1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 22:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Size 39.4MB
Sample260906-2kl6dade89
SHA256 1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547
MD5 90d44ce63eb40aedbcda9ec654eefe00
SHA1 d5b09ad93f9af8791a5e875cef7d67a478f7e1c2
SHA512 d9d5f6ada487dd25d93846ba32588aba0b3c8a8f00117549eec525666c82a75aace53dc9f1572cc72ffbf11250b0377b371284fb53a7dfada0be6fdd7dc70fda
SSDEEP 98304:RK7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7Vf:PKWQc0gEYnvLfjW
TLSH
T1AF972A09F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933B916428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
1816	svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
6512	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCBCABCACBABCCACABCBBBABCCBAACCCBCBCACACABABBCCACABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe"	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACBCACBABBACBBABABCCCCBABCBACACCBAAAAAACBCCACBABCBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe"	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
6952	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
3656	cmd.exe
1388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
1816	svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
1816	svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
6512	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
6512	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
Token: SeDebugPrivilege	2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
Token: SeDebugPrivilege	1816	svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
Token: SeDebugPrivilege	6512	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 1388	2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	90
PID 1388 wrote to memory of 6000	1388	cmd.exe	92
PID 2936 wrote to memory of 3312	2936	svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe	93
PID 2276 wrote to memory of 4908	2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	96
PID 4908 wrote to memory of 2584	4908	cmd.exe	98
PID 2276 wrote to memory of 3656	2276	2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe	99
PID 3656 wrote to memory of 6952	3656	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_90d44ce63eb40aedbcda9ec654eefe00_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_s.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACAAABCBBBACCBCACCBCABBBBCBBBBBBCBBAAACCBCBBACCACBBBCCBBBBAABAACBAAAACCBBACABCCAACBBBCACACBBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCACAAABCBBBACCBCACCBCABBBBCBBBBBBCBBAAACCBCBBACCACBBBCCBBBBAABAACBAAAACCBBACABCCAACBBBCACACBBBACBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe" start= auto displayName= "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe" start= auto displayName= "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBCABBACCBCBBBCBBBBCBCACCACBABBACACABCCCBCBCBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCACBBCCBAABABABCCAACCABCCBACCCABBBCCABBCBACBBCABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f1ccb907b6c96bb0858f57cec1a19885e3a054662d00ad9d359b8c41306f1cf6
MD5 b57c8f9ecd0133d8a77b71f43892317a
SHA1 7c91ab7c2d33e996e8d65bdbd14719b014eb7946
SHA512 3c38a3e8d6637577fe4b1a3516d5745b9466f91a69c6d0270c9e6afd00026f2b3310cd86d8be1a4efd1a4e3cf4335735e8f81b6e1828257a614bc382579b90d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\updates\0\qap`g`v~dtlq
Size 10B
SHA256 019dc73d6061269bb37ce3267f48b4f85bfee5384f7d9d05632b9ae5d3291ef5
MD5 1fd2d9de4cc58892d41b985982bee3b6
SHA1 fef21deff724aded826d2aa7165bdb051a42ad76
SHA512 33126ed9865e86827281434be4d41aa47a3835bdedd2cd346ecd30df0158b1d9e61376d726c04a79fd85973b37224adcd5060b2a3ca3794ad6395cf83e16ceb4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 40.0MB
SHA256 7dd5481477edc8448407d8d5729cb7c4be04bf8c6a1bae424da5f95da858b259
MD5 25edb5762ce0d4e38af98fa07a7dcaf9
SHA1 4ddd3b68c16da246530f402e275cc719a7a49edd
SHA512 f05bce177bb8d6da49774cce5c069b86196380063df6e9c49fb14ac964e229eeb1d281c3783db9c021d2ca5535ddb532ff33824451b011216f6c5818b38e64de
SSDEEP 98304:RK7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7VO:PKWQc0gEYnvLfjZgZ2jf
TLSH
T1B2972A09F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933B916428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 ce8d5df9e01b861f631fb67d96a194604e211d5600fb74b7a00d017321abf826
MD5 0e6962b90f07e696082fc8977885cc91
SHA1 85460626c7c2ffd3c628bb7af1a522d14cb37555
SHA512 88b4bb6de84c7381059c583e3294d710ae8b1372044d7f4a6f6dea702fba75673ee84c24252efc968523aa89559333affebc3e88068982d4d7849efb4393b29f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\qap`g`v~dtlq
Size 10B
SHA256 df26423f8b3379d3ff818e15eb835627e729f20bfe1a29266a880c64dda33378
MD5 71f896930f47a3dde3041d876c8c3523
SHA1 9c4267f0d201cb9b98d273e78815a8b18185fb1e
SHA512 759ceebc241250a1214fb7ef2b9fc0ff6bfbcdc26e6c9bfb453bb8d4f6208641ca59d0e56df2a7b534ce5c3723d8b2138b53aae89067f7b316448ddf0422c112
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qml\QtQuick.2\qap`g`v~dtlq
Size 10B
SHA256 73aeb2a4f308b6976c86f9de9db836e4d15d285326c5d37f39e9c36411119f43
MD5 90fcd0045109e4c8f65b2d550c2be9f9
SHA1 28040bbd2a8ad391bac66f0b928faac560efe14e
SHA512 6e9362f0e873b40105faea4e386fab43067440d7feab9a31928c32eeaa649a14dda92c81546a086aff8a255befba1e6cfb3256725107b9f0bf9b3dee6843813e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f4ed70395d4a2aeeba9b6adf7486a51ce1b34271fae64d14d6df505aa99a0f0
MD5 8c63483947ee44f0a4e4715c7f5fb0c4
SHA1 4263e68b0558c353f51dee865f927c6a74081648
SHA512 26570264d705f8a31092f101324dc14d5b67584edc7ee3fcc1e0d9414e011e27f7f27df717c333f5ad3dce885b90b82bbcd7e318387548828edc0afecefeb411
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 179bd3fa4f6d0a7b8fc346ba26a554ad6e4c70857bb5bf4548c1ec74552f232f
MD5 348294b79ab24990999c8770b5db7793
SHA1 9ae70eb6bf153db355edb2039766b512623edbd0
SHA512 6704fb80321760257e1d58027272ceb407d25042568d64f995fc77b61831c59ed1bef734c0a656c3e2e6fc953c85f3cb720a71ce0ab84c9224ed082e345a87b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4df16f67e4a40571392e834d3ac965be245e9fba1a4d4bf89133bd89a74d2a65
MD5 b1f003c84f22add408c59bfc901f15ab
SHA1 b56f283e6626f5f32d992ebe7b82b9b5db162652
SHA512 71e5db6c44363e9ff97f3b114ecabb1979ebe3f3f998c22da345e918aab33cfcee9cdb8fb868899efa223415bcba199891b165c5760f06236044489c9f57d1df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dce71da79f3850536c11c59911ebb5f738b230dd288f488e15b7da4516afd30d
MD5 3871325c375a0f92cf669f6b8ba93922
SHA1 1b9e4cec24089c5b866b2108de5d628dbc7f8d49
SHA512 d85c28d31a413e3d5dbf0e8e072eace6e55c4a75df6bb05adb9bef26e0a96fa47671ff2cab86df30c0d58ee0187d427df73fc5557ae174c7ddf15fce1e0040fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6c824df4edfb1e6aad1e3bee79578c2d0e7f97725e399a81580f82f78f6b950
MD5 f0cbe0bfd1ac532c52be0a4558c6d86a
SHA1 9f4fbcc9cb3256ccdaae2f65f7b503222179e952
SHA512 49e42f4d7873483a227efdc30842338693eac58fd13c3e1f778918774bfff0c44accc68756f7ad4860e0dcb6182ec25362ee2b34a5ff878fe91952a1cfd5f8e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c8b2bfec22033d2ca5fa36a3d425673f96986399dd02de2d1c991579b5845ac9
MD5 84868f964ce164e909d3cc456aad5da0
SHA1 2d3f42b07e54e64c437e03523779fcc9e9a6b7eb
SHA512 181b6638f5f4e3097c8dccd6a88810e2bff864fdf150b8035d4dbe45e6ae2fd31f07c660c866fb7c65d7112cc57a578178e723bd0743ce90bc335109e174bf21
MD5 SHA1 SHA512

