b2f17bf8e1d821240de1648ddd8409271bb33bd21539704efdb9be3b42a930d7

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Size 22.8MB
Sample260910-gncqws1ycv
SHA256 b2f17bf8e1d821240de1648ddd8409271bb33bd21539704efdb9be3b42a930d7
MD5 4b45f73ded72227efdd33d87849cf4e1
SHA1 9e2aa2b00cf80fa2bf34db132a46c0d067334a40
SHA512 1ed7ddb4b8885b2b9833b8ce56535c69b28605b7ed1130229adaad08eb477e572c29ad6f1beab4b1b3462e8906dff95e9ebc5f4c68e6e373f50851eea90a0592
SSDEEP 49152:U+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+EF:vKjKWQckVgtev5mnlNLf
TLSH
T13C376D06F58350B1DC2B14F00DCBE3FF8A71BF21C5118EB6E78DCA5BA932BA19524659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
720	svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe
5620	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCCCBACCCBCACCBCBBBABBCABBCBCCAAAACACCABABAAACCCAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe"	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCBBACCBACCBACBACAAAABBCACBCCBCBCCBBAABCABAACBBBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe"	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2272	sc.exe
2000	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3404	cmd.exe
5080	cmd.exe
4308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
5620	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
5620	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
720	svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe
720	svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
Token: SeDebugPrivilege	5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
Token: SeDebugPrivilege	5620	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
Token: SeDebugPrivilege	720	svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 3404	4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	92
PID 3404 wrote to memory of 1704	3404	cmd.exe	94
PID 5684 wrote to memory of 4848	5684	svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe	95
PID 4252 wrote to memory of 5080	4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	98
PID 5080 wrote to memory of 2272	5080	cmd.exe	100
PID 4252 wrote to memory of 4308	4252	2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe	101
PID 4308 wrote to memory of 2000	4308	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_4b45f73ded72227efdd33d87849cf4e1_amadey_darkgate_elex_hellokitty_hijackloader_luca-steale.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBAAABCCCBBCACCABBCBABACABCCCBCCBBBBBAABBCABCCCAACBCCAABABAAAAACBBCCCACBCABBCACBBACAABCBAAABAABCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBAAABCCCBBCACCABBCBABACABCCCBCCBBBBBAABBCABCCCAACBCCAABABAAAAACBBCCCACBCABBCACBBACAABCBAAABAABCABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe" start= auto displayName= "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe" start= auto displayName= "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAABACCABBACABAACBABACBCCCABCCCCBABBCCAACCBCAACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABAAACCABAABBCBCBABABCBCCAACCACABBBBAACBBACCACBAACAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 eb5c7a47abf90defdf0c3823e81d1a5b0feed52186961f0027ed8c15570705cd
MD5 c86f40a57c85923a3cbbee9ed776df6e
SHA1 cccff9b8e92d15dbfd1558c9114a232970806d48
SHA512 0a017303ca6b483ff6f6b8bfaab6add9ca05e3b98037d94d48a037344c16028403c336ee86d242f3beb952b0ee12c37550060528f15ef595ccdfb58e7168ca53
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 23.4MB
SHA256 e219aa39a591718aeef3217fbbc2d08e254b1fe6f91967f7d5eff09bcc6fe3b1
MD5 c2648c1d70e95586ff0c98d5d70de5e9
SHA1 1c10d0097d6ed6ee83c80de34c1702d2a22f9269
SHA512 f48c359c3e19af5103c26d394f37f7008ecd6e8370a702e385755867feb4014827d5caf743c35cda9ec12bca33e5848115bb1044f3c5bf86f3eb8ccd8c7768f7
SSDEEP 49152:U+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+EM:vKjKWQckVgtev5mnlNLSgZ2Hb9t+2x/
TLSH
T1F7377D06F58340B1D86B14F00DCBE3FF8A71BF21C5118EBAE78CDA5B7932BA19524659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 f24225a3e9b1e2eb7ad59743423b72470ac7b730cf41375319460bfa5636f6f1
MD5 5d5287b9e1ce42e7fcc8b7aa405c7033
SHA1 ff333021e478864cbabd55d9e658a6e81e759818
SHA512 60983ec8faf78fcbbb13807f5dc0fb5b4e6d1237b70d71dc2e55a8bc90fa19157227a0e4e4f0151c68e61aedbff2178f3b8bcc59a0ff19a43ccfe7c2f9f9d81f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\qap`g`v~dtlq
Size 10B
SHA256 8b9d3659777dd83905eabce730b0905a8874032f8efb2904658738142eace519
MD5 3b4babf156d38c3f96285ec22253797f
SHA1 00e3f0bd5d19180435a58ebb42c8d52aab7a467a
SHA512 19fc3c27f921b7c35f6798de95b43ceab302135fb6d0e8b9884fbf51ccd907f319e897a210c1f4fac8f33b9a6af11a2fad9496126e9dcb4ca2b91a15219ae4b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 968f8848d8ffb2ac4090ed43af1c108a257ce5ce14686715c9706dfc7892d178
MD5 5e8f75e8c92212b5c6a62baae0b0270f
SHA1 05fd544ef6c0150447299743ea03b8cc469db3c3
SHA512 8f62444916be37e1c541cd84c9b7c3df2906041fb81eb7e0c69d0d4f94d0c9999cca2fe73af6fd8578a3eef65561c89efdef6d7c77672bdc62c1d3dec15a2f29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9da0e987a181379771443c7e4d3f7626bdb202ea03722ea59ae1abee08dd5b4
MD5 92565f890c366d279d003b9844a3350b
SHA1 b15b7f0bb02d6b4b14273c845f01672f97de01a6
SHA512 cb784d24c3e56694ca2a56de91b12c0a50874f39f42f7b0815808f42cea96fb9835d911c7709cce9f227cfae8049981c00a96c95e0f32ffb97bb8876ccfb0b5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f8c0c36fef5c504f0c7f238838db87711c3c9be8430cb1befd67c9e3121ddbe6
MD5 bac77d69cf0d3ae1ddf7daae2894b7cc
SHA1 1daa497f6f7cf3457fb2156c4537e2654c3ff993
SHA512 f48440dfb4da0f71b56a790240ea444bc5ecf8ce517d92125ea429238717f85c58427a82f13d036c6727e6a7a81371f793c73cdf31ce9d16aeec9ebcc7f9655f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b42d75390cfb5318e692493898b8aad1fa965f637ff8ccee3696bc5f14b9355
MD5 7c9b65e0b9a5287f668510f981a2d208
SHA1 351b268be58195398ccd1494473ccbaab5aecb7d
SHA512 920dae4ce45a64879eb91025a3ec2d72ad17bd91c70ffe9662b3308b04477dc19627fd5d3461205641e0bc9ec511f420c772d8c3680fa4e1e0b7e20faf33df42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 72b0ef105d855761260725495790378aa9527c052471bbc4978c5e68950a0b90
MD5 879eb7e6a671ab5fdfcdc094c58e0be0
SHA1 778d97adb86c5b767a42b6b2e446625bb7b90c56
SHA512 f12e1af342803efb5b87bbdd0ebe7c0323018f5125d97c871e91409f5b0321f66af10f3069bcce5cf8f3a51a5055bc2f14d39655636309ebdace08cd36f5e76d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d84b3fb8b947a215f3f275b1e94f916cfe0135299926b90104090c8ab8f0e45d
MD5 cbb909c2db6d2dbe58f3a60e6b740790
SHA1 e231655800d816e4b6c332b3737d3f87ba4c6d07
SHA512 2a2ca16fcf9a56d0ad7694e21184035beece56a05ad3df2c3d11f132f104ca26ad4571b7dd2bebe47698cde0baa336d225226c78fff554230af476fca84bfb19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 24c8ec3598bba6fe4f9cf66ac92d3885f6358a4c3c0ffb59b20b00487c8a97c5
MD5 97f81b048dc5157629cdcbe4acbe5513
SHA1 e067b6217be44ec3384f17ce3986caed06dd1917
SHA512 fce6e1ef8971eb9d4e2663638f31eb48ece4879472bcff438538e269c1bcaf285d5a0df6668218d3ba6be66a2887c5b086efc5f6abddae555dfc6b7782ff75be
MD5 SHA1 SHA512

