3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 27.0MB
Sample260819-e7bltsdn7y
SHA256 3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3
MD5 ba6c70082aa706e10dfd4bdca0d2c1db
SHA1 83688560a90f81f7aa63748d9dfd09bf64a96c49
SHA512 40a1d52ce4f6499a42a9f9c902d28fc6de39b38babcc5a0451458be813ac30bef7ec0f99c9db3fe724079a4cf92232b88f26c3c4ad93d898f62caa60c1883c30
SSDEEP 49152:U+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+ES+E2+5:0KjKWQckVgtev5mnlNLc
TLSH
T1EF575C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
4752	svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe
5304	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCCACCBCCAAACAABCBCBCBBBBAABBBBBCBCCAAACBCABBBAAABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe"	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCBCAACAAABCACCCBBBCAAAACBBBAACBCCBCAAACCACCBABBBAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe"	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3276	sc.exe
3204	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4548	cmd.exe
688	cmd.exe
960	cmd.exe
5916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5476	schtasks.exe
616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
5304	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
5304	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
4752	svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe
4752	svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
Token: SeDebugPrivilege	5304	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
Token: SeDebugPrivilege	4752	svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 5916	3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	91
PID 5916 wrote to memory of 5476	5916	cmd.exe	93
PID 1312 wrote to memory of 5840	1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe	94
PID 3300 wrote to memory of 4548	3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 4548 wrote to memory of 3276	4548	cmd.exe	99
PID 3300 wrote to memory of 688	3300	2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	100
PID 688 wrote to memory of 3204	688	cmd.exe	102
PID 1312 wrote to memory of 960	1312	svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe	105
PID 960 wrote to memory of 616	960	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ba6c70082aa706e10dfd4bdca0d2c1db_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAABCCCBACACACABABABBACABBBCCCACBBCCBCBACCBACBBCBBCABACCCAACCCBACCBCBCCBACBBCBBACABCBABBBCAACABBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAABCCCBACACACABABABBACABBBCCCACBBCCBCBACCBACBBCBBCABACCCAACCCBACCBCBCCBACBBCBBACABCBABBBCAACABBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe" start= auto displayName= "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe" start= auto displayName= "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABAAABCCCBBBBCBBAAABBBBACCBCACACBACBAABBCACBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABBBBAAAAABCBACBBBABACCABACAACCCCAAACCABAAAAACCBBABCBABACCBCAACBBBCBBBCAACAAACACBCABCACBCACBCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABBBBAAAAABCBACBBBABACCABACAACCCCAAACCABAAAAACCBBABCBABACCBCAACBBBCBBBCAACAAACACBCABCACBCACBCCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBBAACAACCCCBAACCBACBABCABABBACCCCCABBCACBBAAAAAAABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6ccb0a1b58076c47114851af9699fbe07c1eeba2f0dde2146e45f736ca32cbcc
