96ae1d906525203e7d24ad22776c3279291796fe5008d5ec5bf1cf3bcc535a71

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 3.1MB
Sample260818-vgczzaek3w
SHA256 96ae1d906525203e7d24ad22776c3279291796fe5008d5ec5bf1cf3bcc535a71
MD5 bb48f9825ece4ec64eb0ac6e022b8d11
SHA1 fefa0f9b30a581486276cf6ebbfb4467184379b9
SHA512 d6f7ff7e738ebd7d9e534b1496890d2be6f6c0d3752fa71ad54a31684140249f8a4814ded84505ea59f15598bc2ebfd6741906b00c14cc0e78b76e9e29b787d8
SSDEEP 98304:PKjKWQc+KjKWQc+KjKWQcLO4q75Av7fbUhabgf:0KWQcDKWQcDKWQcLO4q7+zUhasf
TLSH
T141E57E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
5912	svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe
4140	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCABACBABCBACCCBBCCCAAAACABACACBAAAACCBBBAABCBBABBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe"	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCABBBCCCCBCBCAABBABBACBCCABABCABACBCCBBBABBCCCABCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe"	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1648	sc.exe
3600	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4668	cmd.exe
5736	cmd.exe
3348	cmd.exe
5920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe
4592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
4140	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
4140	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
5912	svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe
5912	svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
Token: SeDebugPrivilege	4140	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
Token: SeDebugPrivilege	5912	svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4668	936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	93
PID 4668 wrote to memory of 2604	4668	cmd.exe	95
PID 264 wrote to memory of 4204	264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe	96
PID 936 wrote to memory of 5736	936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 5736 wrote to memory of 1648	5736	cmd.exe	101
PID 936 wrote to memory of 3348	936	2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 3348 wrote to memory of 3600	3348	cmd.exe	104
PID 264 wrote to memory of 5920	264	svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe	107
PID 5920 wrote to memory of 4592	5920	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_bb48f9825ece4ec64eb0ac6e022b8d11_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACBAACCCACCACBCCCCCABBCABABBBBBCCCABBCACBCABACABAABCCAACCCACBBABCCACBCBAAABABBBBABACBABAAABBBAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAACBAACCCACCACBCCCCCABBCABABBBBBCCCABBCACBCABACABAABCCAACCCACBBABCCACBCBAAABABBBBABACBABAAABBBAABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe" start= auto displayName= "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe" start= auto displayName= "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACACCAACCCCAAACACAACBACACBCACCCABAABBBACABAAABBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCCABCBCABAABBCACBBBABCBCACCCCCBABBBBCBACBACBBCBACBBCABCBCBCBBCCAABCABCBCBCBACABCBCAABAAAACAAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCCBCCABCBCABAABBCACBBBABCBCACCCCCBABBBBCBACBACBBCBACBBCABCBCBCBBCCAABCABCBCBCBACABCBCAABAAAACAAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCAAAACBBAAAABCBCBAABAACBAAABBCACBBBBCBABACBCCCBABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0e3bfaecc9bedb326f4d4e1da109c1f52116ad87687d5b51fe27faf20ab90197
