2c26cfff6545e7287eda3afeea4b0ea573109cc7820b791dcb4bd7e435819b8d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 11.3MB
Sample260815-lr1pcahr21
SHA256 2c26cfff6545e7287eda3afeea4b0ea573109cc7820b791dcb4bd7e435819b8d
MD5 17c8af2617a8e617ad1ff92dcb9e3f11
SHA1 c0e9e4ed400e734942d829859fe4ac1577e88677
SHA512 dcc4d343a4a99982fab20b05bf6926b9c670823f59a8ee39774c5cb9756d9ffdbdff301ff88b4666e9fcca5dff1d3ff7f75c29868572d2e40ea4a0885f538d63
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2F+ES+E8+ES+ES+ES+E7+ES+ES+ES+K:8KjKWQckVgtev5mnlNL
TLSH
T186C64C09F9870471D97B51B04CDBD2BE8A70BA1187328EEBE649C72F6933BE16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
4388	svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
3792	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAAACCBBACABACBAAABCCCACCBCBCAACCCABBCCBCBACBBCBBACACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe"	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCCCAAABCBBCBCBACBCACBCCBBCBCACAABBAACBBCAACBAAAACCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe"	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4920	sc.exe
5088	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1648	cmd.exe
1288	cmd.exe
2036	cmd.exe
1056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1072	schtasks.exe
4328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
4388	svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
4388	svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
3792	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
3792	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
Token: SeDebugPrivilege	4388	svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
Token: SeDebugPrivilege	3792	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
368	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1288	1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	106
PID 1288 wrote to memory of 1072	1288	cmd.exe	108
PID 2124 wrote to memory of 752	2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe	109
PID 752 wrote to memory of 4772	752	notepad.exe	110
PID 1644 wrote to memory of 2036	1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	115
PID 2036 wrote to memory of 4920	2036	cmd.exe	117
PID 1644 wrote to memory of 1056	1644	2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	118
PID 1056 wrote to memory of 5088	1056	cmd.exe	120
PID 2124 wrote to memory of 1648	2124	svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe	123
PID 1648 wrote to memory of 4328	1648	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_17c8af2617a8e617ad1ff92dcb9e3f11_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCBAABBBCCAACACACBACACCABBCCCCAAABBCBCBBCBBCAACCCBBBBCBCCCAACAABBCCCACBACAABCBBACABCACBACCCACCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCCBAABBBCCAACACACBACACCABBCCCCAAABBCBCBBCBBCAACCCBBBBCBCCCAACAABBCCCACBACAABCBBACABCACBACCCACCCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe" start= auto displayName= "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe" start= auto displayName= "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAAAACAACABBBBCCBBCACBCABBCBBCAACCBAACCCAABCCCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBBACBBACACABCCCACABCACBBAAABBCCBBACCAAAACCCAABBBABBCAABCBABAACBAACACCABBBBBCACBACABBCCACCBCCACCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBBACBBACACABCCCACABCACBBAAABBCCBBACCAAAACCCAABBBABBCAABCBABAACBAACACCABBBBBCACBACABBCCACCBCCACCCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBAAAACAAACABACAABACBCACAABABCCBBBACBBCABACACCBCACCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 78c322e4d866e425b4265ad53e694ae8ae2c20ce2050beca1b943bfd90242657
MD5 578e718882a3f5151bdd75539647a4ab
