b3b5a7a363d07d8d4661964eef18f913537e68db1a74d4fe7a135479538ca618

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.6MB
Sample260814-d6jqdatxbv
SHA256 b3b5a7a363d07d8d4661964eef18f913537e68db1a74d4fe7a135479538ca618
MD5 a3ecbc34df5a5b3366b49b47dbf366e0
SHA1 f6b73c24313b5238155e52d917caba949c421a69
SHA512 240793d4ca7a3e0b54e65038867ab70e7c6d7304c6f1a05909c81648cbf015547a3ace26d0c6061dc4dc0643cdcb8babfab10edc8cdbf9374a00b238bb88a1ef
SSDEEP 49152:U+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Eeg:/KjKWQckVgtev5mnlNLg
TLSH
T147175B09F94344B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
804	svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe
5220	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBCBBACABCCACBCBABAAACBACABBBBBACBACBBCBAABABAAACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe"	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCACABBCABACAABAACABABABCACCCBCCBBACAAABCCBBCABCACBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe"	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2288	sc.exe
5708	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5184	cmd.exe
5884	cmd.exe
3796	cmd.exe
2412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2116	schtasks.exe
2284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
5220	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
5220	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
804	svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe
804	svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
Token: SeDebugPrivilege	5220	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
Token: SeDebugPrivilege	804	svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 5184	4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 5184 wrote to memory of 2284	5184	cmd.exe	93
PID 2404 wrote to memory of 2540	2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe	94
PID 4840 wrote to memory of 5884	4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 5884 wrote to memory of 2288	5884	cmd.exe	99
PID 4840 wrote to memory of 3796	4840	2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 3796 wrote to memory of 5708	3796	cmd.exe	102
PID 2404 wrote to memory of 2412	2404	svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe	105
PID 2412 wrote to memory of 2116	2412	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a3ecbc34df5a5b3366b49b47dbf366e0_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACBABCAABBBBABCBBBCBCACBCACCCABCBBBCAABACCCBBCBCBACACAACCCACAAABBBBABCCCABBABACCCCABBACCABBCBCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACBABCAABBBBABCBBBCBCACBCACCCABCBBBCAABACCCBBCBCBACACAACCCACAAABBBBABCCCABBABACCCCABBACCABBCBCCABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe" start= auto displayName= "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe" start= auto displayName= "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCBCBAABBCACCCCCACACBAACCCAACCBCCBCBCACBBBCCBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBBCBACBBACCBCCBBACBACACCCCCCCBBBABBABBBABAACBCABCACBCCAAACCACACCCCABBAACCBACABCBBAAAABABBAABBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBBBCBACBBACCBCCBBACBACACCCCCCCBBBABBABBBABAACBCABCACBCCAAACCACACCCCABBAACCBACABCBBAAAABABBAABBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAABAABBCCACBBAABBAAABAABBBBABACABCBBABCABBAACCCABCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 45bb66cf5ed70dd3ffc2894efd50890f8fd9af1255597738fcc93bbb0238fe8d
MD5 106de9c75d4fc2f67ba630439b3fa2d9
SHA1 c5ed42b16e8cc6a915238d33336941ad025c6006
SHA512 5574d8167a374a3920f49e2d05ffdba9acd8484d3f837dcf60375552cf5ab46d523003208f10283ff3a48c5f70e7cc890a318b33bed3f68b6241adb79bce03c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 6131add83a5f3f6d040e12d89af62eaf573dbb7fb7e284ba03fa5c0fdfac7f1d
MD5 08e56a2250c5252fd4089f69bd0b3b0b
SHA1 80d15244d5a068537097ef9d6fd394d9b7bb8f10
