582d0cf3dab97f02f5969d94647473b1fbc1dbe68e5440c62c7874410eb41ce9

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 2.4MB
Sample260818-sa513avalb
SHA256 582d0cf3dab97f02f5969d94647473b1fbc1dbe68e5440c62c7874410eb41ce9
MD5 7ac159570c5b001cbbb1a7907221cf01
SHA1 373950540b26dbd30720b0262c1f3c20875cde02
SHA512 ef2eca83708f1b40ad3828681e6ccb4817bbe312b599086bea590d0bd204dc85cd5cd4f95ba75834c09d85db9aa08b5e371371ec7b4f08db037cdc58880a424f
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2Zy6i1zuajsauw:HKjKWQc+KjKWQc+KjKWQcutw
TLSH
T126C59D0DF6D600B1D93B51708997D27ACA71B93147218EEFE744CA3E6E37AD0A838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
4152	svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
1860	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAAABAACBBACACBCBACABCBBCCBBBACBCACCBACAABCAABCCAAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe"	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABACAACCACABBABACBAAACCBBBCBAAABBAABCAACABCBAABBBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe"	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1092	sc.exe
5176	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe
4704	cmd.exe
1900	cmd.exe
5988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5760	schtasks.exe
5960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
4152	svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
4152	svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
1860	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
1860	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
Token: SeDebugPrivilege	4152	svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
Token: SeDebugPrivilege	1860	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4704	3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 4704 wrote to memory of 5960	4704	cmd.exe	93
PID 3368 wrote to memory of 1960	3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe	94
PID 3116 wrote to memory of 1900	3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 1900 wrote to memory of 1092	1900	cmd.exe	99
PID 3116 wrote to memory of 5988	3116	2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 5988 wrote to memory of 5176	5988	cmd.exe	102
PID 3368 wrote to memory of 2528	3368	svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe	105
PID 2528 wrote to memory of 5760	2528	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_7ac159570c5b001cbbb1a7907221cf01_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACACCBCACBACCCBABBBCACAABABAACACCCCACCCACBBCBAAABBBBAABCACCBBAABACABACABACCBBACCABAABAAAABCBBBACAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACACCBCACBACCCBABBBCACAABABAACACCCCACCCACBBCBAAABBBBAABCACCBBAABACABACABACCBBACCABAABAAAABCBBBACAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe" start= auto displayName= "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe" start= auto displayName= "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACBBBACACCACCACCACBACCBCCCACCBBABCABAABABBCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBAABCCBACACCBBCBCAAABCCBCBBAABBBCCCCACCCBCBABBACAABCCAAACCACBBCAABBBCCBCCABAABBCCCBBCACAAACACACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBAABCCBACACCBBCBCAAABCCBCBBAABBBCCCCACCCBCBABBACAABCCAAACCACBBCAABBBCCBCCABAABBCCCBBCACAAACACACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAACCABCBCBBBCCCCBACBBBABBBAACCBBCBCCACABAACBBCACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dd402cb793a3301b004f833de83ab25be7f16439420a6b45ce6d5b4ac84e5802
MD5 c03d05ac149a768b8f65b50ad901a9e9
SHA1 8ac5e590aa753bc3789e38ee84984511184ea5b6
SHA512 d2fff5822e5d7372b2e93789d2489cdf918da4bbd9275e07da3caacb04846b3d2a3c240f2f888de6c7b56896e81382f14cefef74fd27e7646f9872db97b378d5
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.0MB
SHA256 863279403a916794b5f8df10cf54997246b2c7661353c8ae78a58359d2980475
MD5 ea334b0b4ab932fd4700ab562a722650
SHA1 36d085b9946773e50c651dfce0a9dfb074ce8317
SHA512 bc7b92396ddc9ff8437922dbff9c97a8cae727c14ab9878959182f6d2cbb1531a42a6505599370d4408dff896c7fbd12640206c3afcda564dd216c8c1998f50f
SSDEEP 98304:HKjKWQc+KjKWQc+KjKWQcutvgZ2Hb9t+2xF:sKWQcDKWQcDKWQculgZ2jF
TLSH
T124E5CF19F6D100B1D97741718996C27ADA30F53447218EEFE784CA3E7F36AD0A93AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\qap`g`v~dtlq
Size 10B
SHA256 f74b07e3a89d5104cf848c90713ba507d95c146d15ce5e12caba9f3f98cbd6fb
MD5 fd9059b8742c5bb039328b441dfaeae7
SHA1 68c396a34a202c09aebca0574d9e775b03c1483e
SHA512 c2c76f00146cad0788cdf4e80b92a9cea1c07d4dfc0372aeac91958e9a3506adf86db1c9bbb2dc5395bc13704c671484772a93c234e565375fedf113f13ee32c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\discount_infos_db\qap`g`v~dtlq
Size 10B
SHA256 04a6d87020ecd5bbc45ac6a4da5f21513f06d42dd99bee4dab0ce20c8f790969
MD5 b0721621f888f5bad250f42e1f41d1dc
SHA1 87293e260f48cda2b4612d9ffbad6f1b852a2f47
SHA512 a57c89e411d169c9b6506ed9a63630cbc5c52323364f7bb9d82cb1265d67401c89900e97da746a2ad8fc9cce05c7b552cfbac483ad5931e3ab9fc19cff1516ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\qap`g`v~dtlq
Size 10B
SHA256 89d2438d75c957b4154fe76ebe9eb5f9a6413244e8978cfd55cf069625b8ca36
MD5 c28f101d591a7a92bdd2c4aa38256f9c
SHA1 59991379abe5c769a6dcbea16c5597ace641d1c4
SHA512 d9fce18d5bb9e417965a17e329ca4e7252072292df582b57c805e5b25e40b35f06f8326a237c76157e709bb0604af294d9a2f572fdc39c0e964fa9f46a74364f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 e460e7042b067a7fcd6619be6469e6e4ebf27a2e1050cad197f7d4e7a3a0759c
MD5 e6bbc6f908b9e588cd342c2734fe7604
SHA1 b392d624a1ffbd94c78b8cd0b9a172cbb9e5c429
SHA512 78944f2b13caa0fdf534c5a4869b61d3d3b829d4de3790f865cef9c7c7c52d0f822233a71911aa474419d093a678bba76bf296399ae3c6907beb88bc244e0681
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 669fdb8d242178d984e1ad183dd179da5ee48d1ea17d4239e95aa3980c9f956f
MD5 ec45e06d1a89939490462d2f88b14ea7
SHA1 bbb82e4b43cca0d5e4d6d1d7c8c444b5cc78329b
SHA512 b451a85ebc7fa96f5a02d508cfe72ca00daee6fb967b0fba0a76ca16c1107aa14befe4efc4edd963355464fb3f426a1f3559cd4b3dd59ffb60cd33abd2ff069e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82ab9452a162bb9f1da8b34ff7838e9763b55c37a8bd22885a0b2cb83c92f464
MD5 c39231c3961de31a5b071a423dee6439
SHA1 0118cda8ccc8be84d022a3b36c53bbf44624d750
SHA512 02bb08570f10232ce0dba6a525e0075cb20087e579271729e4ca22d151739de3bf6e298fef360c9cb38b4a52dadf3ee9b1539ad17534731ae583b58ae0fa39c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b482bde7fba4b68f4d6278387b1a30e63a73275667dfa297c6b9e1b1506c283e
MD5 52b92c50776a3b7b76b864a756d55b73
SHA1 3acd9f7e13fe757928f583869d350b89bc99157e
SHA512 59bf6b32c56d273228d156ca342cc4d39acc55982a21db7b11e98bbda68e4565e726932d0a33a820352bf0154ab0b3c81adcc800363a4b3918751031ce340082
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\qap`g`v~dtlq
Size 10B
SHA256 09a6efe52b61bd76a9a8be7dca3bbceb4eae3e8c0d21c0b281795b4e6d1dc404
MD5 6f0f33646d650ae8bc6cb29cbbb0ff64
SHA1 6d95303c921d71433b7756ffda88bb5f7477ccf8
SHA512 737ce9e78b6d6d24e5ecd19d280082be39153d6f936f6a5baf4761a615f0cd5942003ca87cb7f027f642094daccb247aa72c1607c611f2606d3b08c3128a1eed
MD5 SHA1 SHA512

