f53e953ed6497b600ace522a67084b82b090716887869f29d6c2a21d8be45499

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 28.2MB
Sample260818-cw5z7acr21
SHA256 f53e953ed6497b600ace522a67084b82b090716887869f29d6c2a21d8be45499
MD5 2f22e398b8cfccfa3afa072c226eb4f4
SHA1 2730ebe92abb7dd454c7fc12618d9bb7e944949c
SHA512 2fdc2e685a9f03619d6932971795d2370b2f6b203957d9637fd99b790939c1b7f5acce068585bd3f8a19d0d2acc66d5c903caa5ff81bed1856eae8821989f14d
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+Eg+ES+E2+ES+EP:0KjKWQckVgtev5mnlNLO
TLSH
T155573B09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5BA533B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
2028	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
3460	svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBCAAAABAAABCBABBBACBABCCBCBAACAACACBABBBBCCBACABABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe"	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBCCAACCCBBABBAABCBBAACBAAABBCACBABCCCCCAAAAACBACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe"	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3520	sc.exe
2704	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1360	cmd.exe
4608	cmd.exe
2300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
2028	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
2028	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
3460	svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe
3460	svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
Token: SeDebugPrivilege	2028	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
Token: SeDebugPrivilege	3460	svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 2300	4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 2300 wrote to memory of 4128	2300	cmd.exe	94
PID 6036 wrote to memory of 2148	6036	svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe	95
PID 4480 wrote to memory of 1360	4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	97
PID 1360 wrote to memory of 3520	1360	cmd.exe	99
PID 4480 wrote to memory of 4608	4480	2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	100
PID 4608 wrote to memory of 2704	4608	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_2f22e398b8cfccfa3afa072c226eb4f4_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBBCABAABAACCBCBCCACBACCCCCBACCCBABCAAAAABCAABAAACBBCAABBBBBCCBBBBBBBBCABAABACBABCBCBACAACACBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABBCBBCABAABAACCBCBCCACBACCCCCBACCCBABCAAAAABCAABAAACBBCAABBBBBCCBBBBBBBBCABAABACBABCBCBACAACACBAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe" start= auto displayName= "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe" start= auto displayName= "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCBBCCCCCBCBACCCCCAAAABABCBACABBCBCCBCCAAAABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABBACCBCAAAACBACACCACBCAABCAABBABBBCBCAAAAAABCACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9f190827c9eb8368f0d00ff56ce20a53ed6cd5dd5d8d9f8ccbf8e554dc328f9c
MD5 39962b2986940791ef5f7cab6bd58867
SHA1 3a934ac69280a36154d4bd94b7d170104e84f7d8
SHA512 4badda3e9869a31ea2b7444bded6019cbfdc769add28d96694d075b360d0533b657a7ecb81da59f7620e7ba0aec539d2e2f3b76de39e1813106fc006028adb37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 8d921c7b27626739708ba280ee2b564bcc8f1b926ecc92411017ebf01ca65c55
MD5 556fc87b5c512b658ef9c7284af6eb71
SHA1 324ff725c5dfb4b316a7ea43d4c513ed78c26359
SHA512 fcfeaef086b12d1afc5ba3c06d002cd4816b4bc1e371098317865b4b5a95c22397505450977085208b007e3ebbb4e05f9ecca30f360c05269a0e8b94d573f82d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.3MB
SHA256 6e65ea936ef7cafa21096bc080db9578a9440025f4bf5639ac3bc08068b31a42
MD5 d48c5edd9920ad4774ec6c096d334f88
SHA1 f93e059b4249c2330f2932f1d389d216ea7f90b0
SHA512 652584c9fc4580646ac11c32dd02a86d1c6305453d9e418bfb32be73e4ba9b61340d7fff5a3a3444eeb1e96fc9de757b38d843afb88b8be63abcddae4dad9d80
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+Eg+ES+E2+ES+Ey:N
TLSH
T1A9372A09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5BA533B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\qap`g`v~dtlq
Size 10B
SHA256 1671d80c2175988599703e96d685976fa19cc6e24c44407660ca7321563116c2
MD5 73de37b1bb9924666dd69e0f289637e5
SHA1 5383f9305b2645a46e9ee63d6fc845ddd02e3ec7
SHA512 0852859531955ff465b2fe0dd6ffb36471efba930ab66a42a48405c2b15e0a41111237c3d74390f852d1a38ed392bdf8f0a3ba79690e70c87fb8bff81f140583
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 185f8a09bbc224112b1119c11781d704962a4f096ff3851ded9edbf6d97cc3ed
MD5 5d7fd4b613b64af01ddfb9441de64086
SHA1 92efb0dc78f313e914b2fda81f40d7806c5b31a2
SHA512 846b6e04a671600eaf1980ecf3b8eb74c5705c6899d2b4adb11065417cc2f394066ba131bfd2448870b37f76fce5bcfc95afc40b5922961076863b9cbc6aab99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 097baae15a743fba5e970f8ceb00e716e73d5592faaf485b81951af4ce0377d2
MD5 b2b4046a238ab5df796af7f471ee45cb
SHA1 f872a7672dd39cd920bb0095ef4c8fa95d75995a
SHA512 078687d8147490afc190212eeef7a59afa1df8ad404b9f19874f1b74d0821a4171ba11a86671e644bada775834f56d5073ca4f98e03b0d5ce6350703852b8495
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccd095061ee2ccb182d6a492f7abb6c8f995e2118bea9c7caf251fd3e0f1e017
MD5 bc3aefb767dfdfbe56774e5357bc05ac
SHA1 ae45b1807eb2f1763bd5f7ea34aabe085f86ea48
SHA512 b4318f6ee4db7dacecc9dbbcfd39710ca7d43338b9ea6bfd5cf74ad7ec349af42230fcaaa368d12a62dba73726d910c0808c5fe5cc0fc29d9b9e1e02c61dadc2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8526fed8067987f80c3f0cd169813d5f2ea8e733a98a6b1768773b7b445341c
MD5 a6dfce5c8a4ff21f7db638f7a4568148
SHA1 e8a76248789b6c0d371848e500aff1b2c2bc07ed
SHA512 82a94543ec928dafc42ca72efc709c47165da21d01fd07ed224cae15400fa2f0455b857f7e6e99e3fe0c138f47cfde79b7fbecdfbc003aaf1b1463bd206760dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 344fc7496c545651a6f9d296e2f3fd4fd6c96c8a77ec208cd37256fb598511f6
MD5 1980be86ea2c3bf89bb4e8016754f996
SHA1 62ea371f755e55dfa409174c29989744687f23d9
SHA512 12d24c9c619e054cb01ac19aa6a6a8c66db9d0a6f261ea0ae683f60d088864df6769b01247ff8ba41e1f0a9fa153f589bded3d5e48a172e8ce79a977b3b4fb2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 aa6a87b4d463804cdb9b9b9ab9182df801ef6b99e7c4e56c0b62c83bd068c572
MD5 bc0475805cae16e2533ad8be28eca07d
SHA1 3039727f1cad1afdc2d4fe44aac4724994c90384
SHA512 6d39a5dbbed772c18d42eef7320cc6d5e8db798f935b26ec6473b0ab442eb7de204cf52f91d57ecbe0b72f8a22e2a36f26f12a7980ab52f1b979792732ae47d5
MD5 SHA1 SHA512

