ad72b01a37aefa4f2734909b720b3ff0e97c9da0f91553cf2a5f70d03c6e2e6a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 5.4MB
Sample260816-ejyfpayhkd
SHA256 ad72b01a37aefa4f2734909b720b3ff0e97c9da0f91553cf2a5f70d03c6e2e6a
MD5 a5608772f20c98c992d4472b65410153
SHA1 781c7b28a01de2ebdb53aab6a31c53b86b8a0312
SHA512 d9751cb7881991cb7502d56f286565c4e773d11689b9e87123fda02a2b07a7fa76b609c443cdc3226a3d4180e1d565c7ac66a9ba6b128d11738120aef9af9885
SSDEEP 49152:U+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+EqgP:wKjKWQckVgtev5mnlNLV
TLSH
T122467D09BBD920A5E5B7427099A6C2768630BD34471197FFA6C4D67E9E33BC0AC34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
2956	svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
4340	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCACBBCCABCCABCACCABCACBABBCABCCABBBAABAABAACBACBBBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe"	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBAAAAABACACBAABACBABCCABACBACBBBBAABCCCCBCACBACCBCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe"	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
564	sc.exe
4544	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe
4048	cmd.exe
1268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
2956	svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
2956	svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
4340	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
4340	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
Token: SeDebugPrivilege	2956	svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
Token: SeDebugPrivilege	4340	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3448	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2508	4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	90
PID 2508 wrote to memory of 2620	2508	cmd.exe	92
PID 4024 wrote to memory of 3912	4024	svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe	93
PID 3912 wrote to memory of 4572	3912	notepad.exe	94
PID 4040 wrote to memory of 4048	4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	104
PID 4048 wrote to memory of 564	4048	cmd.exe	106
PID 4040 wrote to memory of 1268	4040	2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	107
PID 1268 wrote to memory of 4544	1268	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a5608772f20c98c992d4472b65410153_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCAABBABCCACCBCBBBCCACCBCAAACCABAABBCBCCBBBBCBABCBACACCBCACCCCCBAABCAACCBABAABBCBBBAACCABCCAABCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCAABBABCCACCBCBBBCCACCBCAAACCABAABBCBCCBBBBCBABCBACACCBCACCCCCBAABCAACCBABAABBCBBBAACCABCCAABCABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe" start= auto displayName= "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe" start= auto displayName= "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBAACBCACAACAABACBBBCCCCACCCBAABBCBCBCAABBABACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAAACCBBCBABAABBAAACBACCBBCCABCAAABAABBBCCABBCCACCBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 76f26bb126d906bc4fe4ed93c3267712e0ac3469897a75d85fa47bb7119fd4c3
MD5 ad9b8d2840b1139dc92a42b1d1355110
SHA1 065ea80693725b306426d829c0e40e565da3b69b
SHA512 8acfe8d7afa7320a62132d2d94c22c49fe15e74c16b461c8d7190d427a961373f703718186cf46d75c540bc69387a6d333b7914839eaf338f58c098d0e79266e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.8MB
SHA256 a310bd462f84c7fcf3ec2d6c527f59ad6efd8a99180ca662a7f935e6889c3f44
MD5 70269561e5fddbca816c620c2ad826e1
SHA1 5f05ffc99cb991a78477e0f18d073f861741cbe0
SHA512 c6df522c1569669ba98c5950d3649a25d332fb895f41c4f7fef19f8949b59ca56984049571ccb2b19df43253ca3637f1a9f73c17cd43665261ca6c8dbe88dd4e
SSDEEP 49152:U+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqg3:wKjKWQckVgtev5mnlNLSpiZ
TLSH
T1A1566D09BBE920A5F5B7467099A682768631BD304721D7FFA6C4D63D9E32BC09C34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 e3cc13d89ed36c5b8469e759649011e060ae20919f5fadccb732e42f8ea19a50
MD5 bdb6684619bcfd0a494bd7a11920e095
SHA1 80065ad23fe089e3572c05ae81b46f7bcb65dee0
SHA512 4bf988b853d61e93b38cb376618649b481e45aeb435d951e58853a515c2f47970eca3dd61a3b61e64f6cb2ff688e3a952129d39153e851639b819c7c50150b95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\qap`g`v~dtlq
Size 10B
SHA256 1cdf0c83e8d0842ce0284ce54252690595ab93f83d68c981c2ab461a1014b9e8
MD5 29d62e553073f74eb92f15bece6cfac4
SHA1 e11ef2a73712a30d5dea23fe2caa6a1b05541a10
SHA512 323a6e9705a3e9293599ae685f5038af906d5ab31f1f90a65e1e7adc897cfa92b36a4972f1c2955896cdb640a00a1d5392721230cf4ff06cf60b30870a9fb791
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 a7cdd5af0a8b78090cda7b9e380f6120777f1c1cf21e8d92b21932addd2a6ab1
MD5 4b4deed8469348a55add4682afe600e7
SHA1 96f665653301b28d7897076c9d308b4fdc1000cc
SHA512 948dfee83e6de7a0662150b645cbdda5e1bac961d48062fe51ab05687fdd213683ab37a342ff260a2aa522ec6976ec2600fadbc20e9404cd8b96e4fb93bdeea9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\qap`g`v~dtlq
Size 10B
SHA256 2c47c06496c72e2fa505a511653d476c45a1bfa8c19d120d80b175a9281aabc6
MD5 acc04af3f6fa9f6dbeb235c7116f208a
SHA1 289496b9614196d8950325190d6c82439b7a4bb8
SHA512 56c19eef8c9dc6def5b38e8c30e32f5a399de71fd6ade966446f108c90456333caa63a02ffd4d81ea572c474915462b72682d37beb1916d6726a726e29ccd72a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80f5126509e847786ffa617a25331afb14bc4f0be140f1411d02b05bfa0349d9
MD5 77ad5c4146aff7d72924f941040f8700
SHA1 126edb33df373f4ecc5907ebd869c004972557dc
SHA512 dabdb512dddabde8e8c214cbc2d0e862c64e8cfc846d985bf5131d4244ad8dcc5a0438699e009b3fa2d21a547b1fba98dca5ba9f04d63e882df42afabeae0bb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd82cf6bb4244b1b7552d665b68d0015d093310334762a3e9cbe413a7be8140b
MD5 46639653b23b6ce5701e96af38bdbeca
SHA1 4a2d5a7a3402dfa098222fe09dac2b91df4d68f7
SHA512 79c88c5574914d5e0163ba70a9395e90a412bba248214687d3f82ad84fc405d523c1434a7e88418ae8dca1f26ce3ac4782b246e16c23f2c6d717c2097235df54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e99fa1d7b1e7254065e0189ff7f4f8ea103892f34ff02e3a5c059f259ff25dc
MD5 5eb26a1af2f1f615295553850e16c06c
SHA1 a5aac2b073a508d3f38b4106084c7936a88b5eae
SHA512 9cfbce516f25bb65d98490d2b5050c80c354578afee4fe55d5c626d357a95d94c61af9624e18ad1647c0adf4290f1c1dbca4b5c8937eb112f618a70cc351fa56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7e68342aa3a219117889b9b937fb96c54b63059aec481133c6ec8caeba004c40
MD5 4353692d34b44ece9076e6655c91ae4b
SHA1 c44c10dd2b7b863d52e127f442b4d80972b07c80
SHA512 e240253d0283b50e9809a6db42b02b79c330cbf56aea57ccb326e6ac4aeee77931041e601e9e9dcc89c1867aa662a88b9aa34eaa2c93c3df505704b2fc7be1d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 627b562982839d707f31a6b2ad127b33036e39bb6a0062a10ceb0cfafed930a8
MD5 04282d7a560a682aa13157ff7bdb8a54
SHA1 90e05c1cc8133f6b1867dcb614cd36fe9cea6708
SHA512 8207a16816f6b3e0eb8fa159b57e10890e7d8a1a4361b6c4ca6f3840c31bac8db5afda04340490282f95b332d087fc87d922d87a8b495ad99292282e442eb279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8ec4e76af64267067981bdf2698535c85c4617297fd67dc9631e823f2e5494d5
MD5 cd55856bd129ed4ba7c9bc7e050fb763
SHA1 2f01dd948f80571e9edba359ba71e4225c1ccfcc
SHA512 4d18405b9a4040c48552dc27fd8f5490577a8aa28d1f73daf39c6a7cbe86576021c24d4695ec4d04c77365fa073b54d981ebc93cf38dd825b3e4982d80ba536c
MD5 SHA1 SHA512