Submit Download

svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCCCCABBCCACCACBCBCAABBAAABACAABBAAAAABBABCABCBCABC.exe
Size 22.8MB
SHA256 b2f17bf8e1d821240de1648ddd8409271bb33bd21539704efdb9be3b42a930d7
MD5 4b45f73ded72227efdd33d87849cf4e1
SHA1 9e2aa2b00cf80fa2bf34db132a46c0d067334a40
SHA512 1ed7ddb4b8885b2b9833b8ce56535c69b28605b7ed1130229adaad08eb477e572c29ad6f1beab4b1b3462e8906dff95e9ebc5f4c68e6e373f50851eea90a0592
SSDEEP 49152:U+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+ES+Ek+Ec1+EF:vKjKWQckVgtev5mnlNLf
TLSH
T13C376D06F58350B1DC2B14F00DCBE3FF8A71BF21C5118EB6E78DCA5BA932BA19524659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 544c4ed70188c052db82646eb0f9c25b4beccfc80d82d494f2b623019fdda78d
MD5 951f1a661c5ccd1a6fb5d2565c1e309f
SHA1 bef160192e7d770a32d203b1c0693d73b8d44c9e
SHA512 dddd708f91912c3ce95f928f308cbc3243a9cd405cd82acf3b53887fff2febb0ed70d2d1acdeb0f23e62e83caa30223d6a3d78f05c077a1a8b705d4b77b6a816
TLSH
T1FA11E761F066E867F0712957A52EDBD60CA037DBBC98BB5463484118EFDDC39CD1A0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 80d05343aceb7ffc758b0de2a5ea150284dda9cb33a8d9ca997becb35f846ed7
MD5 e7f8f37194e38df9dac4b484c81c338e
SHA1 b78053ea2ec08149417800bd66671afe1fe06121
SHA512 7d348a4e80c50047c582d645bec35cdb0624413e6db06e55a38b766f51d012aa34a472a8ee20471f6598ba1a03b347b4cea77e08497a818f51aed70c135b3350
TLSH
T10321D461A066D8A3F0712916A52EDBD60CB037CBB898BB5463484118EF9DC39CD1A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-70-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4252-0-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/4252-7-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/5620-635-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5684-33-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/5684-23-0x0000000000340000-0x0000000000361000-memory.dmp

Download