b1e09bb15e690576866c7ff143c07a02cabf6e057322b3a194a88656091d1526

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 1.9MB
Sample260819-p3dkqsfb68
SHA256 b1e09bb15e690576866c7ff143c07a02cabf6e057322b3a194a88656091d1526
MD5 b0780b72482530520ea3dfec82642fe0
SHA1 49ef0485a7ea676e091ac2f5b2747b526de003c0
SHA512 4b6593884e36f45e529a9dd0c3344ef51aaa9db2e1be70b2aff0cf8f08e0392832f7ed31ef0ddbb260087a0ec2824ad4c9640366e7264d5b2085d7c22573d61f
SSDEEP 49152:U+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2OY5j:HKjKWQc+KjKWQc+KjKWQcw5j
TLSH
T1DA95AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
3808	svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe
4964	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBACBCBCBBBCABCCBAACBCCAABAABAAABAACBCACCAAABACABCACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe"	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBABCBAABBCBAABCABBAAABABBBCABABCAACAABBBCCBAABCACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe"	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2760	sc.exe
3216	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5840	cmd.exe
4244	cmd.exe
1072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3272	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
3808	svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe
3808	svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
Token: SeDebugPrivilege	3808	svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 5840	1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	96
PID 5840 wrote to memory of 3272	5840	cmd.exe	98
PID 3220 wrote to memory of 5916	3220	svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe	101
PID 1084 wrote to memory of 4244	1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	104
PID 4244 wrote to memory of 3216	4244	cmd.exe	106
PID 1084 wrote to memory of 1072	1084	2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	107
PID 1072 wrote to memory of 2760	1072	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b0780b72482530520ea3dfec82642fe0_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCBCABBACACCCAABCCAABAAAACCBCCCAAACBABBABBCCACBACCBAACCBBBCABBBACABBBCCACBAAACBBCBCBBBCBAAAAAACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCCBCABBACACCCAABCCAABAAAACCBCCCAAACBABBABBCCACBACCBAACCBBBCABBBACABBBCCACBAAACBBCBCBBBCBAAAAAACCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe" start= auto displayName= "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe" start= auto displayName= "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAACCBCCCBBABCBAACCBACBBAAAABCBCCBAAAAACAAACCBAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCAABACBABACCBCBCCABCBBCBBBAACBBBCAAACCCBBAACBCCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
1⤵
- Executes dropped EXE
PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 6.2MB
SHA256 bf86f6030c35489569717459fe6cbc086d515707a8302374d2e366de014d603f
MD5 6169a2926e61726999f17b2419f2aaae
SHA1 8924ffc60b8aed11bfaf9ea925897c8a03922abe
SHA512 86ce10ab33dc4cdda045a24ec776997b3d09d5d36557828994258cab6a081434a2f93fe632d48dc3492eee1f1bcecab693b9547702b6c293e4ec20c1421e459a
SSDEEP 196608:sKWQcDKWQcDKWQcw5YKWQcDKWQcDKWQcw5YKWQcDKWQcDKWQcw5/:lcScScw5JcScScw5JcScScw5/
TLSH
T13856AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 1.4MB
SHA256 a3d283b2fff18c05f9f5089074c12ccb641bf7cd33d2a60fee90169106516bf7
MD5 2eedffcfa390df154e8236f23a0c27c9
