c8cdbb975125f01920b4fd49c5070c4ebc2f1d01ee2176887bcfe119205c03a8

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 7.1MB
Sample260815-ejsv7syzdw
SHA256 c8cdbb975125f01920b4fd49c5070c4ebc2f1d01ee2176887bcfe119205c03a8
MD5 4ed5fe2abc8cf5ace4eff3c10db0b1d1
SHA1 aaf2552905ed0f8e046c7784d12ab02ccc6aac7e
SHA512 aa5fec385de54f93cd3b3708a2440a1f1a0845d8ff3d0c82768e0b8cadc1744a63da79e81487c754d5bcf8e090b8901618872338ae17828626aa0c70019cc169
SSDEEP 49152:U+ES+ES+ES+ES+ES+EHy6i1zuF+ES+ES+ES+ES+ES+EHy6i1zuF+ES+ES+ES+ESB:VWWWWWWWWOKjKWQckVgtev5mnlNLS
TLSH
T1CB767D09F94600B1DD2B51B18ACFD3BFC630B63583224DE7FB49C72F6A27AA16439615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
4128	svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe
3220	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCAACBBACCBAAACBBCABABABACACCACCCACBABBCCCCCCAABBCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe"	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBBCBABABBBBCBACACAAAACBCCACCACCABAAAAACCAACBCBBBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe"	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe
4516	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4804	cmd.exe
4644	cmd.exe
3520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
3220	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
3220	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
4128	svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe
4128	svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
Token: SeDebugPrivilege	3220	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
Token: SeDebugPrivilege	4128	svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 4804	5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 4804 wrote to memory of 3320	4804	cmd.exe	94
PID 252 wrote to memory of 3080	252	svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe	95
PID 5908 wrote to memory of 4644	5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 4644 wrote to memory of 4516	4644	cmd.exe	100
PID 5908 wrote to memory of 3520	5908	2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 3520 wrote to memory of 4588	3520	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4ed5fe2abc8cf5ace4eff3c10db0b1d1_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBABCBBCACBCCAABAACCCCACBCCCAACABCAAAACBCBACABAAACBACBCCCBBBACCAAAABCCCCCCABCABACABBACBBAACCBCACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBABCBBCACBCCAABAACCCCACBCCCAACABCAAAACBCBACABAAACBACBCCCBBBACCAAAABCCCCCCABCABACABBACBBAACCBCACCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe" start= auto displayName= "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe" start= auto displayName= "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCBABAAAACCBCAABCBBBCBBBBCAABCACBAACAAACCBACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBACAABBCABBAABCABCCCCBACAABCACCABBCBBABACBBCAACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 37b6bf0a386582f7e96a2eb5f23adada41187e7bcf55605dd544045c72c67f66
MD5 128b0dd7be20adedddb74a211caf825d
SHA1 0843859f2c5ab3933c2850bd9b5eb95cc512dd91
SHA512 9ddcf000cc1d67931d6eab63d18fd7dc1fab93dff235e214b0aa8f1b3101d04e69b209308ad88a60001f78db8664db9eb8cd0426b7909806b2f369d9872db8c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 76a2c6dc063e8b43d958422d25e8b8c50849042781478dd99d088cbd61267098
MD5 efb1161aa039b2fd30f46e50c6af30b4