SHA512 5c3b0264f76e0d87135528d72042cb2ff9c7d602697f097a2506a396eb74b67bb4fb571e2207adb45f652bdff5a8d77a9adde6d052707c04ea7d59c3397d337f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Provisioning\AssetCache\CellularUx\qap`g`v~dtlq
Size 10B
SHA256 bab0ad5ebb361d4714cd6c37a3c2810790cb9032e5964c1b07519f0620e1450f
MD5 74bc654c5e05b06a1d7b6057f6401e25
SHA1 48a98f4f6b9f8b717e4f6431bf308c53b19b2f7c
SHA512 7cc314f04e1ee622550437e935137b716c1ba79b2cc92d83aba29a7ef08be2ec05cf041e10d912ca5b44c4af72c7c4dd6aadfb802e349293463c09a5a0c5a570
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.2MB
SHA256 ca004a8772089c364145057806c686a937992a7c7b0e564e796452749fe673d1
MD5 e09038ebcb288ff5590e2b4976b5e31e
SHA1 82a6dd7f923a1eb5cc52ae3a2f572bbbac1c569f
SHA512 d8233ce3197cd4b6700668db11c383179b6e2f56073d74bf6827bd0698100cee80ce7baab9d8d25a616451db4feab6fe4561284debf9114130316df7c2b9bb14
SSDEEP 49152:U+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ees:/KjKWQckVgtev5mnlNLfgZ2Hb9t+2x4
TLSH
T17B176C09F94340B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 e0cbabbab20e2979651deff4287745946aee1e61571e242c1b46abc71d93c053
MD5 278a2af1c6cbcf296096f700316beff1
SHA1 e295070ff409b7dc52198b0e2adf6a03a72f2bf3
SHA512 f6207effc0e58f7e56ed104914d2972e99e0bd058104a025f4e93348f4775df20821c7ef7682a61a1d91cc527a002397b259ac3ea977b81e744a3ade1b931927
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 c9eaca4732d1142feb3b8d741868aa04beb6ea56d93afdb4912e99b18988c2b4
MD5 a8c1a6cf4444d0c7e8de3fadd47ce44b
SHA1 d5069ced97f4de240e43760c7c0dc507433f1237
SHA512 29fb402257d594a0c249be90564d233d7f4dba496b26c2e9b82db68bfed9f3a7427a3607cbc65be7fcbcd6a31ad647d09d3ac36485fe052232f24aef6e3b127a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 27a6cdcd532698031ba3d63e85147d444f4db048ceb4d4ce4afd61440949021d
MD5 d41ca16f2861dd52c63a795123f86dca
SHA1 1f7b5de53c8293cc83de287a45761135e3d0b33c
SHA512 31ca20b85761f2a6fe66436cb38d32625e75fa15e29ccb2c8888968a354d005a078168b5783ddb42de27818f5565dc91b6359b9918b8b82e16ca82ea2eb9ebd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 900575ebe868eea767c4d7387c29ffd8bde9d443d15aa1ebf4a7189d889f9135
MD5 7ab5fa9edf7d1f7a9adb45dd30392b28
SHA1 869cd712954b57837616d98b0fa579241380c545
SHA512 9fbfce86f40cd687fa4e35e58899d5845a3320e60a35f742dbb2ef55770bf6c586fb5f9ae56e320c6a32c663125fd483fad94225ebcba354370099d0f3c05afb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Recovery\qap`g`v~dtlq
Size 10B
SHA256 e363e420e516261a7dd88091e0553f62338e0e868feba8971c80c183e805eb96
MD5 dc5d6981d2f98ff4a10ef8cd72c8c0df
SHA1 38e7e8fbb1cf96d6f1c46915471c0e507c166ac8
SHA512 307252dcb3ef002ec57b8aa3db66a1c641ae6e121388073028d3876b7c47f02fa89b8453d03cfb2beb3b023911c999ea85016f9a08a880f07302e12ecfca7ae4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 d83e592092972fa1f4605252f00b418e8e7bd636475c8f9f2e0ab52543caf332
MD5 3db87d3441d79411fc82a3640c51161b
SHA1 1a94e541aaa31955918a55c81e68cbf8ad23ddab
SHA512 84dcc8f85bcacedf33adc4d62efa9100e7a76be01d8a209e134797d0cdaf4815b1bad3faf278cdbca2e33720f6bb7b8961e168db7369a05109a8c9e0d6ab3624
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 d1ce99b057fcbea878a30ca79f1fb3a0ec09bb00a0484d6eaaf9aa1a546f527d
MD5 a5f1a96f29ce49ddcbfbfa0ef91b8317
SHA1 4f0441675e6d0d7fd9c4a8f5f38809b392214451
SHA512 c4c2d628ebcd40370f890c4511f808253dc7b8f63dbfca5b92258152b91c61b3fea9ec6c30fd5457cf354a83f509b52a75507f7dbe605bf6c562de5f06e38839
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\PingRedo\qap`g`v~dtlq
Size 10B
SHA256 156d559d125f30fcdf846d39a489e72c491dfcb4bb00dfe275e8c54c42bef487
MD5 6718706d6fb9ae40bd44b440d1198570
SHA1 228781071a3d271890cd74427da717fb80cfe336
SHA512 0cad401e5b50da4dd9eafb6d1ded976c274f85f6de53d2650e92be86086fd825d04f4538f438871cf4390137855bb96bad9e657dfe6c49fa6888f82d95058eac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1eec36ace66044aeef8ad32f20d528c399faeab2a6d47a98866fda8ad01e539