SHA1 4b50c06440d3eb982c68881689751c77b3a318be
SHA512 d4f1d206c0e1c2585928bfecbd615f1d014877be6833608f7f7b885a46192a6f7f4676cb41194cd79e05097bd405517bb1364654f35aacf9eb2f22bf437b8f71
SSDEEP 24576:m9+EM0x9+EM0x9+EM0kw8KjKjGFygcc2C9+EM0x9+EM0x9+EM0x9+EM0kw8KjKjo:U+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKh
TLSH
T13B658E09F98340B1D92B55B00DCBD3BF8A70BB3585128E77FB4DCB1BBA32B51941865A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 512KB
SHA256 27f609ef144debec0af3b7d508b1d1567f151bd99f6b484dc97ffcbd7054bc13
MD5 f33a695eaf72a11f1be4eaa12f6a4d4a
SHA1 fcaa3646227809d7f67b3352b2cd2c943b093693
SHA512 d8e32ebd23a1e17d21b962d01da4bddf7c8ed5cf37bda0c306056f37a07d73dcffa81d467eeb9b4b8a5dc45f36ff19be966e4415b81c653860399fa64aff5083
SSDEEP 12288:mgUFgEsnojxgUFgEsnojxgUFgEsnojk8LjBTqKCNAKiWGFyrf:m9+EM0x9+EM0x9+EM0kw8KjKjGFyT
TLSH
T1F1B49F09F98340B1D92B15700CCBD3BF8A74FB3585128E67FB4DCB2B7A36B51A41865A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 15.7MB
SHA256 30424c7a64147b7e57f7a1919ca1b5c00a63177cbbab29f6f9371f8e1a1112b2
MD5 52e59ca49dc97b03cd347739f683fa22
SHA1 74cd1f4492a49d7be0a3b51859e1be1ef4394eed
SHA512 0a6ee703dbb276d8a8d613a355abd5d7d2b6d67e8136d3d23f8f971e673d78c01dcb4c62f2c89cd606b3a4d0dcec17863495b1e5cd22c82674fd340599a82ecb
SSDEEP 393216:lcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScwo:R5V5V5V5V5V5V5V5S
TLSH
T1DDF6AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 17.6MB
SHA256 6e4e6756990f3e9dca5584b178151caaabcb8b4551d5ea8922d99f6c62c9efee
MD5 f8299b3c9d39755ec97349191ba61299
SHA1 f0ecebf2b856f087d81697a836419dc4bed4193d
SHA512 b3ee892a6c6d4f7d1bff08fe9f41afaa5f10b396fcd05a10012854847c0379359cf1ccf3f5ae02227a70c794985ddcfea123abed3713b42565f91aa9afdfac08
SSDEEP 393216:lcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw0:R5V5V5V5V5V5V5V5V5m
TLSH
T13E17AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 19.6MB
SHA256 472bb34f75db9aa1c61fa92e64f69f727a2825b607406cf14d341d7ee48c36c9
MD5 3bf2cc270823a5afe1e8da3a3cd74168
SHA1 d187e2ff3f7de180271bf5e15f0186547732155c
SHA512 3e385582bf02002f385ab998345f96299a7effeea06a795a8ef272e18a10df10438cb2016ea91d28c20d517df56a9374f6644a8b360ec39fae156b8e86cd5d1e
SSDEEP 393216:lcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw5JcScScw1:R5V5V5V5V5V5V5V5V5V53
TLSH
T1F927AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 1.7MB
SHA256 f9e4a2935f1166b80402292f69c204e2a82fe636d194e0a8acd39d43ddcea180
MD5 876d67b4adac10b4005083ffd8373f87
SHA1 bb1a35467d11107953deab66b6ce4ac3b59c88be
SHA512 16c97e287b9c574ec002d1d6a99c22df086f72d80b366503bcfae29984c2942a47cd24b6494c01b75ccd5bb5cb1c74773f5e7f3a1664198356ad285eb1a0a2ac
SSDEEP 49152:U+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWL:HKjKWQc+KjKWQc+KjKWL
TLSH
T150859E09F98340B1D92B55B00CCBD3BF8A74FB3585128E77EB4DCB2B7A32B51941865A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec1982b3c2b8c2f38c7721095e9244b7d57d9d7db7d0234e35bf0adae3446058
MD5 91c90a37321696f2ca09036e6d6d5618
SHA1 14b5dc823e867c6f71ec58871b2f179159e62ecd
SHA512 a8d77f9dbe7f1c3ad21147a0849a9ac64b3615b9397ec567684dc347d484249f7dc37c14e3c0fb226fd6501f7989b3d6eff1971cf3f70bbfbe1cec2b79e84ae9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 326fb8e45f62d2a4a6bf6f5a7121305878c5d77f3c7aadd6f2edbad284f9da82
MD5 dceeb226e4650ea924a85aee96f7c7f6
SHA1 aab5fa7225ea24cbb65b93bafba3ac7b1df36213