SHA1 ec649df2945fdcf0d9f4d578fe0bad50510d5b89
SHA512 08adf2855482741258674617e1414c15645e262bcf869e9b5814e4f42c072c2ed509dd93b53017143f663d43e5c43c618b198e6faf780c697c0919c469d7a3cf
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.8MB
SHA256 27ca8f0bade1c9f4a33e75ef75542f6d8fc68951ffbd92c07ee9e5ccb8590de2
MD5 701ea1cd082a2fee638a788bd69ca4e1
SHA1 0a8ccded2702aa962b391f614b9b0ce7b9a0302a
SHA512 fc24333461460d26cde30a99c54e1d9862fe202dab2b26a67c8a8f2b3752e42c61e136bfbee12de0c5eceff34d97b14097e7cc4ac5710dbebe4a8ce30283ecd4
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2F+ES+E8+ES+ES+ES+E7+ES+ES+ES+z:8KjKWQckVgtev5mnlNLUpi8
TLSH
T1B0C64B09F9C70471E97751704CDBD2BE8A71BA2187328EEBE649C62F6933BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 cf5309a49a4315df63ae5a9616ed097709db3869a68c0bca2bd2fb4ffe754c30
MD5 a44734334eddc5cfdb4866779732e608
SHA1 4eee06cfb198aa0aef76937651ddac1b9ed53b5b
SHA512 9c7c867c0a260c0bd2cc56638cba8ea7f3d5deefa35ef150788ac6d26db0fabfdaa33e3f4444ce04ba1f7553984d2e34a77c4606452ec071d49d3e22ee03cfc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a008841c8f2cd99069431581ee11b3ec5ad93c55d4a2d528b21548d963090b18
MD5 234c16f23ec1b1cbd670cdbe98ec0e41
SHA1 a803828c72aa352126bd0771ca93c2da468e0f37
SHA512 80e3711f1378c18d061b2a340cd442919ce04725b1ce664900593f36fe1b8330c737a1e60aeb6a474475422ea4a0155d23030e01d668fd5199106eeed12729a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 9604e729a5cabc397d4f7799fe7be7345d78a54a40348357963d3b51631ee34c
MD5 f7fd4d6a8984a71e1a26d55fd569246c
SHA1 18885029cc28d95cd79fc9da85aaca84f06b6e94
SHA512 a1deecdf44b74fa0f5f82a4ae616b91002ef21fe20dbdc73674f66b636ee3c84205bb596a793aac4eb4e3422fe858e570176a5f3f9f05193a7482f7f8f040506
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 90108be152b41e853a3f558e10e8c76a9d2a67ab5f88181740c287d4d83067ed
MD5 f0e1c3f4430c0cc6f504ec42ad501fb8
SHA1 88cbe2b7723221f2f35d9cb0f7b80ae2388f66ea
SHA512 c42ef36da8c87dc02b0ddd293e5058f61d8a578b051cea0e037df694ff49251e6dd83c80635c5aaaa70061eb828717f7f5c7cc5fd17e61c72d4c22ad5d8afc53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 02c5948b63baa284ffb347086ad00b41d11fbe2a13d7273fa4e5af93cc914b1d
MD5 d2b2084919b63c5b86bd582fd36e2538
SHA1 b67d0a56a9cd1eb32f247040d274ebd66daf98e3
SHA512 3b7dd6bc3e1754d2790589f91ff3a432a58555799607f907c03daaa9f43013b8801c200fce3d9bbbf7e375acba237584a84c7cdb1e2a679f3cd3b8a265b246b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 5c2c3a8e1bc81f119c59e716e378368643955d0cb93317f74fbbaefc4f2519ed
MD5 7930ffbc7ac8a9f14b69d9db7544859e
SHA1 f7db2af54b52cac28b41052367ebd6ae1e7b4871
SHA512 85de19a4a6054c3cc0b4a269235cf60fe2f306e861bb4dd2c91edf01f4da054ec04a19a0072d568b21c48f26f57bdc8c3816198b3383ce46dca15ee849b2d63c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 030aa727974707a3b26c48bee9dd67a212f22eabdd1afbd1ec2c83799b9d723d
MD5 c66ea772c498826d6eca1894e345bbfd
SHA1 3ad0496944f0fbc507f24f35c8535cc44d934e81
SHA512 43e655994e1d7abbe5bfa7c2a835d2d19c6ba059f7bd2ea42276c94ae195496c8cbbbf00058b33d7660d63277fccbf49eaf2eaed54eb131de89cda3bde2c8c42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8525791c8722209c22c574590037c68015f50938977d927b47270c51c84d7ac
MD5 84cb804590777930633ca8154bc491f7
SHA1 cf7e0934b030a9bf75d7fae40489a449115d6427
SHA512 7df8ba34bae9599d5f14e283d42b5b0c04175bb8ce5b39ea96afbe46575fa68f766f043ab980e1d4b30251ccee451ce768c8169047b72cf08391b49af6b4a9b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9227184ad478befbe648e2805a8c8dedd2c29e768523808fab23e22d7c5dc0fc
MD5 98cade88d69c1dc8e7714bdd9bf6b503
SHA1 20da2260d7fc0587edae0f8ca4d06d4acd95f0da
