434c855ced26c617e4920b462302bbf8cb479b3b5698f5656302788d3227f0bb

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 11.9MB
Sample260910-bn55jsvyhy
SHA256 434c855ced26c617e4920b462302bbf8cb479b3b5698f5656302788d3227f0bb
MD5 ff27d4e11bf4785844bf198df33e5645
SHA1 2583609765387777f7aac4e8fd61e459d15e6c99
SHA512 f2e28a7d9a79285aefcb0139c4b3c260044999d36104f70494ddb7dd7ba8a2def9be37ce43235e1deecf1147cd6e8902963cbca52ac8e1dfb6cdd1410077ffa8
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Epwth+ES+ES+EB+ES+Ek+ES+ES+E2+ES+ES+EpwtV:RKjKWQckVgtev5mnlNLT
TLSH
T1AAC66D09F94340B1D96B51B04DCBD3BF8A30BF2586128EFBF74DC72B6932B916828655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
5028	svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
2832	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCACCAAABCCBCACACCBACBBBCCACAAABCBBCBBBCBABCBBCABABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe"	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABAAAAABAABABCBAAACCBABABBBAAACBACBCABCBCCCCACBACABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe"	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4776	sc.exe
1480	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4736	cmd.exe
4948	cmd.exe
3840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
5028	svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
5028	svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
2832	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
2832	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
Token: SeDebugPrivilege	5028	svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
Token: SeDebugPrivilege	2832	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 4736	2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	93
PID 4736 wrote to memory of 1284	4736	cmd.exe	95
PID 2512 wrote to memory of 3748	2512	svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe	96
PID 2088 wrote to memory of 4948	2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	99
PID 4948 wrote to memory of 4776	4948	cmd.exe	101
PID 2088 wrote to memory of 3840	2088	2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	102
PID 3840 wrote to memory of 1480	3840	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_ff27d4e11bf4785844bf198df33e5645_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAAACCABBCCBBABBBACACCCCAABAAABABCBCBABABACBCCAAACBBACCAACAAACBBBABCABCBABABCCABAAACAABCBCCCABCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCAAACCABBCCBBABBBACACCCCAABAAABABCBCBABABACBCCAAACBBACCAACAAACBBBABCABCBABABCCABAAACAABCBCCCABCAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe" start= auto displayName= "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe" start= auto displayName= "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABAABCCCCBCCCAABACABAACAACABACCACCCAABBACAABCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCCABAAACCCAACCCBACBABCBAACCCCABAAABAACCBBCBAABCCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 64d3cf9452809e87656a45dd04d94a4bc0d62bc21c92bdf560ebb2ff9d1f1a1a
MD5 f68a15240dee29eb19f3978c4016c286
SHA1 70084e3419fa5208cf72d3f8ce6f7cc69edb2449
SHA512 1ca2c1508d62e80d5b9329f34c9628a8d5697a760921bca0d3941923f1d7454a8c01c24e28162c1add26e86cf4fe1ac8112b501b86b0d4ca802e58baacf9cfc7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 1d2a391988a4930eda4d124dba8b11406e98852a2721657b8bba4f6cc5dc15b2
MD5 36fad7f98be0f58b3bc1e594ca776077
SHA1 5483729642f6791bb7fdb31b7c812d2119595955
SHA512 e11a261443463f688b646a524d04bc727c3e6465e45de452ee207aa2cc40170379bf9ae07be1e04027da686cc8dbec5a32a9a732d046636b65f561eee09e47ed
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 12.5MB
SHA256 873d185eb7fb1538838a570369a7a6fa9d548148424665e12525887e5bd4eb2d
MD5 4b9900e398fa124da1f5e0d847149da6
SHA1 103c71dd6280d61f03a888757382307183a913c3
SHA512 c8fef9fb0812a70cd2800bf00ee17f38dd1c8284006f1de6fc81eb73ba16530d01ae5b56a0f1d30bed2d9e0b61d5b7c532adf5760b868fa3461dbeadd94a1350
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Epwth+ES+ES+EB+ES+Ek+ES+ES+E2+ES+ES+Epwtb:RKjKWQckVgtev5mnlNLWgZ2Hb9t+2xc
TLSH
T165D66D09F94340B1D97B51B04DCBD2BF8A30BF2586128EFBE78DC71B6932B916838655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Adobe\qap`g`v~dtlq
Size 10B
SHA256 55592ef250841a72ee45c930406bfd29f1f27e183ee2f9619d9d7a66b9b67316
MD5 e969cb23ca1e9b415926131c60528ae9
SHA1 97b00df871232e34ba2eaa3174a799502cea402b
SHA512 78148a0417f1e22a36e55024cd53a0e30e2ad7f457aed38c3cec3dcf658aa6b34d3f5fce3c95c9ae748842c67043fb860c1f89f4fc4d985d19b4c7e8437e926f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 075a7111cab5b0d4bb4c37ed95c4d8b723c08285668683b7aab60e2d3eab6141
MD5 16392182a97372019d91dd24cf087084
SHA1 91df5da851315ef4bbbf8180d444229a01998465
SHA512 983e9d7d63859b21ce2df26eaf9d542a735971c578f50e8cdbff68c9c01b49f44f897e5016f6a118547b77c713886b3059d243e89c0d83b9087bd6c367528752
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf09a357e62f7c4cde918e6517dfa89138f6a714bba8dcd19c3fa4b1ec7dcbb6
MD5 fedfff7fd844733d77e2960054e6ef75
SHA1 566a94619473a2997b1a0d298cb033ccaa11d502
SHA512 f2ac2ea4375a003a5fc5602f193e688c51938abfb190f2fcb38eaf094df82768d5a2574161736616582d5056c3c2233d566b14ee08adcd1f02a46f4c280ee4f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8b517a4f10d1a953e08d312d2e12d5512c0d4969998a030f179daa2e406c634
MD5 7b39f2429aeb4558a3effff426031781
SHA1 cebc0fd3e7500cc79c4d5b6c8932311565d4bf1d
SHA512 ff9fffde9786ae3de88433326151415484f54edea153ae990db41b7ece7d99b416c8849c624048dba5249c6ea3e21ee698cad3fbc502cb1cac88a10c8fd8467b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57553259a7160c3a8eff7b7912184e14f777d83723f89dfe3b3a8ea8935668e7
MD5 596338f92ba1821f8fc08ff460dd3d26
SHA1 948938f07308d615b3d88a8fabec21a5323cc10c
SHA512 571895bcb1f6d2c1252f123309b618e34995cabdc864c106ffa1cf2ab51b90159e9aa73c7ac18f848438fc1bfaf6f99ccd89fa6cf547b2fee5f5896d0fc57bee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b45dbe67e845234feb537161677f4d0c76876827348f13f35e9dd885e664900
MD5 220b15d934d72dfc880190e0037fb459
SHA1 bcfb4c74d77809b38a568a11740811ec271508b4
SHA512 7c9ac30989beef4cd8030da9ced1747b0e74072f535e8aa0f4b78c9019e4e018b8efde3e528bf859b809563758d4e45a80a629179fd61b8cf4d1e04c50474a91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 42ae88a958408276a656cbe7c0a84342274f62f8d3b005ae124fdda664890d31
MD5 edc7ceb4b3195e4ff3a0f97f78f2ef2f
SHA1 f20ab4a9edf09ecc7d3711dbba73ce938c2bd484
SHA512 a1ba195dd2291777d521f23b6e6dfa179bf2539ecd31d96a8c3fea990727e4c215be7ddb03c06b13b540527bbaa17187f13b4d4e8bbef82b17580d5de652aaf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5cd40b6b33b41dceddc415a10072b63011fabd6ae9aaaad72bee726e3d1b1717
MD5 7cd50a394e07d4a48c95b8c96da675c4
SHA1 2bf5d2564ade1870677452c682e376a4ba94515d
SHA512 af8898deaca4106c65b6588ef3539ac62e822bf06f69078a7da166068b3148d7c32536771798fe2e97da1cfb4c9f4a33ed796d6773035eefdbecf374fd24c3a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 50f6e7c41244d03cbcabdc84867db84b355e8c2dac46da5f17dc4f55efed4739
MD5 d51c71b3e01d6144ce8de6cc026ccaef
SHA1 a4a669931ec68585cb59b6a650da4b8441d17513
SHA512 7d14df0eafe5993ade881946456e41eda0794d399abf96341d441ee2a2c1c95ceff5fe108d72a3d1e1645c97c9c10e637c00b716e1c79cac57d467b1ab7437e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\qap`g`v~dtlq
Size 10B
SHA256 4717e24938dad17d5da4b3e2161065c8b82087bc00c3cdff1a4ba561d0a8b70f
MD5 8936af794924631ec8fd795d1195e4f1
SHA1 63f09f475a58eedd80b6dc405915ab00fde359f9
SHA512 b4a30ca1dbbeba5d20d769ed0c0791f64e1ab5f1cd3398ce99b8e148bf424db3e64a80df76847ea06a09ac991e1d212a7a76bf81fcd352b8d8c604abea13ac1c
MD5 SHA1 SHA512