Submit Download

svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCACCAAABBCCBBCABBBBCBBACCACBCACCACACBCAABBABAACBAABC.exe
Size 39.4MB
SHA256 1dab8372657009409df6778afda267ae929d2984d5dcb8b66d2a2c00ff2a7547
MD5 90d44ce63eb40aedbcda9ec654eefe00
SHA1 d5b09ad93f9af8791a5e875cef7d67a478f7e1c2
SHA512 d9d5f6ada487dd25d93846ba32588aba0b3c8a8f00117549eec525666c82a75aace53dc9f1572cc72ffbf11250b0377b371284fb53a7dfada0be6fdd7dc70fda
SSDEEP 98304:RK7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7UK7K7K7K7K7Vf:PKWQc0gEYnvLfjW
TLSH
T1AF972A09F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933B916428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f56c8d9dd7e42941443d959ba1b841c8a43ee2607259659ba68a3ebd886e387b
MD5 6dac8359c35c854bd71a4ce75261dafd
SHA1 b0730625e26707f6e38409f3a0bfe2c61f0dbdc5
SHA512 b8a2ae4d4d97c589aa69a8cb1f634da417dd2134fb325c62d7565e7310b181a3399c0f4d24574ddb6bf99ba08bf7ed656c59b3c34f22b802f9845cf57d6f7a14
TLSH
T159112B14F0F5DC23F134648B622DCE8B5CA13B9F9C58ABB81308C21AAB55C7E8E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2914285914574889f1cdff2c4afed0dce7e02ac07542a3f32c3f0b8e013793a5
MD5 81003245225c7b3662cdb432b6d72ac7
SHA1 f0df040aa8a61aef5b82666f04325c692ca6065b
SHA512 3ce8c78b6f8325d895181c350a7f2f7214730313bea10f3cecac05d643c1048171a9f30ba35be0700ff4621dfa443f04e49a9876c6d9107643797763f8b1b97b
TLSH
T13B210E54F0F5CC63F1346487622DCE875CB13B9FEC58ABB81308C61AAA55C7E8E194E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-78-0x00000000005F0000-0x0000000000611000-memory.dmp

Download

memory/2276-6-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/2936-33-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/2936-23-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/6512-80-0x0000000000860000-0x0000000000881000-memory.dmp

Download