7eb669677a2eea6247e26bc513ea67f4157ac084d405a31e2875e2cffd9bf192

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 7.7MB
Sample260811-c3webstelg
SHA256 7eb669677a2eea6247e26bc513ea67f4157ac084d405a31e2875e2cffd9bf192
MD5 aa6ff3a2750e9a98aab32b817fdf62d6
SHA1 69604c98ba3c2d3792bb443ab903304d8641dd53
SHA512 eb08d25841f6deaf30589d12f712bac8d756551d5d3885bd971776e3f4978e0eac25b16f085e37eb06285a414d83b371d742463bd19be4da7843085b4e5bab2b
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES:XKjKWQckVgtev5mnlNLR
TLSH
T122866D0DFA9720B1D9774170498BD27B8630BE3187115AFFE7C9D63A9E33B906838A15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
1076	svchost_ACAABCAABACBCBACACBAABAABABBBCBBCCBBBCBABCACBABBABCCABC.exe
2044	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCBABBBACAACABCBBACBACACABBABABCACABCBABBCCACBCBCACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe"	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAAAACCCCBACBCBBBBBAABACBBCABABACCACCBAAACCBCCCBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAABCAABACBCBACACBAABAABABBBCBBCCBBBCBABCACBABBABCCABC.exe"	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4984	sc.exe
3552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe
5732	cmd.exe
5816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAABCAABACBCBACACBAABAABABBBCBBCCBBBCBABCACBABBABCCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
2044	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
2044	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
Token: SeDebugPrivilege	2044	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 1152	3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 1152 wrote to memory of 4704	1152	cmd.exe	94
PID 3004 wrote to memory of 1496	3004	svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe	95
PID 3416 wrote to memory of 5732	3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 5732 wrote to memory of 4984	5732	cmd.exe	100
PID 3416 wrote to memory of 5816	3416	2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 5816 wrote to memory of 3552	5816	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_aa6ff3a2750e9a98aab32b817fdf62d6_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBABBCCABBCBBBBACCCACCBBCCCCBCAABCAAAACBCCABCBBBACAAAACCBCAABBCBBCBCCCBBAABCCAAACBACBACAACABABACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBABBCCABBCBBBBACCCACCBBCCCCBCAABCAAAACBCCABCBBBACAAAACCBCAABBCBBCBCCCBBAABCCAAACBACBACAACABABACBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe" start= auto displayName= "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe" start= auto displayName= "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABCCCCAACBACACABBAACABCBAACBACBBBACCCBABBBCACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACBCBACACBAABAABABBBCBBCCBBBCBABCACBABBABCCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACBCBACACBAABAABABBBCBBCCBBBCBABCACBABBABCCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6c909e30b8ba5aa9e1e62511b7a470529598ad2afe7eb3e733bc8c28d6139f72
MD5 e3cc048d63f8883f1e00d55cac2e6f41
SHA1 fc2d792b825fce0d43418a9b58ebbc716bafd0f7
SHA512 2c46853beb9829bdfe2acbd62d238b6397e0608321a104d788f30422b63352dfe984b6ffe9b7933223221b953ff23d3681fbc0b1876eb951a68561e5e2cd1bfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DeviceSync\qap`g`v~dtlq
Size 10B
SHA256 a3dadca3dd635894fef7d8d7279dab58211ee728aff116e036d42d3496071f4f
MD5 a1576e73ec9bbcd572dd2e2ce9646928
SHA1 f44791d6ce63dc291de15926404b1a6ab37d9357
SHA512 d63419a3e8de2773c3d77f2da9786dca4726329f3fe70f5b73ab09a8af2676fc3145016284e3f2698c8bd04bad9a5f7dd0d30935b74ebf33620e7a66bca8429a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fa58feb31be37c2ef3d2e53deb6b9966ac3d9bc78019ca298ab7fa23aa14411
MD5 5cea829ba5e789a96afba22f950b14b5
SHA1 16afef2fa2633320ab2f708e558f3cbdb6f203b8
SHA512 d3cf87f9dc4ff1acac901011a4f099ccdb406d6c1cc37be634662d285ac1af21ef357f437a77a4c714c21e0daf2b89d5b72a32a86c5390a9566362cc4651772c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff002cf01e38e31f0005b3dd5d1c1133307e3540bd1134ee46935c5cfcd8010c
MD5 61910f037ec41792de6bb7cfa6078a9b
SHA1 4e0d2730d111c23b1fc4fe1c5175b2a021bcf9b8
SHA512 402aeb53475558e42421720374b89460c167a6f41263853ccf4563bcda59016f58cd74b5659c27444a88cb78deccef05cacb5601482fbc68d7139cbf4883dc51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fbb80275718ff149caf66fbaa1f1d72ebd8a5dc0a8a2609f47ebf865729e2540
MD5 4e63ae2c24b88baf4f4a1750ff6ed15e
SHA1 e67a28d2f0adb3090f3ffcb99a58d735738ee6a9
SHA512 84e85af0795bb98bf0231547f9e56031f450b7d06f7ed48c789ff6a38ca05aa9ff82a16d2e9dbeb6791043fce09b54c69a2bc5dba60e2f4a8c2eccc098daf0fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 631e4f4653d6417e5a5d7c50782040a3e758ca9d5ae5f52b16ddf7215bb306e9
MD5 8185384f49c9986f29bdcb464b107305
SHA1 1c59d75f42a4596f3df4b9bbcd29cb1c9cc46b43
SHA512 21f8b68734478d9d1210e21cbee095830877500b4c50eb9f6238c0253023b3ee0efdbeaf56272a6514c2d131c0ea7b6ac2a3858caebd8e9ebcdf7d667026b042
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0892305b484922ecfb49717bd2f6197b7b0d3904fc88c96de81b53dc6e9de535
MD5 aac4cc82b49a88791e755c8ebfa11e7f
SHA1 f6d8fa3e0de9ecd2fca569373c5e0846b9fa1290
SHA512 5b0036ae6c77acb9b729b840158561ad8ffbe175940ba9e4cc3a0902cd9ba056e610c2862fd9484e613e47a0082509d3d1d7388b0195049a84869153705828ee
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 3.4MB
SHA256 42f3ab2e9e0177694569bfa2852b5fec42320b99c790fc6f982f95c1ec2132ae
MD5 63e4135f439dba73d61da4758548f752
SHA1 f0b6311af6856d8f0c6169112ac597e33cda80bb
SHA512 8c7d6efb753cdbe56557990478716dbae7ce5a3cc69b7e33461a6a35d5eabc600d118f2c080ae6ac8bc4beb10dc83c0e1c723517d61e923a70080a048c52f4ab
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+Ep:d
TLSH
T184F53C0DFA5720B1D97741B0498BD27F86307E3583115AFFEBC9D63A9A33B906838A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 1.2MB
SHA256 6c217a8ebeb93a496a2e6bdcadd3b87b0eaf306d8ea0cf872424cc6a386eeba1
MD5 1c1d82779e27a18655847706085926c2
SHA1 8b56599c17b652b7426788eff62188f12b78b861
SHA512 f9fd2782d623bf406aa74c07d593f069e16194e6f1ddc2b74197a92af05c832ba40af336cc06203d2b6fabf72ff4d4e85e1e448043bd13bb90d68d9053e30e72
SSDEEP 24576:m9+EM0q9+EM0q9+EMyUpU49+EM0q9+EM0q9+EM+9+EM0q9+EM0q9+EMyUpUl:U+ES+ES+ElyR+ES+ES+E1+ES+ES+Ely0
TLSH
T125552B0DFA9620B1D9774170498BD27A86307E3187115BFFEAC9D63E9E33B906838E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 46.5MB
SHA256 57ba8478f79ff5a13b94bebe903e09a51861713878df75589888c955e050c542
MD5 ad80117399460ff9f715dea87e198aeb
SHA1 e01e0b59cdd7d3bc3c5dc20ef471c8f9a021862a
SHA512 5b80b7751a687bd7c132dcb70b146b0a288d416c14e7f3b1bf721d6311393278deef23585c25f307591a9ad51fb549d6b87c57045a5d182a2603f81774e4f566
SSDEEP 393216:1cZEIv7cZEIv7cZEIv7cZEIv7cZEIv7cZEIvh:EEIvWEIvWEIvWEIvWEIvWEIvh
TLSH
T14FB76D0DFA9720B1D9774170498BD27B8630BE3187115AFFE7C9D63A9E33B906838A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 1.8MB
SHA256 86c7b719270af8ada9cb666bbc064eabb4640993a32f0906848ea8cae2bf3dd3
MD5 8eeecab2cbaafe9a25ad3eee0020abeb
SHA1 4d7e59c1594475d60f7df57239ea5bc2321c2d42
SHA512 875221fc4d0ea172b8da475f9710aaf6e75e5ab35eaf22817a8513605a48458e4d68ed415b1f5ed0f4905f0e9b368f7d5157a135e84c9c4d21f5e2fcbb19afb4
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+Et:F
TLSH
T170853C0DFA4710B1D97B41B0498BD27F8630BE3587115EFFEB89D63A9933B906838A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b2f62ac75a6201da1bb8736f54f30a3e47c4374e8741babd94b1ff3e35cf8867
MD5 88e38348a7befcae0dab9a7e01b3f286
SHA1 77a5c76ae859fa006aa4bfa1b2f15cfec403f157
SHA512 5eaa08dfe01fabe9113addc4a77dc833a42cebb66afca6137af04f62342fa4ed25cfa00a7374d52fd1ed7b292a20c8c119ddd05f3974617735f48e4c1592d8f6
MD5 SHA1 SHA512

