5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 12.5MB
Sample260910-eqhntaxbmg
SHA256 5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325
MD5 903d3c1b254c4ff922df38248f0e39db
SHA1 dd57393d600ba4d2b04cd3cf8944a024036c12bf
SHA512 3b46ea80184197d420a0c6cf87f296441a9a8942dc1e6a371d9a9e8f9b3f63b1afceaed4ccc29eba30562d2b5bf2b938b29fa56ca23943121734a11420230694
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+E6+ED+ES+E7+ES+ES+E7+ES+Ej+ES+E7+ES+ES+E7+EK:MKjKWQckVgtev5mnlNLj
TLSH
T161D64B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
3136	svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
1300	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCBAAAABABABCCBAACACCABCAABABAABBCBAACCABABBCCACBABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe"	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCABAACCBCCCACBABBBACACBCBCBBCCCCAABBABBABCACBABBBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe"	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4216	sc.exe
5804	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4792	cmd.exe
1256	cmd.exe
2932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
3136	svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
3136	svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
1300	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
1300	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
Token: SeDebugPrivilege	3136	svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
Token: SeDebugPrivilege	1300	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5704 wrote to memory of 2932	5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	92
PID 2932 wrote to memory of 6140	2932	cmd.exe	94
PID 4024 wrote to memory of 2948	4024	svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe	95
PID 5704 wrote to memory of 4792	5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	98
PID 4792 wrote to memory of 4216	4792	cmd.exe	100
PID 5704 wrote to memory of 1256	5704	2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe	101
PID 1256 wrote to memory of 5804	1256	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_903d3c1b254c4ff922df38248f0e39db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCBCABCCBACBAAACACCBCBBACACCCAACCBCCCCAABAAAABBBBBCBCBABABABCCBCBABAABABBCCACACCCAABBBBBBACBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACCBCBCABCCBACBAAACACCBCBBACACCCAACCBCCCCAABAAAABBBBBCBCBABABABCCBCBABAABABBCCACACCCAABBBBBBACBCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe" start= auto displayName= "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe" start= auto displayName= "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABCBBCABBAAAABCCABBBBACCBBCCCCBACBAABBCBBBCBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABACCCBBCABACBCACABCABCBCCCCBAACCCAAABCACCABACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1a2d6bbe62bc8c5740c14dbaa833cf1ca4ee0cc900937636140c8cdf7f36cf2d
MD5 5559045ed22abb569f4f2242bc1d7e03
SHA1 5afd66e1975e729cd60070208950e6517c48d72c
SHA512 30064d7f3e6296d8ecabdf3fe87153c9b20b6ab6e2aaaae6a9cff770365ce5cfdc413249fa0584906b1d69cadac0c134131b8dcbd92ed9b134f322f702581041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fb24bb5a724c87bb5bc1584982ececfd2bfdcc58cbcb4a6b6aca4f1cfcb68071
MD5 009c7a1d1dbcb15f896c6ab9eb722afd
SHA1 a21167a782717701b5333364c1242fc057df22d9
SHA512 0b78c98cc68211d7dfd0984df572bf149833305029bb1e306ab1a0b1100190aadff327d79cad4181710affced1def77f156d417d128f66b2b5c22a50e4b20f0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 e3ba1f219ce2a9520e8d529edb1880b2c4885dd9a903a5ea260fb088cb1c0a13
MD5 2064b2e48a766bb429453507fb4f6607
SHA1 b02f71efd5c2b8fe93d582dedaf514a919b6b8bd