SHA1 c8168cdea2d803da811c02ef4697333b00cbcfe6
SHA512 a450df8288fba66573f8c8788cf4c3d10eb9309fdee90b3934892d5d7d39063991abe2b4ccaf06f4835fc2f408ad5dc741ef15bbb77c1a440b1267050cb96e31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 058e2cdab52e6656ec757f1fcace130f6dd5c37c3f49c389689b2645f2d66c71
MD5 00d697b62c767549fecf3774adfab7f4
SHA1 ee97e5dc573cd746cd0716dac3a978605d5c73c9
SHA512 c016c8491f1b7873f0802d2cb2c3de30515d450268062d111d31a562374bb990fa0c4613cf1a977cb816ef53caa74f83bb6b71264ce4ffd5520c8a810b9574ca
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 7.7MB
SHA256 cee6d2a7f4e518540224fb867ba3776215628e656cea630bfe1c3b6ba73c26c6
MD5 40af678adb557f64193624f386f10290
SHA1 9f36203948661220d66d412934155b1c66edd69d
SHA512 2430b30f065933c3ddfa56489e9044e28547461465fe57a91f0fd35e362b789598ea94588267e981e1f6cbe912db850c95a534b41ccb6159e518ab35b3d98929
SSDEEP 98304:VWWWWWWWWOKjKWQckVgtev5mnlNLVgZ2Hb9t+2x7:VWWWWWWWWzKWQc0gEYnvLVgZ2j7
TLSH
T106867E09F94200B1D93B51B18ACFD3BFDA30B63583214DE7FB49CB2F6A27A916439615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\qap`g`v~dtlq
Size 10B
SHA256 3a285457cf7fc3a4af27c748fb913f05c7aa68b11948e0a477e6aaed92faa7d3
MD5 00a77c9974d8a6ab893a59216d6cba83
SHA1 f42bc5a1d4faa66572948547030197edbf8ce3e9
SHA512 bb9739c919005ca6a8f220f390bec144cfa038e47c82284bfc08735133be88dd202bb96263ac079f1c7a1ec362341544c581cb8e9dfdaf1aec94d2dadff3a810
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\qap`g`v~dtlq
Size 10B
SHA256 5c88eb0d0d1ea5bf8fc2e4c31595a07f8fa4956f6b376741110a5edffd4876a2
MD5 bec44ce721d71038b8328090569b157e
SHA1 9e45be2cd48fb5e25dbd43a6f8429f11ca2784a8
SHA512 6b25b39489bdc410fae57deb5998d8906483317ea353befbeb449732f6d28ad4c39d545ec5653e84b178a433116170272e02e47a9f5245dfed77e24080799a2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pa\qap`g`v~dtlq
Size 10B
SHA256 c35f68dba41bf08ac6a5e0320b7ab531a829bb2e3c4e4366789f89a6ad697fc5
MD5 842ab719e9b4db3b7b87ad4e94518ee7
SHA1 f4b45807c1f7798076769fa6f715f411f80e47bb
SHA512 75dd36c83682a1ba3af99112719de60ce2595122264bb8b5232a9dc64ab2415252dc6564578ad437fcd05fcef82c2f0133319a243e6c64d538aabd32b44d6733
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\qap`g`v~dtlq
Size 10B
SHA256 f6a650de061ca85f201898ef2c2fbd4356ea1f9a8a67008887c2bb7b9092422b
MD5 81ba81206e6933df3dd78ce3bb8b1d16
SHA1 b4dc82db490832c68be068cbbcbe466ac350d1ab
SHA512 35a57b63c14660dea75b9101ad25e89b74458278d4ed9146d6565e5a7c3ef8f1482ed6a351b265488b0cf5e8d5aec9038be38700e28acf3f800d29049e3aaca7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\qap`g`v~dtlq
Size 10B
SHA256 05b277d65b71344368f8270b29c751c395635bb841bfa65a2f80e3692bad4080
MD5 1e27a1290e314cb33adb97d078fe60b4
SHA1 9b4ccea37d11ee24ffc183e77c25b05ca0f72e40
SHA512 8597eb6d8f85a8c4e97f5753b687d85268e402fc15eb92cf6eff320ef33f186b540d2df76a9277b848920e7e6bf9fe81436a638059ff4eb8a64ca084ffe93431
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35a9497ef9cb7f75f593088ef2c064fa875f2d529aa9d2dab50ad6f8903f6d3a
MD5 b6430c713a3d3477232ac220b53f5f10
SHA1 7730e5664422cff72a2645a169d80f6fd9efd743
SHA512 6808c333f6d542f14cd805c13b88931c4efe3c2eed92ba56514daab278ce2a007adb9a0485a1cd7ac4a3ace5a183649bb124065881abd77aa155a537a9611a99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ddba613486202cda0dcc68d1f30bc0ec806b3c0c2ebe707937350d788815fc3
MD5 ccff3e166b3d5a4b270e9f3b6d92525c