MD5 ed05d21e13b9d059eb98ce5dfd2642b1
SHA1 a6a4e0306bbcdc95af693ed2574dd923cea3296c
SHA512 42cf5862cd3a0145bb90612e41ec1755684acc3cda22a03c7cfb2777199b94e0cadf6f914d874f1d2113cf46d3fc97c5512cc846f212c79b24a9ab4ac3688930
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 d4cdba1ec59227098db850cd85bd0cb872c824135fbe8ff14911743c736a2324
MD5 f4b17302c47bedd2e79419b7ab922033
SHA1 5bb0b9cde97c1618478720c5c88674d6da8973db
SHA512 879308253a15a3785facd999a9791fca8a04f1f29bf6b4be7325cca799c829d6f7f2be22049d6d6c87f4cf26921d9c38aab036e7c69d8f7e6b920384c6144fd5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 c021d59523a73d1b0666d092457d58be8f306dc54589d9f013525d39c9765915
MD5 8ac87217f462ef18d9839095023e00b3
SHA1 eb3c90ba3e276121d0b8bde6cffa89a0c076e4bd
SHA512 282b71998ad69601b97e067c40709ceef754ec130c99c12a9277f095bc42224caa4860397afa83ad04dca3247752126c154282cc02c16308249e6c37b0836aaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\qap`g`v~dtlq
Size 10B
SHA256 13fcf1907a412392d0729afebda98b895d2bd355210427178b000c3f10f2cf19
MD5 4be7ecef2950f199ae61bcd9af739e1c
SHA1 a157fa4406ef40c76831d5317ebc5fd497061e38
SHA512 82e8f46f02661ccc91b0e84a0326b9016cb3e094820fc6c90854b2bcf2dbc08f1fe40aaaec35b3f64ec24930b68f6ecb0720cc220915cdc415ed6b312a0f15a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 e3cfd35b7211dc935c9151a9d51fc945503c307b987db2dca79c3e48dfa73277
MD5 a87b436c64aa8137663bd1f168d6bcf7
SHA1 ad2335390d8c42b598c9be9c946b4c648dbd2fd5
SHA512 8e5a6185aedf0d5bcf51431a928adbbe48fd93b8d85a9ecad924bccf3cf6de43d0b7c637fe55b3c8442ac545a1466beab3887d6f56ae0f77e5c3c0eede4dfcd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\qap`g`v~dtlq
Size 10B
SHA256 9a8e1d815403bdba468134bffb3ab223fd36731e3af313513940952d0196dc77
MD5 3af11f9b557eb2739ac44b1b1851531e
SHA1 585c58c9c5a58cffa2937d1fdf7f61494aa00871
SHA512 54b67cdb90efc0233977c4334fef210413be4fe5fd0505c8fcd9131bdbbe3922d856704409e503f9ae8b1347ecfa9cb1ed173adf1f193dbad59230bd737e9f37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\qap`g`v~dtlq
Size 10B
SHA256 4c17946ddb76d48b3a54dc42d6d5365d167315c80478fb16577b189a8feae9e1
MD5 b20fa462bf5ab81ad96a1741329de94d
SHA1 5df2dff02573eb027760243c8eb003f9a40a010b
SHA512 32d42d204de324e1f89950db80fc081f7c92e92c9bf7e889164030b5dda22c00d3e830cf6e5c2f065ab0fd077ba71a215e7a86240a84f6c75ee49a6a6278301b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\3LFQFH7Y\qap`g`v~dtlq
Size 10B
SHA256 5bdfa1622d00c2df42f5314a398ee310674f5c15bbd6e9047c9ed6d9dad5aac3
MD5 7ae4f7e3dd035a885e82cfc3029b0783
SHA1 b5df976eef9c97f4182a053bafc8a4ef89f2e353
SHA512 55aa14497dfbc449a8a8c6862092c71697aa0c70f0f5e95068e1e30c4bbb88ab69540ae4252682058f0d8dd1bd94fbce3079c812b8db18d184b4411667e9c314
