05eb4c71c046eb6fc6d57ec1afe436af677aa6c204c6255f63743ce99fc43968

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Size 1.8MB
Sample260819-ynfafssclb
SHA256 05eb4c71c046eb6fc6d57ec1afe436af677aa6c204c6255f63743ce99fc43968
MD5 4931ab61824455c3b8f0b0716063bc00
SHA1 99d32e4f893278852740e2d62dc3c5dc5ff0e423
SHA512 29691fb312f44115fa9f34c895f203a58ec97432636efda26c7b9e27503d386056acb77d04a27154b328697581a3ddc8c23391183872bf3ee7eb5bff847d0bb6
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2PqatglK:HKjKWQc+KjKWQc+KjKWQc0N
TLSH
T13B95AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
4928	svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe
3632	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABAABBBCABBBCCABAACBCCBBBBABACBCCAABACBCBCACCCBBAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe"	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBBABBCCBCBACCBABAAABBCBCBCBACACBCBACBCABACCAACCCACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe"	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2892	sc.exe
2480	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
568	cmd.exe
1708	cmd.exe
3192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
4928	svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe
4928	svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
Token: SeDebugPrivilege	4928	svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 568	3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 568 wrote to memory of 2600	568	cmd.exe	104
PID 4720 wrote to memory of 3052	4720	svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe	106
PID 3052 wrote to memory of 3300	3052	notepad.exe	107
PID 3976 wrote to memory of 1708	3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	111
PID 1708 wrote to memory of 2480	1708	cmd.exe	113
PID 3976 wrote to memory of 3192	3976	2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe	114
PID 3192 wrote to memory of 2892	3192	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_4931ab61824455c3b8f0b0716063bc00_amadey_elex_glassworm_hellokitty_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBCBABCABABCBBBBACAACCCACAABBBACBBBCBAAACBCBBBAAABCCACCCAAACCBABACBCCBCBBBCAABAABCBCBACCCBCBCBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBCBABCABABCBBBBACAACCCACAABBBACBBBCBAAACBCBBBAAABCCACCCAAACCBABACBCCBCBBBCAABAABCBCBACCCBCBCBCCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe" start= auto displayName= "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe" start= auto displayName= "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCCCCCCAABCAACCCBBBACACAACBCACCABCCCBCBCCAACAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBBBCABABBBCCCBCBBBBBBAAAABACBCCAABCCCACACCABABBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
1⤵
- Executes dropped EXE
PID:3632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e8b7360e036187421bd991d9857029b551fa1a6fd8fa9b1e78cd5ab86c77d81
MD5 8a7efb827c3c270235870536510455f0
SHA1 875139598be623d854999d51bea62002bc02c1ea
SHA512 19b4eea9aaf24a95d1b7c8aeeba647c95076faad2f3fafba9fac21f7620d79b3c0034ff87a059781d08d884d0bcb11c21af768b125eb38111180d5d9d0f64b74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 193cc7e9add6a4fbe3d8ff5d6310d08f456b61f9d89584d2768d9c35f4326291
MD5 4a9124f29e946f9a03e46d4aff888ce2
SHA1 8973446946b349bc1d4eb9d8687568022173b21e
SHA512 0622ae17b05d74824758e8105ee4273af07ce841315e48f104c4911b30c9a05e2d85716540f7833e14405e2f37b68674b9c4a1a51ec3874378f3bc521f2f77d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ccdd38d1a20d929d0763dbe9365be65c57870776fc4e3d6a957744a8e2c169ee
MD5 4a9a3d700929906d2d8aaf6d8b045eac
SHA1 3efe3f748098828cb48c3709a31806be3ca4f0a8
SHA512 e0daf9421bbd1d98c0f50c9c683a9ccf64a8a81bde76a5588322afd1f80b6f9b56ea0d953c6afa95ac9fcb37ec1188e6c4e4eb85f620ae36c1477edd1e73177e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da62702d914007aadb8166add9cb0fcbdc456feee7c1e594d6bf56b8f1f478ee
MD5 4260ddbf87248599cd4f99c2195f557b
SHA1 d9684582862e89168294fa0dd14c5992c584eb02
SHA512 7fa574e1c69af510f5fadcd39b790db222c1ced38ac5524dc49bbf5cd6ef6847da02f33d85ca6d5a0997c59588ca6a248c16c19883e209d0a9bceb3bb48606b5
MD5 SHA1 SHA512