SHA1 e6e1ee0cc28925b170ee86726a30e1e257ec1c19
SHA512 94effc9f025ea6b2ef80e243d2f7e9bc9d5305382b1709089c2d4b011d768a0cdeb0d843b32479e588f22da34230d45c693dac8c183cecae089b04a61ea29acc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f1fd92bfacd804e287f32504d44da1a5fc406a1e15d5120cb430035af209256
MD5 3804433538f5ac235b0f8cb05ccd05d4
SHA1 fb70be9cfabe33396d0bb8a4b2ccaff0fc19020f
SHA512 8cde66eb88aa579f7b3145320564fb859f0ce396c4d1d727419224fbcb6a50e5c67ed9c8ce9c6199269990f9eb165b1c9a9cf076f079b5c547de4abbf7775391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c581e0cbb7a3d47d0c3cf0e24aa301191c403d504c1656b2b36a58daaeddf4b2
MD5 15b6396a9eb77d50c7686c2aa144660a
SHA1 ce3520254b68747424d5e2f71ff751dc1fae8d4c
SHA512 542a293c1a2dff8bcc491800441bec8b5f2634e8a1139ab180150b463ccd02225fd98acaf93db884485c6017908def82bb8a99ae83bdb3a5f4723a5d7f0a755e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 869d33c11157a1a61cb85c02e5a2c1532afae40b454afeee132af299f8fdd63f
MD5 b5cf69a61e42d37c1baf2e6a21cfa949
SHA1 34035ec697639c22d11f1ca011a4701a7db1219c
SHA512 f90eaaf50498537cf10fb243d6a49b252d695217470bab96a43f5663edb21b555b2cd497d4370e3ebd735bb796ee1df44bd0399b188f288fe1f8a0651a16b0e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 28198c854d1c244610ba5d1a1852b7d7f476d3cc06f4d58142874330555604d3
MD5 b517075cf7d2dca6b4e50c89175c65d8
SHA1 80be9260a659de57472fbf2929023e0befae903a
SHA512 817541917637c143e7d11b72cd5b87fae55f90f10936b7e85021c4169ac548630ec93477ff729c1c044bb05740582a683f4d7fa20394ef2154eea3effe768666
MD5 SHA1 SHA512

Submit Download

svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAAAAACBCBCCAABCACBACBAABCCACABBABBCCABABBCCBCBCBABCA.exe
Size 7.1MB
SHA256 c8cdbb975125f01920b4fd49c5070c4ebc2f1d01ee2176887bcfe119205c03a8
MD5 4ed5fe2abc8cf5ace4eff3c10db0b1d1
SHA1 aaf2552905ed0f8e046c7784d12ab02ccc6aac7e
SHA512 aa5fec385de54f93cd3b3708a2440a1f1a0845d8ff3d0c82768e0b8cadc1744a63da79e81487c754d5bcf8e090b8901618872338ae17828626aa0c70019cc169
SSDEEP 49152:U+ES+ES+ES+ES+ES+EHy6i1zuF+ES+ES+ES+ES+ES+EHy6i1zuF+ES+ES+ES+ESB:VWWWWWWWWOKjKWQckVgtev5mnlNLS
TLSH
T1CB767D09F94600B1DD2B51B18ACFD3BFC630B63583224DE7FB49C72F6A27AA16439615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2ee72f5a821da5d97f2738f4fde7276949c7df40c164f011d21f9ea316e859a9
MD5 3f4f5e8e2b3430e71fe182cbcfe2900a
SHA1 d1e6d19458dd6a197aab25d12056cb8b0c679b78
SHA512 8f7b82800c801f8edfe1915053f5b5900db100a56d7d863b4cc5e2571f992291e4e7f401c5e8555a9abf6c63713315954e2a52bc32dda4f8897a16354a794253
TLSH
T1A811C46298B5D867F83368476A2DEBD308B47AE79C5C6F14230D8118FBC5D318D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 90fd94e202da46f4d6f499d7ac5aa17ad286dadb1ebebb96dce635983f76b586
MD5 dffdc3daddfb0dfee1813453e697dd85
SHA1 425b37d3636729453dddb18b6aef3d8895babbe8
SHA512 94f22e61679d481c51eb4cb6d0ff88666b25a8c21ff9c8b7ccb65ebb813637c26f2a916bdf1fdace5399dfef3e4b58777d43f513d2b935630b9b149d7407b182
TLSH
T12021D46298A5CC53B8336847AA2DEBD308B47AEB9C5C6F14630D8118FBC5D314D594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-33-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/3220-2881-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/4128-64-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5908-0-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/5908-7-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download