94bd618ff7dfcbef7cf494f2a59c16f413101fce98c95656f9cbe2f940208fe5

Analysis

max time kernel
146s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Size 3.5MB
Sample260810-c9yg9shq21
SHA256 94bd618ff7dfcbef7cf494f2a59c16f413101fce98c95656f9cbe2f940208fe5
MD5 3bda9d70f0a0e5e466c528cb7c5fe67a
SHA1 da3ae4ef61f3186f629d4acb0f3d64cae7d61874
SHA512 8c9ab7d8b3bfac32405ac9177e7a0bcd6f70e0f3d3bf6a325a8f3ee9f778b384a8bc6907f2902209c32bdac78688eb91b0792d894d0a6c4fd6f6bcbc5c070794
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WC0w+E6Dd79WCY+E6Dd79WCY+E6Dd79WC0bq:Jp7Dp7Dp78p7Dp7Dp7a+4j2
TLSH
T152F57C01B7C18535F1B729328ABFD739552EBD214F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
4184	svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe
1152	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBCBACBCCABCACAACCBABCCCBAACCCBCBCCBACACACABBACCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe"	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABACABCBBBCCACCABBBBCCAABABCBCAABCCABBCABCCBBACACABCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe"	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2348	sc.exe
2900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4264	cmd.exe
760	cmd.exe
5156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
4184	svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe
4184	svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Token: SeDebugPrivilege	5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
Token: SeDebugPrivilege	4184	svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4264	1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	92
PID 4264 wrote to memory of 4440	4264	cmd.exe	94
PID 5868 wrote to memory of 2476	5868	svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe	95
PID 1888 wrote to memory of 760	1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	98
PID 760 wrote to memory of 2348	760	cmd.exe	100
PID 1888 wrote to memory of 5156	1888	2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	101
PID 5156 wrote to memory of 2900	5156	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3bda9d70f0a0e5e466c528cb7c5fe67a_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCAAACBCBBAABBBBBAACBCCBCACAAACABBABCABBBCABBAABACCCCAABBCBBCBBBACACBBABBBBBACCCBBBBBABCAAACBBACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCAAACBCBBAABBBBBAACBCCBCACAAACABBABCABBBCABBAABACCCCAABBCBBCBBBACACBBABBBBBACCCBBBBBABCAAACBBACBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe" start= auto displayName= "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe" start= auto displayName= "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABCBBCCACBABACAACCCCBCCCABBBBACBBAACCABAACBCCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACABABCCBABBBBABBBACCCBCABACACBCABAABBCAACCBCACCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
1⤵
- Executes dropped EXE
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca7a9b5fcdf4e6c61160fdeeb17091a4d08f3a811fbcceb57528eb8db388ea27
MD5 c7e85ae7b861e76315d22339ce8bed1e
SHA1 eddeca809181d256a7459de8b2f35a4e9b707586
SHA512 89ca47d644f1726cfb530fb74f6bf57a22eca74260d136074c7889e71f3853bdfbb59a0dc8e033b70096c409f836ec1e58ef3b033547a4244aac82deb8c9c230
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfd69b002a95907d7cf845368c05901dca8400f716d55f9715e16ad2c923e85b
MD5 f799b392815d53b602dd79b72449578f
SHA1 b3e925521cf2e84dcdbcaaca043844b5f72c36c8
SHA512 af341cd164799e87377254373bee5c57dd9ad8841c84c53bda83c9e29d34138538790ed22452ac4c656b89f76e8ae5c664e61fbabd81a421b5dc363ea97a0c97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79ef3083204f2baa8f9654e1f058efbfd686adae392c609d8abf0120953ebd7d
MD5 122f76bccf793e95994709d9afbff9e3
SHA1 d4884dc3c2e6c5419783bb79585acdebeb68db8e
SHA512 d26889f1bc3ca3262348d911bbcbd2d06bc2e4c81bb1d8e1228a7dd1ee2a73e4dda231aa825f0d1251459334cd1434f99e7584682beb8fa81eeb9de92ab3bf62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c964ecd0e5a27938882e3dfd43f8143b4b6be473d00f2c62424d77a583aec69e
MD5 60ccaff9da2db0cc855e9ca3f2491440
SHA1 f5871a8add1683d026d8de1a91e7db43c3a96ca0
SHA512 d8de9a0d6c9d7fedc6c7a66ffe66c85d572bf799470fcc37106b595eb80fcd2f5e789c68ec01f08fe866710da001ecce979222d837335b1afbaaf5750911ad94
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c55cb610bb9ad9c502b22cd02079693171f234e3105bd9db9ee30a882892f594
MD5 3f5f49cf6ee4e9744e8b3a23f257f42d
SHA1 959b916473b9ddff8a4eb37f7d16f900817b16a5
SHA512 3302a93924592b256b234f15a4d49dc28a6c54dd69f67304970defe04125304ebdb12dd0ef067c33eea7034ee95cd31126cda88c438a9f062425e66c0c526fec
MD5 SHA1 SHA512