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\idb\qap`g`v~dtlq
Size 10B
SHA256 2fdeda7fbdf6154c30a04db78c56036b5b04d3ff5a7d78b0cfb049eff284cf04
MD5 9c620c4f36fd51b983e7c3a53f2e4460
SHA1 bc00ee0969f3a75167077e4dd8233f2d15e918f4
SHA512 1e9017c86314c2c31a7e54ea9cd053dec233d9c878e3dd0fdba37e459a7baf1fcaf97a0bf88148d9a175bdf24aaaefe4f3b67e74d031da9d3819963e193dbb93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89e7404b020f55ae885346ff85b3fa788b62a0134d8386095228f92da478eaae
MD5 f0c1c2b69f2f875f26e75a93776afa2c
SHA1 77822cb3f94fc709849042e38d200e7f76af362d
SHA512 610402a55b31e89aa0c511df512dfc4808bd91140c903e0a2edd89baaf1c468199208deb413c74669f93bfaa6b8d9dc39ef640d36733c87be5250a151af5be57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f462cc4c0402ee241d2dcb30ed1ad07cea627e71ec26e438fe2af4a6993cd36
MD5 c0b2a19f7525149b82693d05cb5568bb
SHA1 e2ffa90952b01a91fbed9784f4a6978f7d6c0f7a
SHA512 8bd7865a2d4eb375bcd81ebecdbde79cfdeed90ea3f408cb45bf4d8408635c96fe0df89169d8cfa98ab003d3d599400024f71f30407a9b5e0e9eeddd4fb3de4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7725d83c02cb2175ea0f5f68f3d7d3dfd2c308acd81ea88cd8753bd33b5a6ae
MD5 41d7d0cc7e3e83867871cfc638d79b95
SHA1 19a6ed252aae22622d1bd4dfdd18b4a8ffa0163d
SHA512 6d8908009d6390fff6807207cf9a4dc6541b6dd4768034c546901334cef86d3c7465c60d2c8470c68e78cf62a09b4d0f12631817e2e91ee5ed5166270491d9ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e3a873f58f3f9b37bd31feb1fdeee938bc9df5e6ced8667a3dddb62906c3a0f
MD5 e099074f1e476c20e91664bd83741945
SHA1 dc5283fac604674556c11db508bfaf2835a164a4
SHA512 e14a873c904bf798ca4fb179cc9153e1802bb752cce003b756c03f0ae4c168505d43826702d240b333bcdc12699dc5ef32c5724478917e763b040c46719597d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a94121864fb9aa5f93218d6d0b87f7b4b8e4ba1c92cb880f0dd593a24bdc9450
MD5 866b724c458629bdc0540d3c86894c91
SHA1 a8551ef730ed0b279c69b489736595f89898a3a9
SHA512 4b3fcd83287d0eec274880bb581608e5a53e184974670b3af43e3d06d28fc9b96ea501971d059395a237b731e5142d2e628e639c6c295db64d7042664bfa486b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dbfa39a8462d0e64d7fb4e152555a285dcd15f37875f79a72c9b665b888967f
MD5 52c5b63fe2ac879476163a505329f01c
SHA1 a65142afcd116c38b46aa14405dabe0c5adaa69e
SHA512 f0ba198c3e016b7bd949a87ac51b7e7d6bef8dc81c6c35592dddffab0e76f5200258629286680d69ee5609376f170b195f027f250e053592fe0a8960c32f497d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 273aa8a4d82d814e7b659bb31fd71bb4413cc0ac45f53a91ac3b828fa4d191e9
MD5 15be04af4ffc2cb863ad2d3dda72737f
SHA1 354a05e36a593c83e37170707a4a77b3e26fc5c5
SHA512 7ad844ccb34f5c9e85a30ffff8ee20a84d766f512ade60f57cef39cbe797d79ed02cd7b593231837dac0098526a6319bd750a36e4636978294f234da26616f35
MD5 SHA1 SHA512

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 35.1MB
SHA256 03f2fcdd150398e98d6bed88ce6c2aab72718365df13fe8cca725d762a34fe28
MD5 f49bf844870e9029ab10ac43c8f235b1
SHA1 e6fadcc4783f6b294f2fc44a20670fd2315c44ba
SHA512 cbc7407fc96a166b63187a832436feefb14775070346f821ab828da14e22fbff96da9b5f7c81f25b5584518eb8a4eaa95ecc461ec74382cce3fc67fec3aa22ec
