6f9c4f7954473bd65f6bd23b249024c172d035aba0f86c8750b34100f4383f8a

Analysis

max time kernel
151s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 24.1MB
Sample260813-dqa4asge29
SHA256 6f9c4f7954473bd65f6bd23b249024c172d035aba0f86c8750b34100f4383f8a
MD5 da207ce4966eb6f9a0855892bfbdbf3c
SHA1 1b224b2bd67d00c37e7cfc9ae1432be75ea63d60
SHA512 0d6fb8c447b03614ec1880c7066e47ad4f78f4cda3fd8062a3df1c8462179a17022e00c243e8e39e9b8a6c802d96d4401a0197dc8e2f5e3a08605b227751dcd1
SSDEEP 49152:U+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+Ep:iKjKWQckVgtev5mnlNLR
TLSH
T13D478D06F98340B1D96B11B04DDBD2BF8A30BE2187128EE7FB8DDB1F6932B916434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
5976	svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
4584	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACBBACCCBBCCABABCAAAACCCBABABABCCAABBBBABABBCABBBAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe"	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCBACBABAABCACBACAACAABCBABBCBABAACACABABACACBCCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe"	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4284	sc.exe
5892	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe
948	cmd.exe
4456	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
5976	svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
5976	svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
4584	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
4584	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
Token: SeDebugPrivilege	5976	svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
Token: SeDebugPrivilege	4584	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 4644	5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 4644 wrote to memory of 3288	4644	cmd.exe	94
PID 4444 wrote to memory of 4784	4444	svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe	95
PID 5612 wrote to memory of 948	5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 948 wrote to memory of 4284	948	cmd.exe	100
PID 5612 wrote to memory of 4456	5612	2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 4456 wrote to memory of 5892	4456	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_da207ce4966eb6f9a0855892bfbdbf3c_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCBCBBCAAABBCACBAAACBACACBCBABCCBBACACCCBBCBBCCCAACCCCCBABABACCBBCAACCAABABABABCBCBAABACAABCABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBBCBCBBCAAABBCACBAAACBACACBCBABCCBBACACCCBBCBBCCCAACCCCCBABABACCBBCAACCAABABABABCBCBAABACAABCABBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe" start= auto displayName= "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe" start= auto displayName= "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAACBCCCBAABBCCCBBBBBBABAAAABBACCCBCCCACBACCBBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACBBBBABCBABCACBCCCBBAACCCABCCBABBACCCBAAAACACBACABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 c883788080cab18d170bc66c545c90d9e6de9fe105c8d9cbafdb887bd198df8c
MD5 e070a3aa3dc3aca218104b56c6e58d80
SHA1 fb2d94729a64c97d2e3a06ee294e27dec0d04a37
SHA512 c4b25e70337f8b2e491e7b0d9e764e269afc004919f6fb421aa1d401043525be58513776aa078abf28b983df22ba3b1138bafa379a136831adb98a5cadd504e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 437991eed847a063182f90633e718bad9da5f868c6b0ee84ff609ea6d5a7f386
