4d042de3e615e7f677949c6e585f87c20d8e6af7003c8c6d2e99bf37b98cad6e

Analysis

max time kernel
149s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 17.0MB
Sample260819-evpmxswfjc
SHA256 4d042de3e615e7f677949c6e585f87c20d8e6af7003c8c6d2e99bf37b98cad6e
MD5 d3a8cbe935c9e340ceb0b31c652c17af
SHA1 98e6a6b04f0fd0fe196bc0e999f4c126de131c62
SHA512 74487225959eaf4fe277b0bb40bb0363d8640ae30fd6959bc901dfcaeb42a26524aae824aaed7b8a5f3b1931058c8dd21fb2c01dfa295b681da87c4e3abfa8f3
SSDEEP 49152:U+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+Etu:eKjKWQckVgtev5mnlNLA
TLSH
T187072A09F94340B1DD2B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5BA522BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
876	svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe
3088	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACCCCAABABCACBAACCBBAAABBCCABBACCBBCCCCCCAABBBCBBAABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe"	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAAACABCBBBAABCABCCBABBCCBACBABBBABABACCBACAAABACCBABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe"	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5060	sc.exe
1964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe
1668	cmd.exe
5084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
3088	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
3088	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
876	svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe
876	svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
Token: SeDebugPrivilege	3088	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
Token: SeDebugPrivilege	876	svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 5084	1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	99
PID 5084 wrote to memory of 3624	5084	cmd.exe	101
PID 3740 wrote to memory of 2900	3740	svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe	102
PID 2900 wrote to memory of 540	2900	notepad.exe	103
PID 1384 wrote to memory of 4584	1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	107
PID 4584 wrote to memory of 5060	4584	cmd.exe	109
PID 1384 wrote to memory of 1668	1384	2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	110
PID 1668 wrote to memory of 1964	1668	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d3a8cbe935c9e340ceb0b31c652c17af_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBABCBBBBABCBCCAAAACABCABACCBCBCCACCABCCAACCBCABBBCCCCABCBABBCABACBBCBCABBCABBCABBAABCCABABCBBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBBABCBBBBABCBCCAAAACABCABACCBCBCCACCABCCAACCBCABBBCCCCABCBABBCABACBBCBCABBCABBCABBAABCCABABCBBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe" start= auto displayName= "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe" start= auto displayName= "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCCBAAACCBBACAACACBCABABCBBCACACCABBCCCABABCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBAACABBACBCBBCCACBCACAACAACAABABCBBABCAAACCBAAACBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 11ddbf533d7d5ec8f89639259665ff915534e5a15985678cad7c184d5287d9fc
MD5 ce316165bf3f200ccc9becb981f195cd
SHA1 fd915d349da7005f4e4d9a7bb57f2e5f492f7cc2
SHA512 528e7849a4f3ee9bedb74a74ecffa90f4ec651d161e105e0c47b581822a12ca44febf61463775a2cc561ae81c393bfad2d8e8c4938213718fe74b9a279ef8b61
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 17.5MB
SHA256 1675a1cc7334957d40aa97165ab297e94eb045c56e9aca0e2005afdc6a036a03
MD5 ba36d8750aec65f934cc069507147a29
SHA1 dc0cd0111141e8ae7542e501435e3d7c17c6cfea
SHA512 ba5ea16563b111d9c27fc6b35cb64a36e93b438a5508b0b3be087911df6c7aa09bfaa85dd232068d29ad7f3cafa62550235eb6832793002e0d7eaa655bcc4096
SSDEEP 49152:U+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EtV:eKjKWQckVgtev5mnlNLDpiA
TLSH
T169072A09F94340B1DD2B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA522BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 ee3b1a8f9c025213410356ccb267a7455224e35312c8d93ce6b82b0f82515909
MD5 145c97cb72f31c56871e49b69d7e3b75
SHA1 6ddaf56e33b1bbd8b0c4f981d602383040666773
SHA512 e35d66c55cf248312b0434db7c18bad89f3addfd3f0aba52de00d68992b5949a2b8cc4cdcbe06bfea2431c113e921e55d64e2f9d3c5472912247f3f6d6dcf080
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 3688d72138eb5eafcba57918ba45e5f5fbdfc5ba6df868a7bde487513531bd30
MD5 e45d3f2d8bed28cc39187a9adbccc6ae
SHA1 c072ddb0d7ab07d5a4631987b62aa49546bf5135
SHA512 cad56032c95d39544a0f6c72b8b9ffb9630c5f3ea9e7da23db888bb5d295ee520f8d6eccc69ec6aa9b98fc91556febc01015ccb5009f8d837264113256eb95ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 7f39f0315d95e42eba37583d2cd5a164c7f08eee7c20c59b3b25769bf90b81dc
MD5 abaf9915e28837fcb4cc13ebeb77a60b
SHA1 7c7d940cc8b828e3d07be894c0c4015cd99c3620
SHA512 7a63014d95e5ed70206156b698a634cfbe49b4bb9c31025d29df85390b6d90416a90f3f3123295e69b05886ce3abab1c2ea8b1005cca7f4c79a7d2331f3cbfec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a4c83b668271075d8f57db12a625e5d37a45d660fa6271efae60e2229fbee0aa
MD5 97c9e5030309b5867e93790325cc24c7
SHA1 92ba753a5b63840d6aa5c7b62737c4ce9755c7fc
SHA512 d4c754b036b9829627cda5d329f64efd83849908232c47020a5c774f607536a09a80c7d19b03bf01c39d2d70e607a2fd44035803e2ef3fc8802a5323b7809c2d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 8b4db0d4763060bc83ca74ad00f9546ae3756d851d161795eacd7b5225907f20
MD5 636c1488e2bf5f9a5f69847529ea768f
SHA1 316360bc643eed13350cd6e68909c5e66513c1a8
SHA512 ce1cadc4cbc876456beb1d8847318dfba119f50611dcd92feec08bf9bd87536e8de9a89c66b68988779e53ab9b9665757e83cebcab9619247f4ccc79b9d5ad6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 66227c37d3d1b29462d3d486c7a38b0e04fa45eb3857d85f038e00d049af9799
MD5 356b8295c6f13035758e1ff26e7317a9
SHA1 77a99a00eae7dc0277e7b87e1d02b7ac1a744260
SHA512 b8ac3e1b9c7537eca1ee4e5025a161815accc7f8cb87ac6e99148baeff024d3e2b9dc0d905ba64b3641062307693b9083170964f3d9ecbd299d0eaa652411ee1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c241cafa12cb12e9ae7f70d65f8390e244569825c7628d5d9edd6f56015b453
MD5 c14bb9811b945b3e3be755bdd4492de4
SHA1 36e2330536c7afb17691355bf760c2bae6e183e1
SHA512 4b25dfecddfc05248ff2edce47fcb634ce9029c3c41fd5c620b3ccde7b0015a0df40356f52e942ea20023a3c8fbc500dfad45f3e286d4053ca24478407306317
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 351560208529ad34970adce82a2b1b0938a0d730a992870602e55f61d0a95eb2
MD5 69522a1a1ddc287937ae136772fc1bd0
SHA1 82a122491f98fefa5f36ba405be21e30b37839b0
SHA512 2ecff2d9eb71fd7a652310f61cf03ac1a2a7658a405a47487efce56c79f6b4b9ba0cdc6c2c9d021fb7e49bc3f1a538539a93f71804b0c624631778fea26e3732
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4ab2878cf8cfed8ffc9690d5d5b08ccde5abeb5feddd6a8050424819dca4207
MD5 70a6ee054c9c22f97977fb1b4b351583
SHA1 33b9c832b48aa3dc9806b844c743ef966e4f7c36
SHA512 cbaf6705c2db45f424c1ca5941e1cc15d2839bc4a5883379b84998918bc84f89499e6565d4ed00a183ef3b07f3f1ba9385014df880107ec432264f037e5b8032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18ead2f9f23d82dc1e6749b826ac27d335d528a8544fbb39732a1ee33bd2e536
MD5 7acb0554b742db5fede1506043930349
SHA1 b504f28b66d444432d191405268ff75093adbe68
SHA512 b1b8f830c3d0579708d98595ddaa2b64280e8f3cf861a54af690fa0900a97759cb23b86aadf6565884c2cce26573c6c2dbcc91d4904e1e84c7e0df081cf6742f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Saved Games\qap`g`v~dtlq
Size 10B
SHA256 7c9470f221a45fb221a81adce7ec0a2d29ba5e6e0c93d03e64352b8ef40ab102
MD5 578dd435065918763209efab7595e065
SHA1 5ac05f39bd2dc89bb31c08aad68fd2293942d28c
SHA512 b8c7eb54d3998d4027e5e50315016635a72a6353a4df94440b2d7ffebfe0eb4e340fadb9de55fd61d5ad6d811a3fb85aa283fbf699278c8a7aa592700437690f
MD5 SHA1 SHA512

