04785551dba9520b4924e68e59feae6e42add9d3850ccf20287f5ca801314181

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 5.6MB
Sample260815-jqg5hasbme
SHA256 04785551dba9520b4924e68e59feae6e42add9d3850ccf20287f5ca801314181
MD5 26ebab3df55713b9d0bf5f97705c1c34
SHA1 4a2c73a18965aaf5ebb8b20fd3d2e73782ee04e9
SHA512 c3e55cac25c8d7d7fccd3961323e7b3993a161d1416c4be310dc8f7ce4ee67b2e41e7db28d4a975697bd375b710a5c842429946ae22088831a279fa0f45dc77f
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ESW:5KjKWQckVgtev5mnlNL
TLSH
T1B7466C09FADA0471E877617048DBD27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
4612	svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
3944	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABAACBBCCCAAAAABACBCBACCACAACCACACBABABBBBBBBAAACBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe"	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAAAAABCABBBACCBBABCCCCABCBCAACCACBBBCCBBABABAACBACBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe"	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1456	sc.exe
3960	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1452	cmd.exe
2448	cmd.exe
2580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
4612	svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
4612	svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
3944	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
3944	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
Token: SeDebugPrivilege	4612	svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
Token: SeDebugPrivilege	3944	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2580	3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 2580 wrote to memory of 4728	2580	cmd.exe	94
PID 2548 wrote to memory of 1700	2548	svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe	95
PID 3556 wrote to memory of 1452	3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 1452 wrote to memory of 1456	1452	cmd.exe	100
PID 3556 wrote to memory of 2448	3556	2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 2448 wrote to memory of 3960	2448	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_26ebab3df55713b9d0bf5f97705c1c34_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCACACBBBCCBCCCBACAABAAACACACCABABABACABBAABBACACACCACBCACABCABAACBABAAAABBBBAAACBCBBCCCBCCABACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACCACACBBBCCBCCCBACAABAAACACACCABABABACABBAABBACACACCACBCACABCABAACBABAAAABBBBAAACBCBBCCCBCCABACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe" start= auto displayName= "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe" start= auto displayName= "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCAACABBABBBAACAABBACBBCBCAABCABABBCCBCABABAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBCBCAAACABCCABCABCCBCACABCABCBCACBCBCACABCCCBBCCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2511a2ee28745a0f741fb8b5af0c9b67935dfc1c6224cec26389a7e39dc0f6bd
MD5 d7b697c9d30c7826f267a3e8cf5e1e68
SHA1 9e9959619ec573e017fc4c336d5015582379b86e
SHA512 fece11b02573934cf361bbad1755c55ffbb2b908ab9be704b5744fef14b7a57bfaaecec66ba58a188fe4d9272b0513e2f6d7f8c4f01cec9dff2af0f444fa2b66
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c1a6f69e52bf57f4dcadb7dcbdac3e1179b7aaaa98c75d63a6ce8ac6b386332