Submit Download

svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCACABCBABACCACACACBCCACBAACABBBBAAABABACCCACBAACBA.exe
Size 11.9MB
SHA256 434c855ced26c617e4920b462302bbf8cb479b3b5698f5656302788d3227f0bb
MD5 ff27d4e11bf4785844bf198df33e5645
SHA1 2583609765387777f7aac4e8fd61e459d15e6c99
SHA512 f2e28a7d9a79285aefcb0139c4b3c260044999d36104f70494ddb7dd7ba8a2def9be37ce43235e1deecf1147cd6e8902963cbca52ac8e1dfb6cdd1410077ffa8
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Epwth+ES+ES+EB+ES+Ek+ES+ES+E2+ES+ES+EpwtV:RKjKWQckVgtev5mnlNLT
TLSH
T1AAC66D09F94340B1D96B51B04DCBD3BF8A30BF2586128EFBF74DC72B6932B916828655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 762187f063ef078ecb45fcdb357dc809e15fc75487692ec071d59af19d6432fa
MD5 95f7c4f0994d13ba6bd8f9e9881633fd
SHA1 66f916e8f164fff2db3ed743a7bb4eab23407816
SHA512 7b25fc2982799cc2d6802a8700c6958d58df6d1a0bf6d8a1dbbac62d8630901a6717e955128e0cb33f233502719aca4e6545ef171dbfc5f87dccfefc925ab995
TLSH
T1DD11A760B0F5EC27F1322CD791399F4B8C90B74FA858AB54130C9218EB69C39CE558F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c6af61065c8411929c5d848d7689a9874bf69aa9a6a7ac2cd13c1b245a934f69
MD5 e2ad148f62c6d6e9d7106468733d25f6
SHA1 fa47ea5a9848c60f33a71f44ecb579d4d2efbec8
SHA512 96d3b0a59f74453d101b33d32926c3bb774ccd755710a72ed045ad82e028df76ca2ccdbf2e0f06d270d69edcb79adc032b160f74f3f3444ebc0cddef3aac2f56
TLSH
T1A7219660B0F5DC27F1322CD791399B4B8C90B75FA858AB54230D5219EB69C39CE558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2088-0-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2088-7-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/2512-33-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/2832-1556-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/5028-73-0x0000000000430000-0x0000000000451000-memory.dmp

Download