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 22.5MB
SHA256 726dfdc72cc500dfe83dddc7d1f9a388c44b46722bd1301c5c0ed9ef6c976b22
MD5 98b410351d039c3f6549f4a655fb0492
SHA1 3db4e21f95c99405848c681971982fffa3572c6e
SHA512 6c9d160a5285a251d10aaf73b2cca819fdd20cb36c0d0d337f07b9360c06c2d951fa56ab6ee860539663cba97bd18ea47368ae3decdc5e287d78785399096be9
SSDEEP 393216:lcScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cSx:gS
TLSH
T12137AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 5.9MB
SHA256 f695e3823ea905db3ad9a675f1398169694d02edf0fab402b97b7d54be60afae
MD5 6196e7113610b0a11b5b142de027a8a6
SHA1 fa6eebf01ad4b072e1f7c416bb70a3b91a093a33
SHA512 9c7e5e4dea554c641085627158be0d39fe9987474237e13f914bc2c72f316def16ba5c61e9c5247cfc02713ab2d587afcbb75f3067eac26367b43edec0657b4d
SSDEEP 98304:HKjKWQc+KjKWQc+KjKWQc0FKjKWQc+KjKWQc+KjKWQc0FKjKWQc+KjKWQc+KjKWx:sKWQcDKWQcDKWQclKWQcDKWQcDKWQclj
TLSH
T1D556A009F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 320KB
SHA256 d3e062719c0db549c6bd4d041b1de2164b6f3c9d7c28ec79cef877cd41184cc5
MD5 201a847144da3dae0f68f1dad0394304
SHA1 cac753eb1be1b86a7620690b6e1c106a893a5cb2
SHA512 a93403ac1a95071304729076d6a0c8ef0477be87284247b44ebc1b5a129f7285c50f69a5f5e9bff869ca148ce437730d7c5e9167b66637af75237a7d3e694ad9
SSDEEP 6144:m+dTTUFgEs3Xojk8LjN7TqK8tsp6tiYNAKi2BGkYZba:mgUFgEsnojk8LjBTqKCNAKiWGF4
TLSH
T18464C009F9C280B1C93B15700C97D6BACA38FA3449119E6BE7498F3B7F35B91E4146A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 13.3MB
SHA256 fa2547135699f1f9d06f96938a41759f9fadd10faabefa256add214c7add0157
MD5 3d2ed933b4b4e5bf4a2ade157edfd787
SHA1 c2565eecb8de0ad5a2b68c7b2e5b7eccb405f347
SHA512 39ca31cc8163a5eb8622ee140d97223b1e2bbcb0f4891cc73fbea598a2427277baee72fab65da78fae32480a59520e860982de730c83f942d75b6c40a2c139cb
SSDEEP 393216:lcScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScScS4q:8q
TLSH
T164E6AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 15.1MB
SHA256 f19a233ac08a00cb6b4d2a44793b5c16f270c3de8b80da98110905ae92ca7daa
MD5 a988ee2e7953d27636b3ed25d7e94355
SHA1 b4d67ec1c221ed48d61e578df647e250ba33ec8f
SHA512 f10701e487eb9c90f3300c23b6e603254f2c11800b5b3cc9388c70142c304e8c5161628567729ab45549fcdb32822077d706c66b7d55489d4823c0c1bda3ea05
SSDEEP 393216:lcScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScScS4t:At
TLSH
T119F6AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 16.9MB
SHA256 278064f6a0f668db2120843c9d6bca536d4d5775dd3d5a4c5cae57396660822c
MD5 f7063f3df2274702d165eb8753a83257
SHA1 1a4995906af0ca2e5d98e5806b0f2bf76ce1f7be
SHA512 670136045748192229c71c22aa1395f97bf78b3bcd1cc39855f864061ae76229dd078e334fa6679a3d22d12dfafc4480f6a2d76d6b9b62bd509dbd9225f969c2
SSDEEP 393216:lcScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScScS45:M5
TLSH
T1EA07AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 20.6MB
SHA256 52c82809bc02fcf956d12e474e10c47384714eecfd2ad3b1f871decf5cddff45
MD5 a42a7cd5486a30f7997e5d7c8af6ce6f
SHA1 a38c54fe8f1a9e8cd1ae41de0b4d2150c42a0381
SHA512 c6a040405dcd5cc356e9fb1974039f2ddc803cd66df7dc25d35e311b4fe9572dfbc9800ce5a9748c244b1fa329b1ce6ad5aa500e762aea9e721413e89ad10c0c
SSDEEP 393216:lcScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cScSc0cS7:cU
TLSH
T1B927AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 57d8ab70d7dcc187b49e0a0794bdad7fad6884047c790dfc4dad19d5684ec439
MD5 415411e8c77342daaebb656da4e88e04
SHA1 00b807e4f15657356cbaca06d727b2d9bd018ee5
SHA512 1aaa71142b99ecc7483ec0d903123966230d5459e3cda4b92960cba377b5c020268b3600602ebf285789477687e2a839e645e6165dfcbbaccf23e2c96f177e32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b02df049112619e245a7a5037923842240b62a13bc94e286914484e1d517b61b
MD5 e7d006b3080a9bad635a8f4990ed0cdf
SHA1 726c360301cfe6144ea73edabab29b01ffe29b67
SHA512 335855a4db49db99eda4e85600bc4b47f71155455dd8cf77554169907ee3e29123cf815c9fa35daaad635574eb9a1c281c281c4f017599dc4ab10e723a3e252c
MD5 SHA1 SHA512