Submit Download

svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACABBBBBCCCABBBBBBBCAAACACBCCBCAACCBAAAAABCCAACBBCBB.exe
Size 28.2MB
SHA256 f53e953ed6497b600ace522a67084b82b090716887869f29d6c2a21d8be45499
MD5 2f22e398b8cfccfa3afa072c226eb4f4
SHA1 2730ebe92abb7dd454c7fc12618d9bb7e944949c
SHA512 2fdc2e685a9f03619d6932971795d2370b2f6b203957d9637fd99b790939c1b7f5acce068585bd3f8a19d0d2acc66d5c903caa5ff81bed1856eae8821989f14d
SSDEEP 49152:U+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+E2+ES+ES+ES+ES+Eg+ES+E2+ES+EP:0KjKWQckVgtev5mnlNLO
TLSH
T155573B09F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5BA533B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4edfdcdb1759f8c6ae320ae9a3464b8482a499a1e5744e59bd48c2e26114f974
MD5 c4c44028650064dadb13723d6e51813a
SHA1 b39f05601872b0d4ea4631f28d60ebc884afd9bc
SHA512 863dcaa86a6fefaf8da683982f5b4e46a1c362c3a4652ffca64f02e08a262cc806a8b2c52be5753907c10cd12d236eb2ca9607c7a806489bc1e5f11c29b18b1d
TLSH
T19321816164FB9C57F9336886B619EB834CAC76CBAC5C7AA463045219ABC5C308D158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 e298637b0adb739985e4ea07212f5dde2a888912b577827acdf9ff7fbd57e799
MD5 da8732d7afcbfd91394792c7879576e5
SHA1 99e09fca7f0ed769e7655e79ce639a60efaac663
SHA512 edc564eea88b68a7a4b7854e695733c58a826a3e1bea81308eb9a5fa019bcde022e3b63083dd0f79e9aeb9de1750b440ccec33f6dc19933497675d120c455f22
TLSH
T1A401B56264FBDC57FD3328976619AF824CEC76CBAD5C7AA423045219ABC1C308D118F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2028-70-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/2028-107-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/3460-71-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4480-6-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/6036-32-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/6036-22-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download