Submit Download

svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAAAAAACBCCBACCAABACBCCBACBABBBABACCACCBBBCAACBCCCCCC.exe
Size 2.4MB
SHA256 582d0cf3dab97f02f5969d94647473b1fbc1dbe68e5440c62c7874410eb41ce9
MD5 7ac159570c5b001cbbb1a7907221cf01
SHA1 373950540b26dbd30720b0262c1f3c20875cde02
SHA512 ef2eca83708f1b40ad3828681e6ccb4817bbe312b599086bea590d0bd204dc85cd5cd4f95ba75834c09d85db9aa08b5e371371ec7b4f08db037cdc58880a424f
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2Zy6i1zuajsauw:HKjKWQc+KjKWQc+KjKWQcutw
TLSH
T126C59D0DF6D600B1D93B51708997D27ACA71B93147218EEFE744CA3E6E37AD0A838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5eeb667a2e20d5f8c3961c4736d20ba8e3972399f4721c1fa7055ee1bfe3c84f
MD5 7db508a9db1da3c8b9f7bbd38368152b
SHA1 28ec09ba235644b8943159efc2f19e1aae360d39
SHA512 0a29c8245bc7110b0a8c8bdc67e7118d3111d65c4db6dc68720a083884eea91349fcbd7d54cbff43e7f3f02166bb8696ef59f70a556805e94861985d8899291b
TLSH
T1AB212C20F8E1DC27FD73A8CF562DCA931CA833ABD85C6905131C8228B799C328D590E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1ee87d7655d025fb083d57ca64570dd711cf1bb22801c409e1584181ee889159
MD5 c6c031eb95249e4bf376e213eedd9514
SHA1 7fe8e974610e060995a123955afa1ee224f97afb
SHA512 53a2d29494b1431168059132e91c020b6659562b1cacca9f03f5ee5ca72761500f5134c0b95f93a5ede2949f3e85c8b2769527ceca4b3e6e067681c79576c77b
TLSH
T143112C50F8A6DC17FD7378DF532D8AD31CE8375798187A192318522CB759C328D690E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fde0a132e52894cb04104f079828519a0c81968d2ce6a90b7caf66a958a12574
MD5 4f05315158fdde24dd73e7e53cf60808
SHA1 5ae796e31c57b271df763e6ed0be4f717f1e1a3e
SHA512 a9e56ec099a23853abed5ad22461882b3b5074747bd0a89de074047958f1021be872a56961ba910b484016c97f72b60fff881b1ce5f0ed8ad424a7804d82362b
TLSH
T175212B60F8E5DC17FD7378DF532D8A931CE8375B98187A592318922C7759C324D590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1860-490-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3116-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3368-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4152-78-0x0000000000400000-0x0000000000421000-memory.dmp

Download