MD5 4abbeb8887a4da7857f4d000b9d1f4b1
SHA1 150f6d3d70d48f4cadfe99a85acb0af49672f1a3
SHA512 13fcc9ae01942815a443b2a0d1bb9f6b626c34ff761a4d16580ec0de7443b12775c1f7a6e21ae55309ab6b106815418378b63402c6d85f72d7213a34430e8892
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7a108880f11942bd89a26dc96999c1b1d39fe5a36a28a2f7dea7aee50c9defff
MD5 ffcb0dde0dfa2deb479814c4e2afb925
SHA1 f1a379ebb4867327e7ae4ed4bbd148bbc6d67e51
SHA512 32e3986346a97a37e48d16fc646b6d2335118d58afc2235062ff00723a6a6da001d07e39a4ff5424bcb64c54548cb56574eadfcffa2ff4b7a7c12375a050a39d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1761251f55a7201ea8d24cb2be50a6380ef9e49de2400278474b11f4c73b77cc
MD5 a98b47f4189f87746d0325f9ff5722a3
SHA1 64b9ad18df738db15c919aa1356aacfabcc5e226
SHA512 64a47712099d52819098221b2c829628949e08bd1ba6fddc5471be720e4d93a258728427faa6c5d896b50b6ce9d7824566ebd57cbc10096a7a1a3154bec4e1d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3c42de91e9ba730a08a05ae8cf6ef53381dab37860cee5d8e268f602e6bad504
MD5 22cc55bc84a9710ecafdff2fa40c3e5f
SHA1 4cd2610df0fcc4a13341c5fd0a6fc60dd0627475
SHA512 9b7197c9b7356f5771f334629a3bcbabdcee5bca5c0d58aa2aa60609db9d760ccc1859efe7695307a1d1913807d09fd913332810f7b8eb85b6be3642ddd84004
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7c055a7693d640a06a53ab762c91d6006701b8f8516a5d97be0cb672908bdde
MD5 f6d2dabd6d528f894953f33383ae77e1
SHA1 6a70e0d53f6db63448dce56705fb0478171cc073
SHA512 9dde8e71c79b858afef0f655d8050f643094f91073b1c077faa8ecb6c54448f2cf4995914047f2c5f6dfea753778e993a658f1cf2cc2e8e0272e11c2b7ee86e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 714641a6da9794a3c85920bdcaaf674f3d534d1651afec58f0733c678978c3b1
MD5 1fb980929cf2d58e40ab5a94f6b4c019
SHA1 4c0bb7a334a15beaa074272207fced260fffafb3
SHA512 a50b1d79978f9b7244b57da754a8893c33679b8d69ab96f117fe223870f540d51452e7cc0642e6f79e68b9824421e755569ae8f64d7698c04618a0425de452b8
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 17.4MB
SHA256 c7e9acc6b31bfff08616dc6b34b9403b30662e1a9598d580ea84a5102786f4af
MD5 62964386e33efb5d55e4d9b4c4a35b0b
SHA1 3287d6ee5917deb8e9be0399832677b499fe7242
SHA512 c8419c62f3187a3d0085ac533d0b78198d31451c07b92573c5e1933808b973aabf7e1f5b8642a746ba1767dbcc593dbd9a79534e6ef91266c2f922a3e8b3272b
SSDEEP 196608:mKWQc0gEYnvLOKWQc0gEYnvLOKWQc0gEYnvLGcyK:3cZEIvjcZEIvjcZEIvF
TLSH
T183076C09FADA0471E877617048DBD27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 34.2MB
SHA256 46ae99b70720cec52fb127ce0586ad5ebe3b27ffaf3409bc056a6c44dfeaba8a
MD5 9bd71c560b5ddc688795f28bd9b18fe2
SHA1 c3595e75bdac47e554caec9b04a333ca780c5467
SHA512 a3fee78a8a7bed98a63a7dfbe4fd8e6ae0170f55272c68bda625317603116d09e15cde0414f26822ba86edf7dbc4bc84d506f24a9ffef87b81072cce20aa6c79
SSDEEP 393216:3cZEIvjcZEIvjcZEIvjcZEIvjcZEIvjcZEIvN:qEIv+EIv+EIv+EIv+EIv+EIvN
TLSH
T1EA776C09FADA0471E877617048DBD27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 320KB
SHA256 3d2d9f69464c72d60be77dbd0c8da1a340844063c7cb2a9686b00e7118d40dc9
MD5 855b3391d2a9b6d8702d38d69e2f70ed
SHA1 2b37fd605df405ad3f38e2f922f7b14769e12aa8
SHA512 9939083a0b131f0c7642fcabafb05e271feccc900a4ce86bf5235c8dfaac47b70a15e32732f89657db09a9eae600fca92bcc44790567720ac5f6bd382e9ff066