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 11.4MB
SHA256 d76de84c708487c2addf2ba9ae47f8cee7adda4cc2b257f9b7ec8507ae81e7a9
MD5 448239d630d0189fb8ae1f1956b1431e
SHA1 23f4eda2641806c7eaa25f2fe46ec7770b4ed604
SHA512 f4b434abc0c5f16dc123cdf7d201f75adb82bb66fbe6c467671fa250c517e24d0b1dc86d834dd1df345b6940ca9283f2ffe26844abcf44676ce1cf68fadb306d
SSDEEP 98304:Jp7Dp7Dp78p7Dp7Dp7a+4jep7Dp7Dp78p7Dp7Dp7a+4jep7Dp7Dp78p7Dp7Dp7aW:vBBCBBUjsBBCBBUjsBBCBBUj0a6eWBMY
TLSH
T1FEC68C01B7C08535F1B729328ABFD739552EBD614F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 21.7MB
SHA256 9746d1c43cb3194c0a0702e198c384b882a78cbbbcdb62f40b6cf1f7bccdef55
MD5 953a8ac8e0275ce68f4bc58f60d24c8b
SHA1 b854f2d22eb3499e8ee8146466111e1c42cc15fa
SHA512 83c23e03758ca45b7fdbd22b2ebe0a598ad1256a6508c7e5c3357b2d720fa844a7c40de34314fcedb94567d7741de246a1205f0ca76dcc5b7d03cd52ff1c59a0
SSDEEP 196608:vBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUj0a6eWBMB:n+++++Qa6eWBi
TLSH
T19E378C01B7C18535F1B729328ABFD739552EBD214F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 1.1MB
SHA256 9437c1d5de26aef8854454821770c6bfc924bd1803229e525d552239a4611eb7
MD5 dee1f700527057b4c13c4ff0fd729a71
SHA1 21c9a1797c8ccb1624fd12b9d34944920fbc210e
SHA512 3fd00fa0a79d8a8a93c9cd75eb789a968d9b5290db2db472d883953635bbe7a22bf3c3aef0bd66d9ea88b9cff1246b7017e1e7656a08c5b60fd0f7dad7633c96
SSDEEP 24576:m9+EM03afDd70iTWCa9+EM03afDd70iTWCa9+EM03x:U+E6Dd79WCY+E6Dd79WCY+Ez
TLSH
T18F357D10B6818035F5B329728AFFE739552CB9214F698ACFE38C072E5D71AE1A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 28.6MB
SHA256 b40feccec5aa93b960a2fa5e8176af4e2b898ec0541a62b20313d808ffa10ec4
MD5 4414122ee636c1f5b1baa6565fc64a1b
SHA1 efb5fe35b6b3e0addfb3e0ffad3969ee40349307
SHA512 f340ec52349d9236cc2b24bb1b8682ac2d23144fbd10ca07b76d812006f22f72abfacfb0999b1891e4b88bd8d6cc0b61fd030d80789425ff40fb84c0fdd5392a
SSDEEP 196608:vBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBU3:n+++++++Qa6eWBG
TLSH
T138677C01B7C18535F1B729328ABFD739552EBD214F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 1.6MB
SHA256 42e55882d4e747e2d5a2df392de73fffee43dfd3147ac009f07f2a6d39600b00
MD5 885a8fa50f9a01b4e1c552b1efd0951d
SHA1 c276d5b220e264beeff191d8c841d716ef0a7308
SHA512 ffc9fd0e937a932c26cba04097ef448d347a77d1001a6a348debee48c7d73c6b6a65edc9e3ce644219f98e5d19960cf4fc1ed0bf6eb90755d64cc4d7af1ce95e
SSDEEP 24576:m9+EM03afDd70iTWCa9+EM03afDd70iTWCa9+EM03afDd70iTWC0CG:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WC0b
TLSH
T16E757B11B7D18035F4B329728ABFD339552DB9714F298ACFE388062E5E71AE0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssertStart.exe

