c
SHA512 98c73a21186f0644d3ba38a6e8caed1cab305a20d4350b3d92bba968e7bb850f3eacab412ac241e8e43e0144400b4ff364d40eaee2c18a54e56d54de6fcfe3f3
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wqS:uKjKWQckVgtev5mnlNL3gZ2Hb9t+2xY
TLSH
T1F9C67D14FAF60C62E1BB11B11DF6E6790D31BB2A8128D55DF99E874F7833B8044277A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 412a4a9ce39bab77bad4a21b87bc2519559d1b9622e6e3fe54872344e55d2d6c
MD5 e8f37cab85948cd7c8a1e0cb208f17f6
SHA1 5b8b201854e3955b83d7d9f01dd296ec53ddfef6
SHA512 acc3c0521734767b4d0c938d21a23819905e9ea326366ed5150e05f18e1a35b3e331ad5f6ba983eb5d9d9706fc8812d2b9a868d6a2690b5cf8f0b1af6b55b628
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\qap`g`v~dtlq
Size 10B
SHA256 31c0e4f3fffc433cef94177dab7148974643ba6cbc191091ddf543f6607ffb4a
MD5 15391181cb80ef47885ceb4eb064ce8e
SHA1 478e884986264d6abaed3b7ff217ed79e2613f63
SHA512 c19462bf28c8ec2bfbdcc9b5207377e149996b20897663a3f54f5e27439b6993f43e6dc5074752371d69dd0d9b3d5aa462187bb3535aaff81013019eb8df5006
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20\qap`g`v~dtlq
Size 10B
SHA256 74febeca3a87344abcf589c1cac0a97e19d30a7ecbfd60f1e4c1a51f7adb3c7a
MD5 e25a1b919ac45c7a9e917d7ec49bf17f
SHA1 b16998e79381fd0a4248cc80796d773cedc14f92
SHA512 f94bb2fd3813167450c79eb6c58360ff85aee21a06b8fb36b09a5bf8651d186f5dc819ba90305bcb9258c43dfd6bed26ed0b1c23a33a74a23ee9e5b95325fd4d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase\qap`g`v~dtlq
Size 10B
SHA256 2051a8a63f989cae385664074337370572338f48dbd94f0ae01b06132a264a97
MD5 de387a37b1e6b6b14c1d45ac6b4a51db
SHA1 3ac0f79f9162a39e7a7eb4f278d4d570ef0a8a11
SHA512 ace834d1bc073e247309b83ce42cf86b5f66660667a8f4e2757f35681733fe194109bdd47f415b0d240e0d43af09a722298f55f2bd948f0573b0636b4ce4c8ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\te\qap`g`v~dtlq
Size 10B
SHA256 6867144c32f3aeedfe36d2ae84a248fc719f622544886cf05195c9276308657d
MD5 394f1e46c0eaefbd40680cb1b968fcf1
SHA1 6c91083155d7cb17fb1d7ee7ce0bd44ea6240524
SHA512 cba7a668d00cd17298488487baf650f6a2eeca176e03c557d9d0eeab63658e07b7e80f5a11da20a19df14697dda2ec5aa848cd79a8abdc1c2a0f9853f9ab326a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\m5oo1zxt.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\events\qap`g`v~dtlq
Size 10B
SHA256 fd4aa2e2122f9a1d503b9640e73794c39ef4760e7c3b2e899dc45af730fe485a
MD5 9bcf52892634469dbadea80d6d8a2e04
SHA1 a6284846e53c3a795c257681117399006e2d0002
SHA512 46c065c4e44399500280bb6b698b39cdddb61e7938532207ce797f24e2dbc7abb3122d31881f70818c1c56855054a24a9d89916d25573b0fa20f5ddf5f67d518
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edd47d1f5ca1855a3936f06a1d29341ed5fcec6dfed0c57d388bc3bb79d9d7e9
MD5 761750a2750a9fe729cbde91950bdb47
SHA1 aea547734a3c0e58ba789ee2d994fc8ad510a054
SHA512 a5b1f93a21b6ebb99ff6975462d78b59b1e566642404fff09cd66f2fb70a8baf178c86546becd3c6b3ac7f9b2061b8cefa62ff336af34f34bbeeee14cc5f066a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9011075653ff0901b65ad7141ec09e0c9ec0d317468ee829d4a384bb5a01ac44
MD5 b83904ee436a2a101ef5c35ab118784a
SHA1 9f858cab96b9095c5aacbdf6b14c47d4a2aa012c
SHA512 88c0751a62bc27c3ac15514726db0738dc4972e30abcda99cb4f9ca687a523cb2252ec50ea17ed2f57345edc3a533f1ab5a2217e858b40fbc4c639a5e0a18892
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a1d5cf14a58dea705bd52c82bd81a2fe1a9bab73b8a9068936ac7ac5b6f534d
MD5 ee1cf251595240a8d360544d05b8a487
SHA1 58d38d529a62d29c14ad3c44be706af2cea9c8ef
SHA512 19488294e00b59ddf0cb0ad713f45a60ef8292d41b389ec085ed073817e89874867eeb1ab378fbd84b0d279477f78f630e4a5131af2f03239a6748adc9eb868a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6149ed9ea66c89b353db16cd32622a6fafc5673de1e728eefa817217d22a2af1
MD5 10ec186077461dd1afb147b6a31cd8cd
SHA1 da1d33edb7c887a93a3598ee37dfc60fa6ae0d0a
SHA512 abe41410b116eb1d6747e3263ae7afb87314eba61531a39f48974431c0760403ca04d57f4eff2610be90249c6b054f5f9e56f6329bbaeb0cf931b5ac6a254a0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dcad801d0f2ddfa3bbc3a8193cb87e4cf9d8d43c83053e0f9eb544a88f758825
MD5 ec0842874b648e209717d43b44be6fb5
SHA1 569709c1d670c831c7db3be5309f32f5b9979911
SHA512 3ef4063c4caa110b16de512b7c7b7c5cf5be30c2326bcde22097a6a7ae877f1bfe81860d02b32d76ffb36cde82a50a5c52d5e250d0ec891d8b6c93eb02b0f99e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 845ae43d5cf90e779a5a187d0aa239a6349559508f796549e9372012b9e21512
MD5 7506534aa87163c8183d0cd773d86488
SHA1 bd81b8c47a32ca6750042a12668a8b875ed52959
SHA512 be4c2b385ec6d7c1fe28c4b84e5e025d02d65c1d7decd718dd241f2b4befb3262c5b4fcc646367601e4dd52679c3ff1ec537b53413878903f89b4a5d01eaf7f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 24a8c5da547474acc221cc62bf282b321952a654c6590131d38e79367c87a1d3
MD5 273da78703ad4de7de8d4729d25fc12f
SHA1 3e64560e1c3911aa39a20dd8d5a6e834822a26bb
SHA512 66dc81826c6a1da5e257d6a28c0f54c813f10736300f474f311ff85e53d3f4419940548df37b429eb1d68fe5302382942ed68558fae0eb05acdc9f69a775e09c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
Size 10B
SHA256 f0c4905accdd589c6402aed08cfa45d3a582c32fcdb9ea118b0ecfd2c1723d96
MD5 7bd6a6538099a6c969b0a062c8e36e0b
SHA1 4c8e975119956b8573f57240fc389811d346eddf
SHA512 3959ed5aafd9afd5b5353a588aa84febdaa94dffbe15b22a7b7c0e52361c58914e030a3ac07e47f093e3f9c028ee2aa9b28e7e829d973d1fce7e368d6dddbbde
MD5 SHA1 SHA512

