92aff8f6d47daa2d529646bba1326b2ce22dfb4883335ea036490f9c095a4046

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 5.3MB
Sample260816-a6ppvaaq21
SHA256 92aff8f6d47daa2d529646bba1326b2ce22dfb4883335ea036490f9c095a4046
MD5 23f455286d78aa4d46559b88535827e9
SHA1 1da5885ec0f5d6c842a0ae614f9f581788e0980b
SHA512 87378899cdb867b3379364849cb941746abda199ff28941862ee8d116aab87ad349ee906a8614df8206089913a1051dd2afa6959df0e0c8a0ad5abc12df3354d
SSDEEP 49152:U+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+E3:5KjKWQckVgtev5mnlNL
TLSH
T176466C09FADA0471E877617048D7C27E8A71B9618732CAEFE649C72E5E33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
3840	svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe
2784	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBABCBBCCBBCCABACBCCCBBAABBCCBACCBABBBCBCCBBAAAAABAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe"	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBACCACCAACCAAACABABCCCAABAABBBABCAACCCCBABAAACAAAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe"	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4664	sc.exe
5052	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4220	cmd.exe
4712	cmd.exe
4724	cmd.exe
2452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4320	schtasks.exe
1996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
2784	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
2784	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
3840	svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe
3840	svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
Token: SeDebugPrivilege	2784	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
Token: SeDebugPrivilege	3840	svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4220	812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 4220 wrote to memory of 4320	4220	cmd.exe	101
PID 1732 wrote to memory of 2972	1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe	102
PID 2972 wrote to memory of 3700	2972	notepad.exe	103
PID 812 wrote to memory of 4712	812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	107
PID 4712 wrote to memory of 5052	4712	cmd.exe	109
PID 812 wrote to memory of 4724	812	2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	110
PID 4724 wrote to memory of 4664	4724	cmd.exe	112
PID 1732 wrote to memory of 2452	1732	svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe	115
PID 2452 wrote to memory of 1996	2452	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_23f455286d78aa4d46559b88535827e9_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACCCACCABBBBAABBACBAABABCCAACBBBBACAAAACCBBCBBBBCCCBCACCAABCABBBBACCBCABBAAACACAABCCCAABACCCBBAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACCCACCABBBBAABBACBAABABCCAACBBBBACAAAACCBBCBBBBCCCBCACCAABCABBBBACCBCABBAAACACAABCCCAABACCCBBAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe" start= auto displayName= "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe" start= auto displayName= "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACCAAABBBAACCACCBBBBABCAAABBAAABBCBCCBCBBBCCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCBACCAABACCABAACCAABBCBCBBBBCBAABCBCCCACBBBABBABCBCAACBCACBCBBACBCAAABAAAACAACAACBBABACCBCACBCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACCBACCAABACCABAACCAABBCBCBBBBCBAABCBCCCACBBBABBABCBCAACBCACBCBBACBCAAABAAAACAACAACBBABACCBCACBCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBABBBAACBAACCACBCBABABCBCACBCCACBBBBCCAACBCBCBBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 76a88739b6b96afe11774073d48cd464592cd19f037f288b23cee59b54308046
MD5 abacfe48d04f9b97e6edc89381501126
SHA1 aed332a4285626f97dbcc89e0c7f271b56cf4e1e
SHA512 02ae4dc206b187527c409da70c20b953c5fc9ec56c32e058be31b9a7245f3f3a24498663f90113c98ca80a5337064e1c01372c57a87140b285937d8b00a68e6d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.8MB
SHA256 c5779b8baa349de3d7e7bee76a00835f6c82bd832daccbeba29a84b7ba2a5a0c
MD5 868109815658e48eb5277e6f466d62dc
SHA1 0e4082905035178f8615624cbe281c94231f7924
