a4008638e44022359eb7dbe1df2db41de14de4fa8359fb5a07ac8b9cf7df3f10

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Size 4.8MB
Sample260810-c25xdahn9v
SHA256 a4008638e44022359eb7dbe1df2db41de14de4fa8359fb5a07ac8b9cf7df3f10
MD5 591edd5270227370d551726065edd086
SHA1 011da6915abbaf21370da81fac02e8b67211988d
SHA512 5166966efcca203fb942e345663b34fb80e539196aff65ddd6bed72deb75558327d85396ab5c99182444076f56d90bc2ba046e324ebbff4f6a9b58f94028ef32
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WChiw2R+E6Dd79WCY+E6Dd79WF:Jp7Dp7Dp7Dp7rp7Dp7Dp7Dp7p+4ja
TLSH
T196366B0077D08535F5B325328ABFD739957ABC614F3586CFA3880A2E6E726E0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
3772	svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
4304	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBAAACBCAABACAABBACCCABBABBCACCCBCBACCBAABBBBBAACABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe"	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBBCCCCBCBCCCCABABCCBBCAACABCBAAAABBCCCBCCABCBAAAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe"	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4568	sc.exe
2336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5156	cmd.exe
3028	cmd.exe
2128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
3772	svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
3772	svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
4304	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
4304	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Token: SeDebugPrivilege	5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
Token: SeDebugPrivilege	3772	svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
Token: SeDebugPrivilege	4304	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5156	2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	92
PID 5156 wrote to memory of 3704	5156	cmd.exe	94
PID 5296 wrote to memory of 2976	5296	svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe	95
PID 2200 wrote to memory of 3028	2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	98
PID 3028 wrote to memory of 4568	3028	cmd.exe	100
PID 2200 wrote to memory of 2128	2200	2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	101
PID 2128 wrote to memory of 2336	2128	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_591edd5270227370d551726065edd086_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBACABACBCABCABCCCAABAACCCACBACACCABCABBBACCCABACCBCBACBCCCCBCBBAAAABACCACBAACBCABBABABCCCCBABCABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBACABACBCABCABCCCAABAACCCACBACACCABCABBBACCCABACCBCBACBCCCCBCBBAAAABACCACBAACBCABBABABCCCCBABCABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe" start= auto displayName= "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe" start= auto displayName= "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBAAACBCABABBABCBCBAABBBABCAAABACABCABBCABBABBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5296
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAAAACABACACCBACBBCABCCABACCACCAAABCCBCBCACCCBAAAABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 741e2199257d0bb18410e80c3784b093cced22638b9883db2db577145b39fd5c
MD5 caa3b882e71a3cf8e3ac52b745c6ca67
SHA1 6df50cbd4e998cafc1d70d286fb19d21108b6fff
SHA512 ab50c20aa7a6093b1812607c1772e0033e7d41df473080c75da5c5565ed47871ad7b892d6a37299af3a3fd5ac379ed257613e0ceea4388515e6093e77c8b8f93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\qap`g`v~dtlq
Size 10B
SHA256 5225f814d83c905e2fae375a5f4b321d2d2aa4dcc818100937eb95b2180c167e
MD5 000f18887488c2bf665caac5e76c0e13
SHA1 3449e173d3a32cd445f1bd6c53cba2108bf83ba3
SHA512 d36a9c26b68505d0a5ce92a52d96e54ac09ab5daaa7a844ec4e9add36facc6c1f71ebefddd85467f1bd9fd717526f913f9c46ef3b0dcb24cec3e69bf8d410f18
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.4MB
SHA256 2f2913f02a5e9a537f336e249be275c4f7cdf983ff7a6520ae766c58f63a76af
MD5 c3551acec433b0206afff57acd6c3944
SHA1 deb82d6cff004247ff558622ed9192236557ba84
SHA512 77eca6d706c42c2bc94a3a136d6b87b967ab8464553871538ec0f66e5a11a67bf27a690f5f3b0939e5d29832658f5a2b5e4e164e9275a27060db1b5f9764e232
SSDEEP 98304:Jp7Dp7Dp7Dp7rp7Dp7Dp7Dp7p+4jdgZ2Hb9t+2xm:vBBBpBBB1jdgZ2jm
TLSH
T1D2467C11B6D08031F5B325328ABFD339597ABD214F3486CFE3885A2E6E716E1A931717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a05eb6de7ffbabf99f446dcd2067a86a33ccf76e2e0b198aa8bbef38b0fe351c
MD5 855b4a7dd394e34302de61bb6de8502b
SHA1 765c11291fbecb07bd81188d4b4313e40f166d7a
SHA512 66fb0ec0ea5cac1f1cbe7d1d4fb2386edd6dc6e3937d5e43347b3b72c833a1aaa2cea6730852dee07eb14d2697000452b4e4e73b78474ed3fe7b52f42ec27317
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\qap`g`v~dtlq
Size 10B
SHA256 8603d79249f111530c40ba4978802857902b50d3715f59f96c941822f8357d9c
MD5 8a90755e7fe03a8d2c32e2c3f6c32b5d
SHA1 2a70aaa9fe2fb82949817d90eb5c441e4c0faeef
SHA512 7debe3eef0f9a833941d9f8fd9b18fd4e84b619aa2523c4821483e93b22a2acc46f59172d75e1a1aa7302ab38f30b1b8c3df16530e3f7dfa63850aa92e1a2670
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Feeds\qap`g`v~dtlq
Size 10B
SHA256 efd2c39f4793945c0953d5470cc36a55e121751ef93b0096cbbbadcd7ae9359a
MD5 9d7f494d3db0f7b34a60e5c092b89337
SHA1 fc0a396345c1885ce2410504c0dcabeea525c363
SHA512 4c8d70924fecaac967b2a8802b176262204a5e721e3f86b65bdf65c64547f83393e54c0be22dee6757493224be9f207cbe42748c21f2e662a4c3b24ae5065f0e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\qap`g`v~dtlq
Size 10B
SHA256 6613e627415e09a667ef6a8bee1629dbd299c3047f83f32c31c7539022b666e1
MD5 fad1130c01254733479e139b2414196b
SHA1 ec4539d7347c902be9e05caab7ad1f8b9069a9f0
SHA512 b44c130f034d464e1c8b73cc6271d57ae7dd86acd230992e33ee3d4ebec940d2440383c6b6a50cccd8ddb0d9e83d15bd4e7d4ad6de3b217defdbe5528e75c93b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41c8d641f159f4ddcdcfc88341320129ec6ace92ff3a18cee56248add166739e
MD5 bd472871b15255891e7bc9ece9b95d3d
SHA1 deae4fe83c3593736734321fc5656ffe0e89b0b8
SHA512 965b48c20e0cad0b8ac2001c56ca46733b34c74f3d4f77c33bec35802c561a253ec547d9472dfb4055ed2be8d6e25993f3a726b2e098c4c0e7415bff59a2dc4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c21d88ffdcb912145e8a04f9f6243e0178217a88481afb72a910fab4be37c02a
MD5 a9b90b2f72560bb27fe75a964a6643f4
SHA1 2ccd50fbc206c9ebca481faa59d6f885f73ca091
SHA512 2cb4245e326452173e8958bffa0edb142320c02c3885b33187e3e445239778449cf145474bdf0dc106beccc49ed323aa26ff8d99481d493e789523d962317a1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38e5e32f2bc04799f6939ef17670257b173d3ae0871e6a8c7cab9f90323acd0a
MD5 130489abcd8284037c7176a04a62b0da
SHA1 a2aecc6be777363c1e87b289118352f95b4fa10d
SHA512 370b470c923a0d7333415d0a3dfba7f02ef41d1300d818839ff3018967216068183a2282f384e4d52c67585493620802dc57d715e129c0c6da4c4a2a5cd827f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f4fa70d7d27a298c8ded7d98e2d2e14efda6bc02130c41fa5a6388c5eb224c7
MD5 130b1c0b8fbd480a7d85376dfe5d7267
SHA1 549803197518f87d49e18cd56897ff2f72bb2c01
SHA512 3a769f7e71c33a3158ac884fbac2e9e956a5170f45b40d24c360206659cdd341d48d890640021cdea0bb3b75fa46340a9c8dfee82dcc4a4302b030bbfbdb20fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b366f175262d4b431d1d898947ac8920a1001782ed082d4c47762f655d2699a3
MD5 0f302d658a594763f4d0b97c76604fec
SHA1 b1521520b466c6038202f42b7a61e349823f524d
SHA512 520bfab22092a97922c498ef3afc97fc559a1f772e21de19043144c1f96020f6890e863b314171436be7041e2685e5a7af53dc8782598e3afe7c261081460326
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
Size 10B
SHA256 6311c9afd3847eacf7947e2beec44143ee375880e2f86558186765219dbdf941
MD5 80dc553b8907dbf47e1ee11b6aa130f4
SHA1 7c654ac3c66d3492ff941ee9c5fe1085f5256500
SHA512 836ff8ed61411c5980c367fb17beeee8409fc83ef38ec2ab7b25e1034f35b5cab2319e3d8bd57eba3a51227297867175096aa4a7786d0866a12ff584df9e2d62
MD5 SHA1 SHA512

