b665718e32a232203cd105f79e4005ba2c9f7896875a7026570c752d9f1021f8

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 13.5MB
Sample260814-ddqyzsbl9w
SHA256 b665718e32a232203cd105f79e4005ba2c9f7896875a7026570c752d9f1021f8
MD5 e8239fe7207a28890f66ce7bc7d85ee6
SHA1 20f32785497a37d4d854327653d5fc48037eaf10
SHA512 7aabfb5a001fce51d68f6720cecde19c4a352f8c013634c3d1c2591a6aa5c7d6f0e5a5b033eb9e41602eb15200ab09e4fc38ac7eec159c7896f072ad168dafa5
SSDEEP 49152:U+ES+ES+ES+ES+ES+Ew+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+Ed+ES+ES+ES+EB:pKjKWQckVgtev5mnlNLS
TLSH
T11DE64C09F94340B1D92B51B04DCFE3BF8A60BB25C6128EF7FB4ECB5B6923B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1608	svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
5960	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBCCACCCAABCCACBBCBBBCABCCCBABCBABBABBBAACBBBBAAAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe"	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAAAACCCBCBACACBACAACAACBCCCABAAABCBABBBBBCBCACBBCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe"	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5688	sc.exe
4888	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3440	cmd.exe
2760	cmd.exe
5992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1608	svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
1608	svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
5960	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
5960	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
Token: SeDebugPrivilege	1608	svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
Token: SeDebugPrivilege	5960	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5692 wrote to memory of 3440	5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 3440 wrote to memory of 3428	3440	cmd.exe	94
PID 1448 wrote to memory of 2888	1448	svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe	95
PID 5692 wrote to memory of 2760	5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 2760 wrote to memory of 5688	2760	cmd.exe	100
PID 5692 wrote to memory of 5992	5692	2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 5992 wrote to memory of 4888	5992	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e8239fe7207a28890f66ce7bc7d85ee6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABCACCAACABCBCABCABABBABAABBBAACCCCABBBBCACBCCCABABAAABCBAAACACCACBCABCCBABACBBBCCABCABCCBBCCABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABABCACCAACABCBCABCABABBABAABBBAACCCCABBBBCACBCCCABABAAABCBAAACACCACBCABCCBABACBBBCCABCABCCBBCCABACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe" start= auto displayName= "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe" start= auto displayName= "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABABBBCBCBAAAABACCBABBCCBCBABBBAAAAACBBBCABCCCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBABACBBBBBBAAACCCBBAABAACCAACCABAACCAABCCBBACACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 88f610a74a48fa38900414f2c004e24b2c68690135a563d7868d1f35fa953d86
MD5 18e3c0dbeed869b628ff032f455258ee
SHA1 01fb5edcb134758d67b9b0abdcb41b0723ab4836
SHA512 25794261b92ecd8b3c774376a853a38fed01a60d76eae456cc30cf0d9266bee5db6c01e4bb9cf1a2a57a46a32174d8cf168beb25ba6e22809515295a9388d828
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 cb1710fe8286ed2fe70fb10d4a78e9960e497bd3f342b32aaeefa8a23ffaefaf
MD5 bd8ba814e7fbe709bcb39fe78e9ee245
SHA1 2e1eebf2776c321c00b8e4a3c43e33f202652f96
SHA512 8e2facae6ad60eccce444d026c310c9a95c57e61c4b468d37f436d9a4858694eb64789d71e540745a38ac7d96829b64e4810144a829fdd9ae9fdc5fb7daf2089
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 14.1MB
SHA256 8a7cfba69261a75b85a38826bde52a8ea8966bed3e1d698e3abf8e6029f5edd1
MD5 740d5453deb43d9db1c83ef386a10095
SHA1 4f55e72c87ff12dcdedd7e3a0e14de3a939f14f9
SHA512 6d1e383c4010fdb320ea79da7f224661a94bf2ffcdf1367dbcebff929875b9177f721434eebc993e9ba86f39ae5bbc5e1180284308148eadb94ff5429a9eccb6
SSDEEP 49152:U+ES+ES+ES+ES+ES+Ew+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+Ed+ES+ES+ES+Ea:pKjKWQckVgtev5mnlNLVgZ2Hb9t+2xJ
TLSH
T1CEE64B09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5B7923B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0a630339-8157-4a8b-b6ec-49d13cc075b5\index-dir\qap`g`v~dtlq
Size 10B
SHA256 79ef139b56585b93a88c00152719c5b14158669e6bb95b3c1faa5b081404ee08
MD5 bef22584cb4675f8a35654e319cb577c
SHA1 8faebc76e62f311772365599c1ffe1e2edbf6f2a
SHA512 a8d241dfc3593acac806e6169ad826e6fbdb422197d1a626209965377910ec0f29c8b18f1189c26c8968617c4dddcbf45790bb8b552cd91312918fba935ca888
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 41bd98d5697fbb17b1b13cb1beb8939e23437339d15853e1e69e0166ee32fd71
MD5 eb8e97adcf2c130b122a47f65d9dc79d
SHA1 a68f91c00c30a9e4dd7f142777a5ebcbdd09dad2
SHA512 85a0eccca0600ca457ad5d478b5d409f50067c72c00804a2b57b17130db223597b0f08d656ffae66a604cc8b5e17dca2f4df7e71bdbedd211799dc659fd722f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65648adb55f166d0a5d7fac2ba79780d9473d4da7bfc47261fdac5d587194e69
MD5 d17c0ec374ecae646db7348190494333
SHA1 ffebbff65784b37da1d86c6714d6f22f9f9ad540
SHA512 4e6b48aac610a6a5e327ec41cff8ce4a93f079d0de72adfd3f5c8889a8169f9e684d3237e546d44985590d22128ea2e6896dd8ec8bfbc672df31658c4e165f9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0178fd0d2257998a5ce5e7db56213cdff6cabcee3af55b375e6149bdcdedea04
MD5 d6ffdef6e5acad0ee9e4ccf5f4205db6
SHA1 d05490acdd00d63d5ce59583fe5ba148ab0935dd
SHA512 7887e55cb8a1874b814b334864923abf6783a09a7bcb02e79012a9329d0fe38e397760283026780dac8e1f9214dbe21612dd8215f665f49ea5368b75d98c631c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3c8a2a80f5695803575e905ccb9c0107d74d38fca6bdbc373eca475a9d10bbbd
MD5 c2497e7fb42b2d2f2e8c2143b892218e
SHA1 efe28831695c7b6e1c11abbb3c723016a56afc03
SHA512 00181f5e45d3d9e0d15659f325662d6aa34272b48d02158895cf2cfc7f30627858b0184e0b40e660bd44a57f9340bed1a18af516052eb034835c021a80ec7cf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f18e26e803f1beb427c94bfe1d45e50fcb2b4b4ddd9a0b97861b18ec9a1bf8ab
MD5 48cc891d245144ae843f08e61bc68807
SHA1 e2bfba16b5b78ec6a330c06d8bda07f92ccf63f7
SHA512 a66a2597e1631d611009c7a94c09ee87b2783721a52ece1d18ebc326775b32f4abd5e4122176e5094301dbfb750606cf9fe043af8665c30840427c55a13ec220
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33d526ddbdc758b862117234aceeae5cdea3e9c225d8f47643cc47b00cb9dc44
MD5 8534af9ff23cc3092779f8d97d692938
SHA1 04c20367d180f7db646f249d3563fe7a075ceb09
SHA512 3586d851ac8a8ecbcca24bfd941448bc89b368fa5a48e169eb023ab2b1b62f2cc61154f777c19a50b1891ffec0f786e665cd3c03d38f36b976cb4cab342398fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4a354f92c3a0ff25c2593e7e677d7805f5ab8df00d3bc514893e265c1d0a89de
MD5 e0957d0d629a9b2893164d7a46a0d451
SHA1 35d02c92b91a062ed1413c27dcba6936f59e2ac0
SHA512 41f842e03bbdf17255a6c37c827918aceba060ce4774d17a4b36f4d79caf4d8445c2a9560e9369f41227cf4c4117a5b0cc0070f5aeabe7e3a5b0456b709d9879
MD5 SHA1 SHA512