SSDEEP 786432:XhasPhasPhasPhasPhasPhasPhasPhasPhasPhasPhasq:W
TLSH
T17B877E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 10.1MB
SHA256 75e9076ec2ecc0626535a107338773f364a928f9d3e407c0d9e472ca1e5790c0
MD5 381fea5f3f64b1b1884b9cb88e36a72e
SHA1 e86df9732e0e2de615cc06d624b6c6ae8620470a
SHA512 bb7e202ee2ce4580ef197f4690cc447572b15e330afe6b456768922382f37139fb837aaec3749147c13943b2f2c7ce65e2837335f278f94c1d2591a54c137803
SSDEEP 196608:0KWQcDKWQcDKWQcLO4q7+zUhascKWQcDKWQcDKWQcLO4q7+zUhascKWQcDKWQcDj:dcScScLO4q78Uhas1cScScLO4q78Uhab
TLSH
T112B68E2CFD9541B2D476867188D6E5FDEA31B9216B004FCFA6D6430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 16.3MB
SHA256 391c5e95a7653106c02b07795ce3bee2bab07a7d3d352e4344bc329b0b781f6c
MD5 457ec07a42f14d99cc5cde903be3cc4d
SHA1 dbf9e093ad28a76e3de147f330283fba75add4c2
SHA512 3407752177008fe389ef980496c40483b92746d09e1e281386197c08aef378f61cbab4549e6ac4b1eec7b37111d7587f8be68a5ff092e14ed5f5e9fe8d8eca04
SSDEEP 393216:dcScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78UhaJ:XhasPhasPhasPhasPhasG
TLSH
T19B077E2CFD9541B2D476867188D6E5FDEA31B9216B004FCFA6D6430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 5.1MB
SHA256 21b3bd1f12d9fd94d45f7c759d587bfed2150e8c89625e9ef64e9d11a604af80
MD5 1162d1858e120fd28c23effb61777809
SHA1 23286feb5694060d8a37f95b2db872db2c922522
SHA512 a52c8661b8a89812d9bb5f2dc3af93dbf5534a9994ac7614097cd72862069d9697f98cbc9a15fca8527acbc8dd8694c9f1569f3fa1b5bbcd2c91daab7f7e45c8
SSDEEP 98304:PKjKWQc+KjKWQc+KjKWQcLO4q75Av7fbUhabgXKjKWQc+KjKWQc+KjKWQcLO4q7W:0KWQcDKWQcDKWQcLO4q7+zUhascKWQc5
TLSH
T1B7369D1CFD9140B2D436857088C7E6FEDA30B9219B014FDFE795874B5E3BB926824E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 19.5MB
SHA256 abf37991bd9f0ea32667ec2035dd1dd983bf86f78191c150ad271244a48269ab
MD5 9fe871ab0ff906dcf9ae022e92432a1c
SHA1 ddde09b0c016626a176b82e1512ad0782ddf70d0
SHA512 4647a3b16d127164da6755981b32cf6169a6311cbd854d9e817c3ed81014b52c42f0246f2fd64b63a7fe0aa5de8a93e40ce59fd8023f6df5996d27b7f06055f6
SSDEEP 393216:dcScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78Uhap:XhasPhasPhasPhasPhasPhasU
TLSH
T1D8277E2CFD9541B2D476867188D6E5FDEA31B9216B004FCFA6D6430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 22.6MB
SHA256 4d476da0a4fe94e1958987537bbdf15536b65977c78c1e5360ab8b5b7b33660d
MD5 60ebfd4dba885b28f2c74c14d3208c83
SHA1 1dc9f3ea3ab2d63a57b568713f06a4c76d265a77
SHA512 3a2c47994e6ef8e75afda8466261e445957e5a5bad36d90dfdfb3e7f469b17e4e087e21dba1af44bc88c35df9d7b34a26db69d2f51be57f34c1641d54d159515
SSDEEP 393216:dcScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78Uhas1cScScLO4q78Uha3:XhasPhasPhasPhasPhasPhasPhasM
TLSH
T138377E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 25.7MB
SHA256 08e40d73cd0dc13b3e08d6eb86cd47cadf75f6822feb513a5c2d2aebae8596ce
MD5 b987a948a81e0d4cb15a7baa2346680c
SHA1 815cbcd171202b041f6226e90d653721ae71991e
SHA512 cf79369756769ce4c43e180ff9179c859f64af568599f842cfb462c81061f233977e289a1d6472bd2e996cf192f5630fd63021c607fc3b0d120b2c646f76eedf
SSDEEP 786432:XhasPhasPhasPhasPhasPhasPhasPhas1:9
TLSH