SHA512 9dc3bb079d24e860d7d5f9761201ec8593d22edd6bd632c99a6bce6da7af7121c229a93a89523abe504955f5a505d96f1d5cc37b2ddae9056c0a0bc5d7919ddb
SSDEEP 49152:U+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+EM:5KjKWQckVgtev5mnlNLUpiO
TLSH
T111567D09FADA4470E97761704DE7C27E8A71B9218732CADFE249872E5D33BD0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\qap`g`v~dtlq
Size 10B
SHA256 1927f44bcf83710828b34841eb5b962a22592eb331f272d9c90e62f9bacd4b50
MD5 5bc1002cb5f76a682035273b3833ab0c
SHA1 ba01ab9b56e0da256cc71daaa57aa68ef3089b3a
SHA512 9481c62d30aaf6a074d0e14b2b20b60e9d90b31fc317f55b926749378a2addbd2a3f471e2ca325c2c27e470e3a451b2741493d6ab6d300af0c95f9c17aa3592e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\qap`g`v~dtlq
Size 10B
SHA256 ee079434be19d855a0921894bc7c880029ae7eff75254339f283bc1a7124f17e
MD5 3af98a67df0cca2445b77419f6f657dc
SHA1 05eeb221c9b9a93f4ca6413d13c4ac0b3aacb7b0
SHA512 16f9524eb5e8c78b52a219cd7c64298c08eed06bc1ee76e99df4e5716138b92888699684279136db103d4670e5f8905d89bf8f8f1cd5db16ad3f197dc323016a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 ba66f92afc18af2a87866a637cf5059921ca0370a67cf62b761e7ce795359499
MD5 30286d44d4f9fe91da758891de6e9ba1
SHA1 173c64b824841799700a3bd676b8a66e19b958ea
SHA512 e8b882023d289be558bfb74c1ecaf5f0248ddbb8141c9edaa7618ff8064f687cf6d2b5a3627c4a410fa5b462c9462703ab0299a8296cc868252f4fb9c1edc3fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 740f0f69f88b7ae2fee63e8a491d90e81d52e5fecb4a15d0f6a112aa1fc16b93
MD5 f786a981a1d2e6957a704cb545a14596
SHA1 aa068815475ebdea2d82a23b47819c1c3693dbeb
SHA512 65f0fe09a49885943acef0086a06e7f75631cab7b269a4436d616b31c33b71025282b2ccd0be48d09fb51635b5a14cd72adb4f4389e5cc1da76dbc97022e66f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce53dd5f19f5db4bf848215039a93b0de5295ae06200ea8257f8e439c78cd8de
MD5 5ffefb263218fa66febcea384a2d52c7
SHA1 fb54b98a164b129d6ab7e1a464a8789075bd8612
SHA512 11c7a14d51f6817ec3ded7a0fd4511b9dff4a2502f4dbd52c3b722bf358cb670a4b7f30a10c2fb670203b1170bc1d0c1627e9f23245bfc6d694aaa93f936c1dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d1dfcf61768e44517eab522e92280122c67db008addb9cbd5da2c65b714bb29
MD5 a3d9a935efa5194f3db8af14294841c7
SHA1 a5ead5f0eacf3456f77b795d79442d20a2e96317
SHA512 42102c27055a43d350ba7c4432c9738659318bdd4ab043022b9a4a27e909dbaef81ab7c1587b7ad8b73df549bf0f32f3c12072eba28336d327c24fc6e34fd8a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79a59e1211a6fb59f11110285816aa0fbb95ede1009e0dd601ec1caca2352b77
MD5 22231cfa56f5b41c824ddf4ef1adbb05
SHA1 6438dc791f5b3a2057d9fec5a48df0e9c162135d
SHA512 da9474225718a92d3c6c92d946056abfb4b93eef180c1f7ee41547382e0a116be025989aab3f3a703c91034c158acf86f891f8dd6dd7c9645e0d72c6f1fa4162
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a1a4708ac028aafd4631ada40444ee021a8ed50343263fe857575dc7690403d9
MD5 38bdd13427f96181177cdcf3c73e676f
SHA1 45bb37a594816d8edebcb73975fe578e08f71a77
SHA512 1b215c79a96f814f602fcd36391fb59a513137aea4e7c7d9e3b8696500ceb339dc7afa8abdec689dbb970d823997656c8ae728664036029d0d342471913f31ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db09bbeb8a2efb9a8871745d765cec7460abe5a056955da4a7a01c54949d8bc0
MD5 09f4530c4fb9100524d3a933907fc97a
SHA1 ce768bdd1f7bdb82e050f4b09db5e613a953270b
SHA512 2964d8027324ca5b7da42a819d20ab8d44b480c77b0120382d6d7ede032dbc2345e5b9711d7aad911452183d1998098b0bf59fd2ca689a79b4fd6ac20b332d2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 000f72c3da639187b84b44581b23bb2e954ff0081ea691c6f50ef0d1b10614bd
MD5 a9f35b37951165352ee3adf8de64809e
SHA1 387482c6f352552a8c193b89ab3e50de1c5e0cf5
SHA512 7964461036a30b0be518e1b98c4a8941499da74b0a95033ec161aa0626b13e8a715c9963ef8f3f14c0963f11ab2b10e7d65de4e27f1cd072f14942d8620ea2fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f68ca7e8cb342210b3620ac3ff34c7bccceaac78da66a1553d77a55aedf85c67
MD5 fa91e0d58c5df17e0f38103163022701
SHA1 607165bb36d98f9ea039a0a996f780d07f18d2b1
SHA512 f2379a11b73116be2a833e22038ff6e598db94050e8bb80d0409b6ea0c52c2d35a40393dae5a8b9f56ab8b269288fa5e1d50d82e4ba9c58a3a0d23894b501d30
MD5 SHA1 SHA512