MD5 d53848e891f71c81cc49d4176fecf92a
SHA1 c79ffc9a43b6632680a8e3676dbf79ef7cf3485e
SHA512 c0fce42616887f98361b042080df57608f9103d1675594c1b59bc469128ac285f6c576444f4c1ca15a247e650be2abdd96e689754035dac186428868d687f279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM\qap`g`v~dtlq
Size 10B
SHA256 007ad0b3f58cc682e0c0be7802920bad74d85c5d2e9f8b015b8f8c9f343fe850
MD5 17549dd02ad01cfa1731e5538376472d
SHA1 6a6baa36a8b84b2f2461a84dff82258284849ad9
SHA512 026d497924987e46c8dfa8ea7f8ea8a9fff93e4f21667e30196546c7f1c52ff506c057d2450fa7c2a30e225e80b7a1f53d5984e87cbe1b7deab6037b20b10bd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdgeDevToolsClient_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 21795ab3a33975839a5e55d4e3114457dc4d69538f1dc9c746694c8740f87e7b
MD5 9b61f955b02f4102f44d863a58298ba7
SHA1 172dd400d03bf45edc270a082258e61a16338613
SHA512 9a6c050d9cf102a706fce44b15ddfce4e0d279963367ec59ba5e572efdc5868fee7a6a1a2c0261ea7a88b99a909fc0e0a9fb14ff152344c5ab215f4dee09b393
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.Client.Core_1000.26100.19.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a1b6492825feec3ae2e0070d608afa30fd57b9478d25324ec15d7ce0baeb5086
MD5 04c13b2a7350b1856945d09d76233c25
SHA1 20473f7ccdc1c7af75514aa4b3411b7b7441dc5a
SHA512 31d459ff329cb6498b808f04f5712eef2b060f0173cb81062625af685123d8bde375873c6c8a5c9711ac24ea10227fdfca0653be7d2e344c9e567ac83b01579d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 27.6MB
SHA256 89696cd03b272112331d46f6f383f66ecf7b40e5a5b959136a072bafdf16bd9b
MD5 493aeabe8b7ff536078ad63ceeeeb096
SHA1 4ac3aeb480b563c324ca6d78e6d25cad798a31bd
SHA512 6b272fbabf1ddb1d1c11fe62deb86ce3cd2cc3d75cb585e237ade401ddd534451d6f2701d9ceac04ae51d64ae725bac9eed5624c3f3b6101d9862096919c75ba
SSDEEP 49152:U+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+ES+E2+b:0KjKWQckVgtev5mnlNL7gZ2Hb9t+2xM
TLSH
T1BF575D09F94340F1D92B51B04DCFD2BF8A60BB2586128DFBFB8DCB1B6923B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 6ee68c0c50c758ba995717395ace35b5ffb822b46db018bed217f49f34b372bb
MD5 b6a18dee43838ddc1c4ac2b3f815b688
SHA1 4eeea1c9fe97e0252aac5981a3b78eedd08bfbbf
SHA512 e4a306a44b944b319f62ecf3a4379fef5aa7631be5fff63c8680f8ab7a624163b84acd1e3edd2d8a85ab6e302081a08c17fbcd93dc1465a2c66d1fecee84a864
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 6b610581f553188bd003b10579322d4555fe4b0455bb91b067dd302bd8b86a19
MD5 e661738c8081e3b6c1260e2840a9e57b
SHA1 e91647fabd0f9d448c7f7411f1092c12e6d6bf4d
SHA512 ccbfbfab808c5fb74066d3d3bee27ea0f4c54aaee924061496fdb9cb5cbef114c4beca3765a961889fde7f8a655804f09d5889249f8f02df80026d7c91db3413
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 973cd4dad75b46f52625ad85cecf7e526c2d40304b33e4abc6465abad33d28e0
MD5 301992dbabfbfc897f8bd22492b46c92
SHA1 d801b08e296f4b32f823701908fb432329275886
SHA512 9d91d49f3b596265e06e09708e673211bbc87396d0042caa3aca41b2bc5fdd531ff97777666a3735378f17459dfc227a6df045efa17bbc17e6fb1474b969da02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 502d691c49b48e2e5ede389199a3e74e5df85d68a9fe9aa55f8843e099d93479
MD5 49bd29d4e42bfe990d1a5055f9899010
SHA1 b5596720d665b3d061c40c804aabb22f4b2cba0b