T1BF477E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchUninstall.exe

Path C:\Users\Admin\Downloads\SwitchUninstall.exe
Size 32.0MB
SHA256 324b9ab0e03985c25cb73eaba6b5309995b12e2d0c888beb63317e952224a115
MD5 c36a3fd77508fa6efdc940c4e19f08e2
SHA1 9bdb56846eff31c9a8f64ef166419c0d70c671a9
SHA512 4f37b67bbd2857318e6e7d53b80230825b09d03886cca4221ca94cb89a16406b756c27e45da633b93488d6e3ad8c59853eec1adee73cc7058b552b93026adcd1
SSDEEP 786432:XhasPhasPhasPhasPhasPhasPhasPhasPhasPhas8:U
TLSH
T1FD777E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBCBBBAABAAABBABBBCCACCACCCCBABABABBBAAAABAACAACBBCB.exe
Size 3.1MB
SHA256 96ae1d906525203e7d24ad22776c3279291796fe5008d5ec5bf1cf3bcc535a71
MD5 bb48f9825ece4ec64eb0ac6e022b8d11
SHA1 fefa0f9b30a581486276cf6ebbfb4467184379b9
SHA512 d6f7ff7e738ebd7d9e534b1496890d2be6f6c0d3752fa71ad54a31684140249f8a4814ded84505ea59f15598bc2ebfd6741906b00c14cc0e78b76e9e29b787d8
SSDEEP 98304:PKjKWQc+KjKWQc+KjKWQcLO4q75Av7fbUhabgf:0KWQcDKWQcDKWQcLO4q7+zUhasf
TLSH
T141E57E2CFD9541B2D476867188D6E6FDEA31B9216B004FCFA6D5430F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b92eed1af33edb8aab351683746731e0d7bed3e735cf4940fbd5992c7f31d303
MD5 fb21236c98ffdc633f69fe5a47d6394d
SHA1 d536609d34cdaff1ef6af8b33737fd652ff2cb84
SHA512 779419728a79c096dc546248efb9479e63fa8a6f0382e5e419f92f5c573db34902cad4c71ea202445299b504023cbd428c6176f49ff5c0f95a0633f4bf881f93
TLSH
T13111E7B3F8A5C863F972E4CF961ADAD26C9C36B75C5C6A09131D8119B7C9C308D198F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7bdcadb15137993cbc33c3df73b25c6ed9a6ee656fb417bac2245a34fb6fc834
MD5 d230e3ef5627c4aebb464c26b78aa366
SHA1 3e8592689082687957f114e3f880d91c2cf6db5f
SHA512 0503b4ef52e5463cb187c8aa18f2d5a3bf3b1085bfc365566d68cc6fa798e22182c2bc97553abfedbffdd56e352d6f99dd1fefcbd2c52cd5bb470f03e310e6bf
TLSH
T144210BA3FCA5C853F972D4CF971A9AD27C9C36B75C5C6A09131D9118B6C9C308D198F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2e3f84e343606eccc144ae749c871cf38e10b30eb12a978795f3d759983442f6
MD5 65ee69fe4c88fbb27c97e8e3b9b5daf0
SHA1 0058834b48432ce552e551e6e17878eb7aa7a001
SHA512 02462ab30625e08a0c83efe0e5ae4b6fe6529126212c2b3e42bd222a93426d307b0c1b87404844532ca9803e0317e827658686592a189a938ea3d6b20623b921
TLSH
T10E113AA3ECE5C853F972A48F861A9AC3BCDC36A75C5C6A092315411DB3C9C308D198F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-88-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/264-68-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/264-46-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/936-93-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/936-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/936-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/936-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/936-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4140-2390-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4140-4100-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5912-89-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5912-4098-0x0000000000400000-0x0000000000421000-memory.dmp

Download