SHA512 46438c0596af85aaa702efeac614fe17483f630bad6ff2f583a0494e36709d50e8edc3b5de059923e796e44759345482939eef3700f7d3592d6eefd0d424bfb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 71d7d4c1293c2543eff48a2ea6078bc738ae490f370132de04403ebb34842263
MD5 ce770de173ef50dffb7df28b69f61dc5
SHA1 c3c84463aea37dac3960bc1f708e362b0f4690bc
SHA512 a026862c95c80b47d9ab7b5e4f89b1090b090313272a4b22b07e96cc8bc700dec942a4c179b2f557cb881744d2db81880a3d223e1ac3eee51a8ea334e2bd354c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 8edf1cfaa4416b4747aab8d4494f9e29bab15bbf9e462f6e7756683760da0452
MD5 cfc070d7f8b2344a4b02e7e99bd08d0d
SHA1 466c997ca3f873b652d4ea286324dadb4977c0d1
SHA512 af2c51c3d7702836b582531dd9a9ba880681e75887c4cd9a27da8a5b1f51630277a88b7b91eee5a80c3fdf28232fc76167e25f888ad28d0dc7321e55b987b702
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 13.1MB
SHA256 f32454f3939639c52a1bb70fbc80071bb97e39be29015ca2d8d76914a78ce447
MD5 85dd583de5255811d4a99c7ed4012efe
SHA1 01fd43ee9de34b1a61629c028456ba688ef3daba
SHA512 72ba19640196d31965c3c9a73f1060e39fb1f202ac8eec178ef696f1b24814cb6de86f6d61498ea471913ca40e28f043969c655b89a0f76d7bfa371cb833d46e
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+E6+ED+ES+E7+ES+ES+E7+ES+Ej+ES+E7+ES+ES+E7+Em:MKjKWQckVgtev5mnlNLmgZ2Hb9t+2xc
TLSH
T190D64B09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5B6923BA16438155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 8bbf082a41e1481d1ae738af585c872881434d43ffff56d066af7cbd891a318c
MD5 79c7b2101e5ffffcf48fa5789b79caf1
SHA1 812c21525200aa1e1ee3bb16294a35f72001990c
SHA512 528b644aed20fad6d9f9698a22fd652cb8aa3f2975d027626c07610890f6311e289236fd431272e78fd4480dce0da9f60c854fb99900c5dba35a833aa0f3475f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\qap`g`v~dtlq
Size 10B
SHA256 db6c71e2bc469b38339931610ef8de90dd14f02ed4da7d938a39554c9a34347d
MD5 2e975c530fb293b9f85c63b3fa5e8d94
SHA1 27595700bd709eeabe1764cfbfa34834732a3ee8
SHA512 3bdc603f3d1e6610c2c7d72775a4abe02e71779d33de168e6e3f87d0f3a869d489845bc9c5b8e7b3b9214c1ce657ae9bf6064ec432ef08e7223c7c0574e13f83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\af\qap`g`v~dtlq
Size 10B
SHA256 8e8fde357b1db72ca5cd422e59eaee14f2da1e8e32b8b349af4cf25de0f5666e
MD5 26b3df5c0c2678da09b5c4945326e4bd
SHA1 aeb31c6148039a30e26fcd200322e75bbddc398c
SHA512 b9fcccbb6abd54f46a582f5fdab3e8cedbc476801ffa3ce927cccda3f7e18fa2434657d37726ac69b46a68a618aebc0e9b37ceae15df4d5e8e9556d4bc51ed5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 2a063b868e8bf5c8207addf4622328d39477a959d709c25fd439d6978fe0f70f
MD5 e6555b6945d4317dbae8e4b78bf80ae2
SHA1 89ba473da2771c22e86777ef65b89367d389e06b
SHA512 00ff82b6345d44d0b26809483b0f026af6266064f9910766f84d10b2f485096e4890aad0dc7992561755f39df933c90f60bf42cf7bcbd194e62568bd3f5e28ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\qap`g`v~dtlq
Size 10B
SHA256 f4b43ec4ff302a6998488e0fa3cd9615727197ee39a5e770d3cbab3e49f5f7b4
MD5 b837932c93ea20655de5359c5feb7fdb
SHA1 c5c5a0bdb624de0158c329276f31a65cc0e4e7c5
SHA512 9b65cab7a9dfc31191657b7c16cafb18a5b1edc9310cd9cde777e0141eca9566dc99031fc84a7c1b1e1b1a9f4f2b3aaf27c1ac30cb7d6144548a124f0f80e7d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\qap`g`v~dtlq
Size 10B
SHA256 07694d9c3c32f707f4f581c4b54d32570f1b2e51e5954eb8329bc12ed2fce9eb
MD5 beff1056c99ee5ed8f111974d1eb5575
SHA1 438311aa11aceeb422c277367d99b1dbea5f6f12
SHA512 d94f9e45e8ed540a9d2a3939c55a84b01551fb3005c4ce006f99fd4eca1e0845e1ecd561ebc8b0e5af81138ddbd87f150d743be9c7e9a70dcd0a91bb4f6ea761
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cbd40716a0a9bf017e86d575de32a4d80abec13add43829dacf295db7f39efaa
MD5 0799f0976b2a1056f79d64e32d0377d6
SHA1 2bceeb0c23a41b430b852885d05de8c45518a920
SHA512 bb51a00dd5abb7c67708225882ac78053cbd3bb6cfef705fbd92454dd33bcef3b140451026a1794cb344899f0cfb06bbc9cae1d5f04c22f3d1ee16d33719aa16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1ff141b692ba80b9f22d3f82b857de976be32a3dd6cf6e61ae675ded4a0946a2