Path C:\Users\Admin\Downloads\AssertStart.exe
Size 42.4MB
SHA256 45dbaa9c0da86cd29620b89383c44f701402fe142e1e470be5389101f52cb904
MD5 2b34908eac458eb27a4c4bc4d8399db1
SHA1 cae0b5b368cc588f18c2294430a5c9123a41cd21
SHA512 b4940520918e83650317477edee7594e5d630952b83abd07bf38d680b298663aeaffb3baf0a9163c48174b94503a2d400d2bdab18f55b533b4ac057c42e3aa6e
SSDEEP 196608:vBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUjsBBCBBUg:n+++++++++++Qa6eWBl
TLSH
T14EA77C01B7C18535F1B729328ABFD739552EBD214F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a790677a03a2eaa8934addda49afe1002fb4fc681f3cf589d942be2cc90a0ed6
MD5 307ce533d517288754130503f0f36b82
SHA1 4ecb95d187bd5cc6ff8000793040fceeffb30b6a
SHA512 8bcf07e93ede9261afaac52e53c778bdb8287e2953304eabe1eb4edf933c97c9f56c84ca11b2698cb5d33282392a1225fec838480f1a48bd4313cd134447947c
MD5 SHA1 SHA512

Submit Download

svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCBAABABCCCCBACABACBCBBCBBCCCAAAACACACAAACBACBBCAB.exe
Size 3.5MB
SHA256 94bd618ff7dfcbef7cf494f2a59c16f413101fce98c95656f9cbe2f940208fe5
MD5 3bda9d70f0a0e5e466c528cb7c5fe67a
SHA1 da3ae4ef61f3186f629d4acb0f3d64cae7d61874
SHA512 8c9ab7d8b3bfac32405ac9177e7a0bcd6f70e0f3d3bf6a325a8f3ee9f778b384a8bc6907f2902209c32bdac78688eb91b0792d894d0a6c4fd6f6bcbc5c070794
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WC0w+E6Dd79WCY+E6Dd79WCY+E6Dd79WC0bq:Jp7Dp7Dp78p7Dp7Dp7a+4j2
TLSH
T152F57C01B7C18535F1B729328ABFD739552EBD214F2886CFE3881A2E6E716D0A934717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a3f9c47176cfa7929102bd7915001a64e0bb49670bfe61df1125de1fcb06351f
MD5 c399fb7e02ec39433a9a6b171da7794c
SHA1 b565835910cb5bb5af2797c88783567010a6621e
SHA512 9c47687ace17d829fce37919b274a8ec0c9c758e628a2b6457463e425b65840cf2261ec8a0e8218da18a38d9fd4dc5ca833b5f94cea6a8cda266d17cfc227a59
TLSH
T11C11E751B5F9D457F833B8DB52168BB20CD8779F682C6E1423094318BB96C31CD590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1888-70-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/1888-23-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/1888-48-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/1888-12-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/1888-0-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4184-107-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/5868-69-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/5868-47-0x0000000000840000-0x0000000000861000-memory.dmp

Download