MD5 26fbb3b217d19df78893091dc3a93c1b
SHA1 185f6e1d960888bbb7d8453433aedc4b3ebf1f1f
SHA512 0835ffe081f93b39459183d59cbf889a503b65857169375385772d3e2074c74cbd46fadb65f4e84f7ce8857b7d306f780a57171d4583dd889286843a5d784f43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 14a08bb8a900ce84787e40fd3bd93f70985bad4655dea3302de281c8205897e1
MD5 9c2594347df12557db9392cd4dc75d20
SHA1 65c81feebc49581a93cc7808bfddaf3525b5fa8d
SHA512 93a27523144c3f95e4dd0739a982b1a1129545c7a175896e43809f8404867c03fe956113f0dff23cb85d407b8940bc53cfbf2593c3df57a779078452f1ec41b6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 24.7MB
SHA256 51b223317a14543cce9f67d5e9db9e0dce3ba91a0af1ace5aed0048ce890f3c7
MD5 60a183a395b64b0776874be76194a90d
SHA1 41f6e1d60fd887e0f6c09745f642a6e40e3b5cec
SHA512 6770cac39deca29ee0dba3ce6a8a7bbdfd71c0ae17785e8fdec6725d1607ec5b431809d61026edfffd2f454fc65464043d505e1a5bc0fa9409cc6c427d1e2905
SSDEEP 49152:U+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+EU:iKjKWQckVgtev5mnlNLwgZ2Hb9t+2x3
TLSH
T196478D06F98340B1D96B11B04DDBD2BF8A30BE2187128EE7FB8DDB1F6932B916434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 cb3a7b1794866b75d22ff5954eab87de503f9f7c2e1e6ca85a5e363b64ac73c3
MD5 b343e9661daa1030b1ab31578003abe0
SHA1 fb1249d1813b3a21cd9feec83e45911193b0b925
SHA512 f722e69154ab9b0dae3b660743f341f1e0a4cda7b7cfc43109530d357c7e4c4cba4569b0a0e675c9e15bf7d069c8cc54d43ea1066f10c170bec86d9e9820967e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 8325995054523a715c473779782472b280e895712dc234582a340bb2632e8075
MD5 01a7d9b89de345e782afd8244b1ac3a4
SHA1 7b652995ae463f96f49c103d9abf7dad16df9a62
SHA512 7f4dcc8af7466a26490e3c00b2a63ad345c02fdf0847d5b1761498342384a1424e5b11199858b61e6c31117a0cf9a5b5f95faf152760324f6972ea4a7d52d967
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-BR\qap`g`v~dtlq
Size 10B
SHA256 777022fd25ec11bfe2113b7f30ca71623ee6bfa07864ca816e497c52820b6411
MD5 b5aa05b14deddd4134462d60a2237fc7
SHA1 8936a763af9f0b2774606a648bd9b64b6da77505
SHA512 14d2e9cc5da8ff56f312842f271bc4301d4255fd0aac8d1a178d29de2755587f895e7e4d2f30f18d4564094135ff4814b565708cf7229f8d1751a7cfcd877365
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 bfe3a1cf2a0921711a85bf87f4ea547feba1725e1a6fafacf35c1258ebaaccd2
MD5 16b4bb60da30048db267f15d78a0105b
SHA1 0020b92aa6299f8defe6dc9799962693b18722b6
SHA512 268bf411931c8fe1e4e69a9996c5b898aec404eee31bfb4cc936f8baa88f0962df02182983659a28b66a1b601473922b1985c5c7aaa19820683233c80033f3a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\qap`g`v~dtlq
Size 10B
SHA256 861be6d125ea351de504bde4e77bc768e1126067385ad230cd8e364c474f2360
MD5 6a6c8a14189e3c229e9b7a9df028ff69
SHA1 5456ddaa0802513b532ee90c54d1bb94def119b8
SHA512 18646cff9f3016257ad5d0bd79fca404e521df0f777982cecabbe3fa54d57940d462535d5fba36956291671c7a5a566d9f60a6fe356a52e5f6e64d83d938271b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 334e6dbeaa098df1be41562fc8a20a01752308e9676c12ee2d82d52784fd011d
MD5 bd4ba36bdad6350123b75e3f922092ef
SHA1 3470200b7f2dee84030a313f33841459d1388725
SHA512 7c86668c71a38fed1877ea987c51124ec2f86899c2c3ceb2e2c4aed193a4a068b860f8ea0d476598d710d905a57226ba7bf5111cef3caf9b77c859320dad7dd6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75c3f498299dd5b22a555b16e9d9dfb8e990b8a6db6cdcea3f9e5a4b9d612302
MD5 1eef3ab4d18e90e255b3977b0c806906