Submit Download

svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCBBBABCCCBAAABBBABBAABBBCAACBCAABCCBBCBABAACABBAA.exe
Size 17.0MB
SHA256 4d042de3e615e7f677949c6e585f87c20d8e6af7003c8c6d2e99bf37b98cad6e
MD5 d3a8cbe935c9e340ceb0b31c652c17af
SHA1 98e6a6b04f0fd0fe196bc0e999f4c126de131c62
SHA512 74487225959eaf4fe277b0bb40bb0363d8640ae30fd6959bc901dfcaeb42a26524aae824aaed7b8a5f3b1931058c8dd21fb2c01dfa295b681da87c4e3abfa8f3
SSDEEP 49152:U+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+Etu:eKjKWQckVgtev5mnlNLA
TLSH
T187072A09F94340B1DD2B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5BA522BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7359a4ae4ec768d9d3f5ca90d84eca8ed65db6de4353c582d36762fb108301d3
MD5 c4fa6c273e83073cbfeaea73d37405fc
SHA1 f0edfd959ff4a07e73746ce57eac26722118b66b
SHA512 2a742a8e4c2ac8e55e0ba4382a17aaa9e0302902a5349d0a1a15a70993d0eedfb6aa4d0fb521cf0b0b2d26c8d8dfa31f03e7682061c1533a27048a97b875f210
TLSH
T135219561A4F5DC57FD3228C752299FC38CB5368F6CACAA141309A21CB7D9C718F198A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 a09cdcb94a842367acd9f0e89fba5d2a7c6e18c43880ddd300eda7f339a3a03a
MD5 010603a5e850beb49c23433f30310c71
SHA1 0ff81d541cacca6cd7aa6d8f63b0382ffaa7afc1
SHA512 82279b2efbc04cda58985988d8c1aac3b2d66f87dcf6b9b86279ecc1ea0494188795590f17006bc0afb83ebeb59e8ce35d61adb0d199dbb2f221d8e1b32a09f2
TLSH
T17C019B61A4F5DC57FD3228D7522D9F838DE5368F6CACAA041349621CA798C718F198E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/876-77-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/1384-6-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2900-58-0x0000000005870000-0x0000000005871000-memory.dmp

Download

memory/3088-80-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/3740-36-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/3740-26-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download