MD5 cfdb0a967ee12ef31f6e6bddc5aea5a2
SHA1 d830415e3716e3f0b87d52e8a9ab217f17712a2a
SHA512 86b16ff30e8b50aca9edde0b99b0271a5320c438ddbaa8336352e297083c0e8bd4a2f23d0227cc5bb1b04d9acaf18d8ab3b273fab43362cb876d6bdf495aad98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b641c9abf9a8b46e29a52bcaf890f3df29454e095639e35e135fa709a25eb06
MD5 b580ab9b30819a4ccd77b20d583ca846
SHA1 df5357aa16a93f0506441aebe3ed06a32d7de836
SHA512 738c81650ac09b4acbaaaa592dbb6dc5ba8b6b656d90de61c1ba020f236a06e9bd372fba2a9ebf0390ad1f809c3979742d49a23b6f2a90c3ff6d0cfe8b285589
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1430207bc342864b96a2e7e0f30e977374a87daecd0242791b6aa50c078c6ae4
MD5 e562859bc39afe98976ff876d02f22b7
SHA1 f1e9abac6c0ece719615017f6aec48f1be9eca16
SHA512 9c96a1c48ea452bba9a2367326ba7cbe014661f1c64766af0323dc809971afc2f8452f8ee39e06597a0d7fd9572d9c107557daf635b32fb38df20436ccd0851b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 883bcab66d095dba7bb98b53b1bcee59b58889185e831f356359b3cf54dc824b
MD5 e76862964822f93ec169ce6f1763d673
SHA1 a150710012b3554ee5bba461a0791e07dd790e0e
SHA512 740011d9b57bf3ebd9780adcba878b1153c3914bf9887b5eb15030469b20877f2e0b51b2221d9dd25fe5b2624770b8e207b9b3451316b6a18e1b4a7352cf2220
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Saved Games\qap`g`v~dtlq
Size 10B
SHA256 c2b26a13458a40983082a14417ecf90a652d70608f78ba4ddd46551cdade1f93
MD5 65fe6c035999a8cb901a1be0e67cbb5f
SHA1 4f3cf93e98c889fec3e4efa8cc2efbfdcb366422
SHA512 e8a1e1bb56df0cb18a7630b24066e71dcee83c1997bd5fd74f3fc69dfe2a823d1272a78c50179f87666694756faddfa7665d372244f2f2dd53a0c6cce5599c8e
MD5 SHA1 SHA512

Submit Download

svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABACBCBCCCACCCAABCBCBBCACCBBCABBACBCABCBCABCBACAC.exe
Size 18.6MB
SHA256 b3b5a7a363d07d8d4661964eef18f913537e68db1a74d4fe7a135479538ca618
MD5 a3ecbc34df5a5b3366b49b47dbf366e0
SHA1 f6b73c24313b5238155e52d917caba949c421a69
SHA512 240793d4ca7a3e0b54e65038867ab70e7c6d7304c6f1a05909c81648cbf015547a3ace26d0c6061dc4dc0643cdcb8babfab10edc8cdbf9374a00b238bb88a1ef
SSDEEP 49152:U+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Eeg:/KjKWQckVgtev5mnlNLg
TLSH
T147175B09F94344B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d83a45206e73efcb2356898277c200af636d0b2129f93c7752ee78f631595d6a
MD5 7e6b9b5f976b70f19d994067d5c64af0
SHA1 c119e54c0ba1fc2029fef9df4fb2d5b9956d84ba
SHA512 f8729382323f8831c4379c250381e29ff4423d94ba89d7faf52323c053428dccb881e1a8d386a45ad28040196ea73ed336c91bcf574fac39c3b21efc58f152e4
TLSH
T1E0110B91E4E4C867EC3274CF921ACBD208A4739B9D5CAA2653094628FBC9C338D190E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 15de330b4e88c95d4de37696c219107a0f679b31b924146ebc950cd0bb4c3211
MD5 487b9ee5e3dad5390572b00fbae3b3ae
SHA1 43e99ee4ebd819b888395f3b9da1eb56b29f542f
SHA512 7bf7d565eacff90980726d3d30964cac76338388e0174d9bdf9f2364aa4250fdbc4eaa0447b1a22c5d3d9ba54dcfb8672cdbe24f4ef2b5af09eec1f174631c12
TLSH
T1C521EAD1E4E4C867FC3274CF931ACBD208A4779B9D5CAA2693094628FBD9C338D190E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 779fcc74dbccc3b0a9f6b711fe40a2a679c47253d60ca7fda147e3956b286cd9
MD5 14e1a57122306826dc77aed6a075f98d
SHA1 7dec161aa221b91374681c44babc913aae33d9fe
SHA512 b50afc6691e1630d492182f5c59b8240deacc1e08fbba94d21a966252283cbf634b52f2da4b4f2fa3a28093d4e7233508ebc75797272308d4ee72ea2cfb294d6
TLSH
T16511E7D1E4E5D867EC32748F921ACBD208E477AB5D5CAA265309462DFFC9C328D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-69-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/804-3935-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/2404-33-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4840-6-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/5220-1991-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/5220-3936-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download