MD5 358803652abea3221048abc345b443be
SHA1 727b5448c9f759819909af2cbf0c21d30a31abb9
SHA512 0eb511a9b0e971911d7a6473eb310015fb32e85439455ff237025bb83842e259cee91e43fcdc225549f9e103bd4a5f8e07302cadaf262426968b37be10c14525
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bdfa426ae30f0295f709d1c2f502fcd7e506d5f2b2a04ca2fa2d6896d376cf6
MD5 b27700fb0b91bf6b05f1c313dc697b3f
SHA1 e52405f600f06d2476306ea9f206be96cc72b032
SHA512 03c85076702be917a62b310d6c306ff201feb623ee2bc0be2707678db387e74646d569af761ad84e009286f8ac82fd9cb08a582784f06ee615ed29adccbd5214
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65edcacdead0cc147286fc54323592c567bf537344d01bda75e98a608ff2069d
MD5 66a468d2142282f11485c95828dafbc8
SHA1 445d6de20a2578582e7bf7a904a5f729b98caee3
SHA512 5a5f741dfaa6e71c7e7fba2f6c5f12f7085208d3b7e276987e62c0c8dfb70c35bdabd821af768582fb01e2156cee54dea093dcbbbf1f6b80b9bad46d5a9ae5d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af69833b8f29e950a40a281200deb04edc9cec165461f5896424fbb748c2ec3e
MD5 9332bdbca910ea6c3316ceff1a177a0b
SHA1 f1f6adf73b6573bf5c3a217e4393e73458c32704
SHA512 1bbeaf5a2a0846492184a695acd959c99abfcca00c45adfd00ce742cff1f8ba9ea4c06d1a4481c6638c657ba81cd8b4c4c9738b3e81f7509f8bba349102cd7ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b6164c7a666d074ef14ec399212490736c9978238e908a0c753d345d21ffe6c
MD5 096871d2fac8c789c31ab406c0505030
SHA1 48e76271e2b0840430ef51053a7ecd4407a19b7f
SHA512 aadab76646397f92512e9c48ab81be153898ce03812a2fb720afdfa1b10965638076743e69010fde2666db4e708fd7b27bccd8332243943d33d4a5ea1db72d75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b3216e2ca56b319c93e59ddb2978721641a43e75443d160003ea186b298e4a8d
MD5 ca1f3f5692561c4c60a35593d749328d
SHA1 3a987e840b72635d409844b0b51ccc19c5661a67
SHA512 d262d4b8931ffe1eea511007c4d17ee6c09d24d2444b43272f2b5f79a0005b5942fcfea19804e46b9217d276ad1e9c6fbfdd5fd18461633592e44b042d90c0d3
MD5 SHA1 SHA512

Submit Download

svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAABACABBCBCCABBBCABBCCAACCABACCAACCABBCACACCBCCBCBCB.exe
Size 12.5MB
SHA256 5f55aa464de551651249f409dadac58aeef316fbf81fc0b5c767d4b9febb2325
MD5 903d3c1b254c4ff922df38248f0e39db
SHA1 dd57393d600ba4d2b04cd3cf8944a024036c12bf
SHA512 3b46ea80184197d420a0c6cf87f296441a9a8942dc1e6a371d9a9e8f9b3f63b1afceaed4ccc29eba30562d2b5bf2b938b29fa56ca23943121734a11420230694
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+E6+ED+ES+E7+ES+ES+E7+ES+Ej+ES+E7+ES+ES+E7+EK:MKjKWQckVgtev5mnlNLj
TLSH
T161D64B09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4ECB5B6923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 170e48b4d8bba63d1c0de57f100dec77a02d19629db520290b068bad9d918def
MD5 47fb11a7cf523d4cc2329de9b1524080
SHA1 f33c446e569a5eedbd2b629ecffbd8ae843f03a4
SHA512 12d9f8b0bd1badd55a825e4d27e271f5be9c85dadfd90c121475dd8703fc3227385bd3001aa5e940bc093a105eeaf92898df082c3d0fa6f6814fa36e1a7232e5
TLSH
T1CB112312B4A5CC13F1322886513DDBE70EF073AFBC6CAB0422484218AF41D3ADF564E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a1b58a30a31ebedf944b87c8f048dd9cb62bd91f7c8cb958ba6c673b186fd9fd
MD5 8945d46dd842b6bd3086b6b2d28ab1f6
SHA1 d71f0ece402c2ad2b927889891a71959e3d3c834
SHA512 ef519aafcf433e27af984ed23c889e89ec07472f2e14e2c8c2e44257354b273a08f5c4efb8099ee3da9d2ed3b3b665ce145b99b90b25df21a0ac85b8b1943881
TLSH
T1D621F661B4A5C823F1326886513DDFE70DF077AFBC6CAB1422485218AF41D3ADF554E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-892-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3136-79-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4024-33-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/5704-0-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/5704-7-0x0000000000680000-0x00000000006A1000-memory.dmp

Download