Submit Download

svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACCABABCCBBBBACCCBCCCBBCCBCBBBBBAACCBBACBBACCBABCCC.exe
Size 10.5MB
SHA256 0df8ab0e14f33e2551ecd5927d48cc1f6ce0d8586444fdffd3ff67a049420c4a
MD5 1b87ac30ad9cf75861a011e818685742
SHA1 d19da9953478273041c6d3be3159f7467af8b47d
SHA512 0c5ec20d504b1bbc94a8d1ae573d19141d7550c8f6c8e8a0adc1630e2a62e8a46e30fed42710bcd273e373b73aa4407e61f078628fdda76f5121ffe8fc3c3a27
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wq5+EF+Ei+EF+Ei+EF+E6wqu:uKjKWQckVgtev5mnlNL4
TLSH
T175B67D14FAF60C62E1BB11B11DF6E67A0C31BB7A8128D55DF99E874F7833B8044167A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0d42f3d5a5d90eb1cbc16dfbde14b806d5e7afaf56d206094dc723f5d87b87ac
MD5 188e90c744ec6fb67c8291c2ce47b7e5
SHA1 d5e8e5b7df57feadab0a69b2900556bec491fc9e
SHA512 9445ad8b95f4919908cb3c1a474e214e6880bd241bb7ef80202057347c32e86881114453050d15c11e60ad9bc5faac0dabc080ec51e3300977ae379f587110df
TLSH
T12111CC61D4F59C53E93368CB663DEBB208A8735FA8985E1412494218A7A9C32CD550D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 33ca04e447dcd6b34687e7d64f32f9e59f3e9ea2262c269b57b0092d6bebaa2d
MD5 a9ec19ece404249d090d4c94ddc9fabf
SHA1 0aa10fdd67ad63d3600bf6cb3cd9a26b56e238b1
SHA512 0460c8f396f384db368e6b57f6bcdf39c8b9144237b71e3515077ab1469be66ee7cf5218e0daf07e0c40f8d3047aff56e820e8c43dda84ee41f66df2200cc409
TLSH
T1E421EC71D4F89C53E93368CB662DEBF208A8735FA8985E1412094218A7A9C32CD594D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2a1fe107a886d7cfb7c6807b61311182e9492380edc376ce95dbf06c3913d40d
MD5 ae68c37524ad216d546cea94fde836af
SHA1 0b79287e161f0f7e62d4aeac94e43b34a14c4d47
SHA512 38cdcbd945182202626bd4887fb3ec2565d41f6fc66b7c3c38d69cff75d19579142a4ee0313664c200c9a04b5ba2b7118e540c1d5fcd64e2ca7063a90b62acb4
TLSH
T184110461D4F99853FD3368CB662ADBB308E8B35F78586E241245021CAB5AC32CD590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1908-1892-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/1908-3928-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/2636-6-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/4628-32-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/5180-70-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5180-3926-0x0000000000430000-0x0000000000451000-memory.dmp

Download