Submit Download

svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACACCBCCABBCCCCACACBABBABAAABBCACAACCCCCCBBACBACCAC.exe
Size 1.8MB
SHA256 05eb4c71c046eb6fc6d57ec1afe436af677aa6c204c6255f63743ce99fc43968
MD5 4931ab61824455c3b8f0b0716063bc00
SHA1 99d32e4f893278852740e2d62dc3c5dc5ff0e423
SHA512 29691fb312f44115fa9f34c895f203a58ec97432636efda26c7b9e27503d386056acb77d04a27154b328697581a3ddc8c23391183872bf3ee7eb5bff847d0bb6
SSDEEP 49152:U+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2w+EF+EF+EF+EKKjKWQc2PqatglK:HKjKWQc+KjKWQc+KjKWQc0N
TLSH
T13B95AF09F98380B2D92B01700C8BD3BF8B74FA358A129E6BF74D872F6E33791A515655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c978f54445118e3181cda6a0bc4a025f9042865dbe832f7830ba0c4fe1f67de1
MD5 1796985e225d97deeb7fe46b11036a92
SHA1 bef292e7862c8bdf0798d3cef9ddc1b9cc94e869
SHA512 750fec05e5d3da1f75e14a22f0f7eac567c85b037a573b57d0003e6dd0ab6a7fcdf3ae3bd5d43665a631cac12adfd5fb1611d0fbc843a301fd235908c511a753
TLSH
T197119462E4E5985BE933A4DA623D9B83CCBD379BA85C6A14130151195FC5C70CD690F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3052-78-0x0000000005C30000-0x0000000005C31000-memory.dmp

Download

memory/3976-25-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3976-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3976-75-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3976-12-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3976-51-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4720-76-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4720-52-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4720-37-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4928-109-0x0000000000400000-0x0000000000421000-memory.dmp

Download