Submit Download

svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCBBAAACBCBCCCCCAABACCBAABBBCCBCACABACBBABBCAAACB.exe
Size 5.3MB
SHA256 92aff8f6d47daa2d529646bba1326b2ce22dfb4883335ea036490f9c095a4046
MD5 23f455286d78aa4d46559b88535827e9
SHA1 1da5885ec0f5d6c842a0ae614f9f581788e0980b
SHA512 87378899cdb867b3379364849cb941746abda199ff28941862ee8d116aab87ad349ee906a8614df8206089913a1051dd2afa6959df0e0c8a0ad5abc12df3354d
SSDEEP 49152:U+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+ES+ES+E7+ES+ES+ES+EFiw2F+E3:5KjKWQckVgtev5mnlNL
TLSH
T176466C09FADA0471E877617048D7C27E8A71B9618732CAEFE649C72E5E33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fa42a09dbef6c5edbd297f1f1cc938be9abc45ff401a03cc61261176c4a547e4
MD5 41f6acadca0a792ec4fc0e8d58618d34
SHA1 34f9645c55862be7a208da02176f1fc34fba1765
SHA512 bb8a0b1c2ebdd6be10f2b19a2c83f169d3bc18bf4696fe818d8e9e9cbc30ecbe137e2f1a29796d56268cab294bc0a40bc8a9d262ade1b19efc8a41066bb92dc0
TLSH
T130210854E4EACC93FA7269C7730D9ED309DA378F69586A10234E621CE6DDC318D158F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 75fa63bfaf83b21cea6421be9f0e4a167ebe2a89301ee1af26a3a0f154ef8456
MD5 48be218740f478249689b0ed56b61246
SHA1 336629bcc4a8446989d5a24b10440b3b0f86aa2c
SHA512 14a022cc2b4940adbf4fe2ab7b4372c3d927554544468c2522ad798cf05cc7f5b3fcca0065810f22a20f17ee27a4728e4f7323896adf9c3cfd94019e382489fb
TLSH
T14621EA14F4EACC93FA7269C7771DDEE2099A37CFA8585900134E9208E6DDC318D158F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9db2a49791bb0f0ea4fc2006afeeaabe59858354a6e39d282b0496bfe298f477
MD5 d4aeb12b6e0c9cea6fac188df06fbc30
SHA1 b7b8631699231368ace79abb0f117a5d5158c26d
SHA512 8b021b924f5cd5d8e32c456cf1975314e777cdd59037934267b28699f6d31e3f21868c855d082b8030406880b3fec23c035c8b8163cb6305229ac735d4186864
TLSH
T15D112714E4EADC93FA7269CB730D9ED209DA338F68586A00234E620CE699C318D154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/812-6-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/1732-36-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2784-2663-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2972-59-0x0000000005270000-0x0000000005271000-memory.dmp

Download

memory/3840-71-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/3840-2675-0x0000000000580000-0x00000000005A1000-memory.dmp

Download