SHA512 4dc46fa59b15742d0a3ac2a09a26a17a15c315c6d4cdba7ebc885d2226bbe5a35d240890798ad0eb03bb627762eca671f672c3fd3255ca5490a718e6e145dace
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 606b12ce60d50a609fae16c41e7efd1b4a7f2e9daa944f69f44f4cf1df82faee
MD5 8d8064545e3aa36acdad15ecf42ba65b
SHA1 ff95612d5edac884465f2c871ca7aaaa083120bf
SHA512 fd2bfd44b391f4cfdb9c2f0a7ad4755d9f9762a9d83b1cd5b6a13579e00e9280f2be1ffc8bc8ba94f0cec8645f444cb1b10f6006867c4e57f2d921f02e10dbcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 0dd41210318521c0453c4561d1c5de0c980e0c61d98fe84c20fb5790373effa2
MD5 91d1e890603feb69a89db221b7615086
SHA1 83a248e6fcc0cd32efd012b489b62c550636652c
SHA512 cd06a16e99398efc170518e8224aa80193a7256b9250d0677d69d1ad0bdb5910f44ad86d21c6d2439151b8892d0871ac20b55206eb030b9fa0f159975cf0c63e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 794effcdfd495c86107f2caec0b92da525785fb4bb3e9682fe7d6662ba7e028d
MD5 a7b394ec8d0349f5d0840d9e7bcd23ec
SHA1 336b1f56f34da129c1570c2fd286fbc95fd59021
SHA512 c78bd1a3e6de5f996da8de017d652bb210b46d0d090e4c3255146deab7b0b8633ce2eeb04fffb8a6e85cec026c55d2e8ce0089cf12681e8029ef7ceae9137117
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\qap`g`v~dtlq
Size 10B
SHA256 d7c6dee554b8767efe669612d955e2379d266326ebd664b909715e917bdd1f46
MD5 20326482d1d5544587421f815d0e897f
SHA1 cf87ddef373b52ab83c819978ac2bc8e57803be0
SHA512 adceb797fed4e8e9e05b60e1aab0104e5c64b1fad8941a60d51f1ad9e2a3c316b20b80e3cc5a3e9af24cecbea0a967596cf6bdc313d8f82c5d7f80edd6556220
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5d5787e5c9c82f3d5559a39b822c587cd427206fad410de21f52479469ee3ab
MD5 a3aad96a06981a1d25bbf1f79ab3e132
SHA1 4fa7b78e0ac0c53f64c6bb59e64c5b4f55c1370b
SHA512 8d1d22ac12087828e41b865abbbe97aece1c544e4a01cfc17054613c58b7fcbb7a87d42b832e2de8866c6fcfbaffb663fe687da7b123af9b0f4a15aa3c958bd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b50800050d347aeba4a02e17fd2c71244b62693545dd1db561a50f8689c79d4
MD5 03f8778691454403dacfafe742265f5d
SHA1 5fdeae24d67413d49325cb7a42356f94e99de9a5
SHA512 a4e90857c99b17aef2ccc2b7eed7c1c84d44f4f9a8afb3d4717b96c5066c2d56ab23e96120559530dac85f4d54e611198f0a890c959e09cd668a009c40a616be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef381fde40862d0bcaceee3b6b9b38fbe795315392ce42c4d00fa0d703fa6807
MD5 1f711ecdfe7d5a496cf7a4a0309d5baf
SHA1 10052623816fe2c6c800eb282162c93ccfe994ec
SHA512 8787e8c5ae346e64408a2ea3b957b813d29913b853e684c2d9822213671653068cb4ab5c8e336086831b9810c4ecbb77d8db00b187d5cc7157a0d04685a5bd97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4da26427c218d972958cf9815b642890af6c54b387d2863cee6331993e542ea0
MD5 56b04da2e13d428651ad65ffdbb4906f
SHA1 2622a586e4a3118095bf634e7506211d576894ea
SHA512 7b6c13f4c326cd701b0e5d3e962a3c257f0f6ba934ab5e3e47c2c921482a5eae98e6c602e504af74837f763783de5f40eae50d73498c38680f24d5ac00e37274
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e48871b32943630c908c1a3911a6b95cad3a7f8a94d46bf4c21431c8a1af4e7
MD5 c2676eb51191db635fd2d763c50b7789
SHA1 8b20e4a6f65ade1a7bc7dcabdb1c2a2293195f78
SHA512 fc185a8a342f069abeb8df4c5b138f0ec0e1b18dcaf68605a10ddea5042b116ab3ba2ca6eacac09365644bf7b980d456df9e8e08300bb7ff19d8a1658a34bdde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\qap`g`v~dtlq
Size 10B