SHA1 91957cbfd6e254076d331b3edf1b50bf79144ca5
SHA512 25454d2a2e835b4a90fb161180cd07120924bf0d44bd5a5af01511c1396ba6e66523ef54e1bb7e2f9de8f5c0990c2cce52274fc8be51b81837920812548ed7c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61bb90e82138c7f12d6734449b187a639d9cfc2368830459eda253eb1cbb9dee
MD5 f53d07bfffe0556f9a29343c39dc6742
SHA1 5e241e6ae27c3ebbde2e4a1d3d55cc03caac3f0c
SHA512 bccf1add396ff345453eff5e26dd787346f03da014b72ab67004f117b941ff015f84ae48c3547aa53fec61a564e79f50c7f80f87d81a1228bf6afc9ef28ea3d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20bdfadf121fbc9b711146c14ab9fc910383a94ff278b8ca501ba38deaa99fc9
MD5 37a385ba9ae3505ddd5ec0c26f12a8a2
SHA1 a8430f822835d40d1a87d061a66214fc431c0897
SHA512 91f81000000ce959087cca5901ea0ecdaf06213b97122f193c5e707d1062fdfa62845ad9dec397d2fb454c594cf5f7580421836805877f24ad63621f3326b505
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 088c08cbeef56e79eca7ba72db3d67409a37864dbe62c31827238c21dd822e5c
MD5 b196d4ee0d00cd93c4c6fdc002ad8c9b
SHA1 8698e98cb19f61c36348e46761db5e86f49c8326
SHA512 bb80920f55ae526cdb7172557107e8ce88c61442fb8559170e2d8789e90e42328790cfecf4d97d4a4bfb6ed2b0e046d73d7866df74485676b4b9a4a386bbefb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0be131ddc93b591ff37d101f65f09ef1cfb3fbdb336d5abc7ef5803bba0370ce
MD5 e47b9f2abaa408f80278a17d56fa7ac9
SHA1 cfb3775e0f136725b1437b9c81040338db975c2d
SHA512 74af94cd30eea0311232d1439a0f2c6d8b5e6b72a3baec0c9577a6a9a1701e819342335509940656b4b8979a006ab417f26fc21064b549e40272f300429f020a
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBBCBACCACBBAABBABACCBCAACBCACCBACCBBAACBCACBACCABCA.exe
Size 24.1MB
SHA256 6f9c4f7954473bd65f6bd23b249024c172d035aba0f86c8750b34100f4383f8a
MD5 da207ce4966eb6f9a0855892bfbdbf3c
SHA1 1b224b2bd67d00c37e7cfc9ae1432be75ea63d60
SHA512 0d6fb8c447b03614ec1880c7066e47ad4f78f4cda3fd8062a3df1c8462179a17022e00c243e8e39e9b8a6c802d96d4401a0197dc8e2f5e3a08605b227751dcd1
SSDEEP 49152:U+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+ES+ES+ES+EWLj+ES+EW5+Ep:iKjKWQckVgtev5mnlNLR
TLSH
T13D478D06F98340B1D96B11B04DDBD2BF8A30BE2187128EE7FB8DDB1F6932B916434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d6f12736b6374f7029dde8a89b4cc94fc122f09d713ba80138aa84535b1158c3
MD5 62f9c1bb37e3458d03e7628cd1cfc04b
SHA1 16ef88c0d04a02e408d0552d415c6c22fb6b085d
SHA512 819093344d033021972c46dc00ce4e2dc020628dca79ddd2be5553b9e04b31db4e1ddb9ffaca7a8c5b5afcdb9a4a718f2033c3a50859e3361d0dc9b10e324a2d
TLSH
T16B11EB60D4E6D463FC3328CFB97BDE4218E536CB58646A2853498319B3A9C734F158F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 745e4345169d72556c58067f8795bf8a0cbe1047e031e645ee0a9d4dd459c35c
MD5 34abd6b0d3cca3b659512161c583abcd
SHA1 97985433b733df3c3568a0fdbea75bbca7b561fe
SHA512 921739f5e76fab5efdaf1d0610f8652d15e49c8f56cc02eda2c44db982e3422ae22efc9c99688d471eef17dbd8835cad4570e88e1491b69ad2771bbb8646977f
TLSH
T11821CC60D4D5C473FC3324CF793BDA5218E5368B5C646A6853498319B3A9C734F158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4444-33-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4584-1454-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/5612-0-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/5612-7-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/5976-73-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download