Submit Download

svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCCACBABABBCAABCABAAABACCBBAAABABCBCABBABACCCBABAABC.exe
Size 13.5MB
SHA256 b665718e32a232203cd105f79e4005ba2c9f7896875a7026570c752d9f1021f8
MD5 e8239fe7207a28890f66ce7bc7d85ee6
SHA1 20f32785497a37d4d854327653d5fc48037eaf10
SHA512 7aabfb5a001fce51d68f6720cecde19c4a352f8c013634c3d1c2591a6aa5c7d6f0e5a5b033eb9e41602eb15200ab09e4fc38ac7eec159c7896f072ad168dafa5
SSDEEP 49152:U+ES+ES+ES+ES+ES+Ew+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+Ed+ES+ES+ES+EB:pKjKWQckVgtev5mnlNLS
TLSH
T11DE64C09F94340B1D92B51B04DCFE3BF8A60BB25C6128EF7FB4ECB5B6923B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1d3e4511caddeeabff43d6dc86800fa33dfc863389debea75f2fceee506ad4f9
MD5 8f33eb0e2b6b974ff79d4449b8ce360f
SHA1 0950acd6e56b7367d7c05f1b0b243e989be8c928
SHA512 e00e4c9fd1b718c645dfeacf93b30d6ef92579a4635f24d897fc2deb467c9e267f37e8ce5f2b81d32596ea37a636aa997f34a6c2ee9d15b632bde37555714170
TLSH
T17D110810C4F58863F9336DC7D7299BD20CB8B19F641CAE402345132CBB98C318D194B6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7553ab0b311069c08c43a5986ffe63b69e216243b534f70a7a4cd170422b5530
MD5 5f2a4d9ee0a6afc579f40725051e18f0
SHA1 ce54aa1b801586564df54d94acf29e3fd63f1bbc
SHA512 ef0362e484dd2e052bf420cb035282ff06c3e1adb442fad42b091045aa63b2fbfa9867dc2524e7fdd69db9f7c206a313cb77882ea65c54ffc307cdb386734159
TLSH
T12B21F960C4F58853E9336DC7D729DBD20CF8B59FA41CAE542345122CBBA9C318D1D4BA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1448-33-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/1448-23-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/1608-78-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5692-0-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/5692-7-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/5960-81-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download