Submit Download

svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCCAABABABBBBCABACBCACACCBAABBAACCABCCAABBCBABACACBC.exe
Size 7.7MB
SHA256 7eb669677a2eea6247e26bc513ea67f4157ac084d405a31e2875e2cffd9bf192
MD5 aa6ff3a2750e9a98aab32b817fdf62d6
SHA1 69604c98ba3c2d3792bb443ab903304d8641dd53
SHA512 eb08d25841f6deaf30589d12f712bac8d756551d5d3885bd971776e3f4978e0eac25b16f085e37eb06285a414d83b371d742463bd19be4da7843085b4e5bab2b
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES+ES+ElyR+ES+ES+E1+ES:XKjKWQckVgtev5mnlNLR
TLSH
T122866D0DFA9720B1D9774170498BD27B8630BE3187115AFFE7C9D63A9E33B906838A15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 7026ef14a40ec582a881e7af939cebb46fd2b7ee810084c443183fb1172e1c12
MD5 430d6d431197f807e29f0f16116f3fc3
SHA1 af26db090dc3b8e1b0bc02a3fbeee0a95bf3fc19
SHA512 b672d54fe1d570d03761271f202ca83498e2cae1ef783ad8a4956c0794a28e3a6ffcd681885a43ee4b0519f3bd7151dffd726e4ee89a60964a7aa553f51c7234
TLSH
T10301C473D4F5DC7BEC33A49BA22ADAD308A437BB685CBB0413195118A686C314E550E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1076-85-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/3004-48-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3004-70-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3004-93-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3416-49-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3416-71-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3416-0-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3416-23-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3416-12-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download