Submit Download

svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACCBBCABABCCBBACABABCCAABBCAABABBABCCACCCACCBAACCCAC.exe
Size 4.8MB
SHA256 a4008638e44022359eb7dbe1df2db41de14de4fa8359fb5a07ac8b9cf7df3f10
MD5 591edd5270227370d551726065edd086
SHA1 011da6915abbaf21370da81fac02e8b67211988d
SHA512 5166966efcca203fb942e345663b34fb80e539196aff65ddd6bed72deb75558327d85396ab5c99182444076f56d90bc2ba046e324ebbff4f6a9b58f94028ef32
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WChiw2R+E6Dd79WCY+E6Dd79WF:Jp7Dp7Dp7Dp7rp7Dp7Dp7Dp7p+4ja
TLSH
T196366B0077D08535F5B325328ABFD739957ABC614F3586CFA3880A2E6E726E0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2fcbce9158812961dcf2a9e70c83bb4535bbce9fbdafa1e75bcd044f221a72f5
MD5 9dadadd86fbb886c5d9b2bc579885d95
SHA1 387640c1f3448319620e050f36bfba8b31652400
SHA512 9ff3d7f7fd1de5a974de2512566c8e0ae505096e22d58ca0490ca4da75839361de0dbfd3b33b8a23d62ba112f708d9ff82f87c987eed42dc1225ee7218ef7796
TLSH
T1491194A5E4F9D837EE23A8CFC12D9A624CE0377F7C58AE14620842186FD1C32CD558A6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d83ed1fa7e28ba50c8efb8ffe87b2659c439ecf65a40a71f38fbac10baa7be7c
MD5 6853cf378e050c3ea62dc0c2953c8a05
SHA1 eb3a23316558f9ef16ab4b6352a44ce221cccd64
SHA512 5690dad05809e03c4e7b5e84a20c21697f9501adb5fe2d27353ab4784fa4710b4fb8dac948fb7a1153b5c71ad84f629344ec8fa0e791c0076f19a8fe8ef3e21d
TLSH
T13A21AAA4E4F9C837ED33A8DF812D9A620CE0377F7C58AE14520942186FD5C32CD554A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-0-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2200-7-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3772-78-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4304-82-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/5296-31-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download