Submit Download

svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABABAACBCBCBBBCACACABCCCAABCBBBABBBAAABAAAAAAACABCAB.exe
Size 5.4MB
SHA256 ad72b01a37aefa4f2734909b720b3ff0e97c9da0f91553cf2a5f70d03c6e2e6a
MD5 a5608772f20c98c992d4472b65410153
SHA1 781c7b28a01de2ebdb53aab6a31c53b86b8a0312
SHA512 d9751cb7881991cb7502d56f286565c4e773d11689b9e87123fda02a2b07a7fa76b609c443cdc3226a3d4180e1d565c7ac66a9ba6b128d11738120aef9af9885
SSDEEP 49152:U+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+Eqgj+EqJ+EqgP:wKjKWQckVgtev5mnlNLV
TLSH
T122467D09BBD920A5E5B7427099A6C2768630BD34471197FFA6C4D67E9E33BC0AC34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 f4bb11f2b20dada3438c1719fbfe5189a9da088cb6bad886122d46396aed9c70
MD5 b9e30b9b873138055ae8217bd428c440
SHA1 5082a76c5a2f003cca1a8e1e39c3d225921755b3
SHA512 096d000476bf0af711b029609697b54eda1f69bdf5d09911eff713f46ee105d6df525fdf7ad68f3cff65a143f151e75be8bd131caaa489de554849b7c3c5b106
TLSH
T15611EE72E8A5D463EE3268CB832D9F430CE1774BAC9C6B0453098118EBC9D368D5D4E3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b825d47571c7078ba09354afe80c952d8efd70174356f69f117531265f1f45f9
MD5 d6d8b9ba6cf338478cdcc6392404dbb5
SHA1 e56e8fffa20549ed8d7b36875863337cfbf6984a
SHA512 fddfb93d153a8f9ff078d56720fac16ccd6ad1e614bbaffb90313a30eaf3bd43687f70b747926aa760ed3052f8e5a826bd7dad26f4ca5c918fb1be64ef393221
TLSH
T1A921C971D8A5D463EE32688BC72D9F830CA5774BAC9C6B1463058119EBC9D32CD5D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2956-935-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/2956-77-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3912-57-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/4024-35-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4024-25-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4040-6-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4340-88-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/4340-3030-0x0000000000370000-0x0000000000391000-memory.dmp

Download