SHA512 6a63c38d3fe671d9c3b5d706462a7e8da21441e6ca3291a54f262c3cd0abb946956f0ac129e50776dca26c8cdca0b09a3959694c984c125c0bfae76d7d57ab4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9702118b6f8b845af97581ecff8426b42dc8dd090a6b25867f7d25e2fcb3cb59
MD5 debe6255b2e87c8298f9750d492d0630
SHA1 87bee172ee04addea3bbd1aaebb6fd50a607c960
SHA512 4142f594df1e9b4456a3b0865f3a79b8ad693bffba3c7032004f48f35eb35debd4ba4ab088274ad6ed13d5f01b9e24b015727f23bdc666823069222e87e473ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70c76771c31880f15d2029ff46fe14f300e694f2863c42e66ef8fc3325876e6e
MD5 c57db4ba10f90c98eca044faefa07ef4
SHA1 212b3027cabf55208b05ed42f1d559c17bc22ab7
SHA512 8bc034228579aacdadb46d985ffef3681fbe9265662f91a52d856e821e6fe06aaf683af6d1ceeeadd1eec51b9ae288761298cbaa4381c76b67fddd201b21f57c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6899147def0123a889f9c5792d9e067de4c62e390090103a0ecba89286eb328
MD5 145980fbdad287f56872a08653bdb2d6
SHA1 23484e979fdedaf636307d4487f9859b284765c8
SHA512 ad33fa6dbde7f58f66cdbd60a3240a629832ce0dea9ca43c4164bd77875c22db6c4b4f2bd3dd3b2db7c79d477b29bdf0fff788c4ba94fdcd4c78b8d6b0b468e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7c3f0f2372ebe1725070b086875e46d017b45602a008fd2a3608154f951ec5d7
MD5 dbf53fd8d72750695cb95f25c57ffd29
SHA1 d7efa34dca654702627de68253c6bc7bd9d849ae
SHA512 60d1386d8d9f98f0487371637d819462419788a8a06bb4332cc3f5a98620615642f83dd28ffaeaa9801b48ccfcec0dda7794dfc2bd1c8bd6f0229830d06f2062
MD5 SHA1 SHA512

Submit Download

svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBACCBABBBABBCBABAABCCCBBBCCCACCACCCCACBBACBAACBACC.exe
Size 11.3MB
SHA256 2c26cfff6545e7287eda3afeea4b0ea573109cc7820b791dcb4bd7e435819b8d
MD5 17c8af2617a8e617ad1ff92dcb9e3f11
SHA1 c0e9e4ed400e734942d829859fe4ac1577e88677
SHA512 dcc4d343a4a99982fab20b05bf6926b9c670823f59a8ee39774c5cb9756d9ffdbdff301ff88b4666e9fcca5dff1d3ff7f75c29868572d2e40ea4a0885f538d63
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2F+ES+E8+ES+ES+ES+E7+ES+ES+ES+K:8KjKWQckVgtev5mnlNL
TLSH
T186C64C09F9870471D97B51B04CDBD2BE8A70BA1187328EEBE649C72F6933BE16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a066a425abb3f46f27b6284620f36410770a3121e01ceaf0e9e90d3ffcfd3508
MD5 e2596988aaeb5a5edb3e50fe5c91f7f2
SHA1 2a98b8d0ac25b4e72de875b0f57361ff5b9809de
SHA512 af96660b191d2159db063580f534c293625f5f6648c7ccdd91c4d851992b015c6e72078b0f4a3302ccf44a4311fc7e075235580a762ee70eb244797e0874c838
TLSH
T17621D872E4A4CC67F96368CB9E59DBD20DB83BBFAC5C6D0012098B18AB98C328D154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 78e4fdc31aaee41837e31f18a0fd50f9beecfd821412ca2f7ad15fbed4990d2d
MD5 ba50184ef8b7b5143873b6c781827727
SHA1 9749738f15d351eb3ba01177772c05992ca48e80
SHA512 60fcd476e161c81c5ce3e7e496e3ad5e9bcec88dfb8ce6fb1710e52c2bec1edefb81a8d1ab82941744ca4728f8321ed5fc0f4569dea9515143067477d4516153
TLSH
T15311E772B4E5DC17F96368CB9E198BC30DF83ABFAC5C6E0522098B1C6B54C31CE15492
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fd27130ca95c034f5fc13637ab6243b94a837664f9684b08b87cf087ca9aed08
MD5 d01040802cb1e33c47d963d6df5bc3f5
SHA1 496737ea2f4713daf8e0e7c3400bf851b2493cd0
SHA512 009e23c4373f74c6c88b21e8596d3ef1a926bb7d3243ff088c0d08a275dcad58dd567c26121d293e4f9a3f6ec85e6d888c5d15ad34f14594b9897658ca731ed1
TLSH
T14421F962F4E5CC17F97368CB9E59CBC30DB83ABFA81C6E1022098B186798C318E154D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-60-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download

memory/1644-6-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/2124-36-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3792-2363-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4388-76-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4388-1813-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download