SHA512 6a528c87551fb8502aa9a9db410f8ec9a81bdbb77117cfcae17f06105cf8ce2f770716f96354fd7d7e8c4b29d3b5c8db1a85c6476e4d61eaaf61ceefc4df7cb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa4e917b8e5a1d9ff79b65dbcc3fb3d3d4a367b7f974bb954ca4a55de632d414
MD5 bbbac48cea91fa6831712e33f7c092b6
SHA1 95fb4627c7f46e2314a069f52f66013cb24fc4c8
SHA512 3f5074908465d862590111c86c5f9bfecf56024f4427c8eea8391afe493a89fe867a6a214f505d79fda6cd13455458deb30d82772ae6a13b468c8b69fffd5b6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d3227cad635fec7c1abcfdb1885c69f03f23c414ce7c907552bca040358eec0
MD5 a23f83b8e5b965c90a7a19a3ae4ab76c
SHA1 318d16e2ea8e9d80fa7775d0d89e85fff02bc5fe
SHA512 383e6b8ebe9d5e12dfa58ad61cee3779107ccbd14f208e047e7ca2f7a6c289c185d7ddde0ddea3fa300495cb2dd6a6d926b1e838dc760ecc27614d777836b824
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac5939186d8993c0f8375c32e446a5712184cb3c83a83819e42c5284dc6709c9
MD5 531d2fb3892d6823e0676d235221e6ca
SHA1 f8fe5ac9067a5aa94ce6171c2fd5f092c6f9c15f
SHA512 bc952c8b0f342a57044637e721ff128d801eb1c5908577aa933b53e21f7328bbd80bba03c020359c97f52473fa5e1d03a6caf15e062a78202a529a01a29b593f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b697fde804cdd90b0febf8d758a88f58a600aeb67f3cc72aa7fa35724e63a76c
MD5 02d6cfcc4f222da241fd42e23d5d0396
SHA1 a29980bf0cd329ad9c04ec13c34c3cad3c8b229c
SHA512 051a93a3198448868d3dc8300648cf2827d3a4409c804ac72fbd8077b45cc09f01beb1c4a858882e8600425626d0060caf2953bd36288cc9119b64a0be0a7711
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7f13d890c7e78179e088b24a9351a6ed306b2a5ded25c30973c0592b8eceaf1e
MD5 8f623c952e427c8ce611b56317501f13
SHA1 0552dcc2948758dbedb62fb226639ef309aae14e
SHA512 d089bea318df101cf93bb2b5c0e0af166fd59eb3dc37e81a9697b0ed9d1e738ba7381100a594b0e9b7e1f40cc57fc35ac5e6584caf7d61d0b7d26cecbc3a7afc
MD5 SHA1 SHA512

Submit Download

svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABACABABAACAACCACAAACBBAABCCABCBBBCCCCABCCCACBCCBC.exe
Size 1.9MB
SHA256 b1e09bb15e690576866c7ff143c07a02cabf6e057322b3a194a88656091d1526
MD5 b0780b72482530520ea3dfec82642fe0
SHA1 49ef0485a7ea676e091ac2f5b2747b526de003c0
SHA512 4b6593884e36f45e529a9dd0c3344ef51aaa9db2e1be70b2aff0cf8f08e0392832f7ed31ef0ddbb260087a0ec2824ad4c9640366e7264d5b2085d7c22573d61f
SSDEEP 49152:U+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2OY5j:HKjKWQc+KjKWQc+KjKWQcw5j
TLSH
T1DA95AF0DFA8340B1D92B51B04CCBD2FF8E70B63486114E7BEB09DB1B7E36B91A419659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6bc2ea974d57f0cca3e2b4dcc437bf3dff69c03f9c32b5b32fda80fcf0d31e67
MD5 b65df75d7fd50ac0eed2aa3d531dfc6b
SHA1 4c0069f9de0c1eea7d77a05c88a88efba0b875da
SHA512 6ab8883346222714a991021d0a617b35cb1d888e54aa8863f2c0379b1d0d60a32266678d44a6e796d2ddce08c396db441c0cf6d2210bb55c1fee84324fc634d3
TLSH
T102112B10A4F588AFFD7368CB563DAA828CD833E79C5C6A092305911CBB94C318D194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-66-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-92-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1084-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3220-70-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3220-48-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3220-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3220-108-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3808-93-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4964-109-0x0000000000400000-0x0000000000421000-memory.dmp

Download