SSDEEP 6144:m+dTTUFgEs3XojAdI+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+dTTUFgEs3Xo0:mgUFgEsnojAKgUFgEsnojA9gUFgEsnoJ
TLSH
T164641909F94340B1D92B51B04DCFE3BF8A60BB2586128EF7FB4ECB5BB523B616428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 512KB
SHA256 d7cbcacfd9b1b26ba91dd446e05230dd5c7e8210af245bb48ac2051d9050922c
MD5 edaddd0fe2da22112cf86cef5444689d
SHA1 7e9be1f76a8a63d218187c7173fba62af477627f
SHA512 9ea0a37fadd3bb5e0d51e0d6b950b81b0977e80e2ffb9189b05836062e5a27133da37a37fe04c581d20441ed28f030d720e6eaf7aae16c0887e4dd687ed3630f
SSDEEP 12288:mgUFgEsnojAKgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsntzLic:m9+EM0v9+EM0q9+EM0q9+EM0q9+EMt3l
TLSH
T14EB43A09F98740B1D92B50B04CCBD2BFCAB0BA2587124DE7FB4DCB5B6933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 384KB
SHA256 34fe3d3a51532bc92658bcc5fdee6f1dfc762e58a5741b3b5008c5e0134a5440
MD5 9b1e8557dc5b0853cec257c57ceddf7a
SHA1 ba4bd125175fe18ae7a71f78536142c08b3b2941
SHA512 370a670b746861117e6d5f2ac6efcb3537db1f93a012f3253befab04c4baa2dc1d0ad27cda582caedd3a246c5914a528cbec1ad23f61612a5c70fb76a1c8c853
SSDEEP 6144:m+dTTUFgEs3XojAdI+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+dTTUFgEs3XojAN:mgUFgEsnojAKgUFgEsnojA9gUFgEsnot
TLSH
T1EE840A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABABCBACCCCABABBCAAACAAACAABBBCACCABCCBCBCBCBBBBAACCA.exe
Size 5.6MB
SHA256 04785551dba9520b4924e68e59feae6e42add9d3850ccf20287f5ca801314181
MD5 26ebab3df55713b9d0bf5f97705c1c34
SHA1 4a2c73a18965aaf5ebb8b20fd3d2e73782ee04e9
SHA512 c3e55cac25c8d7d7fccd3961323e7b3993a161d1416c4be310dc8f7ce4ee67b2e41e7db28d4a975697bd375b710a5c842429946ae22088831a279fa0f45dc77f
SSDEEP 49152:U+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ESW:5KjKWQckVgtev5mnlNL
TLSH
T1B7466C09FADA0471E877617048DBD27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f49895e9ad81deb842f67fc33bfc8e32781a34ed52754e9b1f7d8dff7992e5dd
MD5 4c404663899f9cfe9be6589cad6a0c91
SHA1 9413bde9e0cdeae0dadfd2816445e6c4e5cae703
SHA512 96aaf83c5cd4ec7d241c16ae7ab84d8ec04858787fae2540b615cd6025cb9d20fa62ceb2e3aa0e818bbc64edd9b158762458716abbe51764dce31e7928299ab6
TLSH
T1D821A1A1A4A5C873F932699F5D39CFA30CF43BAFDD9C6E14234801196795C32CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d6954e88adb17ddbe9c0e059f456d56cd4da8d2491d823fe566f29d4447526cb
MD5 e8dcd2f7fa01836242ce2dcbdb7c2595
SHA1 d1d8b571c6712c344370c24eaa853ecb25463374
SHA512 a344e2cd50caf358a3f6a0189597c9a2477afa15c34ac160fc7abd2a5a14e0b5a99f50391e7060e31df8bee347233bd88368622696a9d45558ef909612a46b19
TLSH
T19111E3A1A4A5D873F932299F1D39CFB30CF03BAF9D986E14234801186795C36CE254E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2548-49-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2548-71-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2548-34-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/3556-70-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3556-0-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3556-48-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3556-23-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3556-12-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4612-107-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download