SHA256 e574999ee4b0547898018a0f9dd28cb3fc16c7feedeb20b61793777c140ff6e9
MD5 24b797643b081d3d94f108e9129061ad
SHA1 a282bfed13e40c8dabd778103473c250f7e54624
SHA512 d00267c0e4ade0ff7dc8a0e23d355c28ed5f337c7441ecdf7878670f2a5ddd80601afa2cef9772179ff9f834671f7145ba5905de2ea25d9981776b67b38b93ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0274a344f9d09eaab2a060ab6ca57414c41304634d5060a6fe80177493814b6
MD5 d286bdf19fafaeb9ded0dde3e32901c2
SHA1 97e12ddf5214caed173f4d561943610662599e7d
SHA512 ffe460317a42e22f8222650a0ee6ad8d155bee91b2b4bac3bfe57a2a9b5e3d6ac7d8126451905b9384101f48d66bf6071e4bcf11a10b62fafb0092fc203f7dc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\qap`g`v~dtlq
Size 10B
SHA256 7c1feb66dc1a8face5ec52e3ff70a8e7a1fa052a64242a38dd0dde68a3397040
MD5 238f930fd844da06a4d202cca7d47eab
SHA1 e469b5f93cc3f3e1282a6afb00cd8d84af952cb2
SHA512 44b3f00fc1361009bb123d73b616aaa850cfb9035a441ab9439adcc65a878d181a7bd0ac9184cab1f3adad81a87eae19a231162211914f5f65059f7ddb67f01a
MD5 SHA1 SHA512

Submit Download

svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBCABABAACBABCCBBBAAABCCBAABABBCBBBBCBACCCBCCABBAB.exe
Size 27.0MB
SHA256 3da7abfd2a186c8491cd75cb7f65929824e3c8a00ea5ea5e4574b3d615a2f4d3
MD5 ba6c70082aa706e10dfd4bdca0d2c1db
SHA1 83688560a90f81f7aa63748d9dfd09bf64a96c49
SHA512 40a1d52ce4f6499a42a9f9c902d28fc6de39b38babcc5a0451458be813ac30bef7ec0f99c9db3fe724079a4cf92232b88f26c3c4ad93d898f62caa60c1883c30
SSDEEP 49152:U+ES+E7+ES+ES+E2+ES+ES+EZu+ES+ES+E7+ES+ES+E2+ES+ES+E7+ES+ES+E2+5:0KjKWQckVgtev5mnlNLc
TLSH
T1EF575C09F94340F1D92B50B04DCFD3BF8A60BB2586128DFBFB4DCB5B6923BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 38218f212de63d7d358bca085684c0369edfab96080efe1fb630cb73674b4a57
MD5 086e1b89101d3796b07d10619868009b
SHA1 bf635f8f617d03c20d876acac324116f520d98f5
SHA512 7acc80473e458b02f688e80c0095003f5c50a93fe586ac20b06210047e161912a2cb9921881d2f20ea1a089a6161569f78d87a551df81b3b3059622706c7695f
TLSH
T1F011C671D4F5C87BF93368CF953D8A828CA4339B989CDE001209521877A9C76CD1D4F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c2a7f3349bad6fe0e724704f805d28257a74c72c3ec26b60595e0c2532d80f90
MD5 7981af9590156d621c7fcec7e9d2a5b1
SHA1 3d3e510bc17b5e8bcc34800d64a971f1dd252f88
SHA512 ad0408574b1fa5b87598d3df36f26618c8fe76e5c9143126994f0fbf81b70d6ad17479b130f9f4f0ea97a399eecc421ef7b2dda04ea52c21ead121914c1d38eb
TLSH
T12C21B171D4F4C87BF93368CF963D8A828CA4339BA89CDA101209621877A9C72CD1D4F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cb0deb333c7681954ebb11d029f2d4197f602a754c71fa71c8652694f04fa921
MD5 c8570c61bda70205ba199a24afd919a2
SHA1 29e32a422a95febdf18b27a6a36013400fea5577
SHA512 eecf29a56c157b5d530bc168ec1a4b2e78866fdfcc02e7bfdc186fb3f134e07543f4f52d528276d2f1d7329fc7abace95a6ef95305b7becc33c438d85d0f66dd
TLSH
T14511C471D4F5D87BF833688F923DCA828CD4279B589CEE1422056118A7A5C76CD2D0F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1312-33-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/3300-6-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4752-67-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4752-3684-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/5304-1041-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/5304-3691-0x0000000000690000-0x00000000006B1000-memory.dmp

Download