dcb57ecaa0364e588f8d8616e03739e5e2f3af273724b8817b89bd71d44b7dc8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Size 20.2MB
Sample260831-vqs3jsdn5x
SHA256 dcb57ecaa0364e588f8d8616e03739e5e2f3af273724b8817b89bd71d44b7dc8
MD5 90c4b37fe2ff60f87f841e9d3a7ad7e6
SHA1 220404571f2711898a395db1cd1cd7bfa2f425b5
SHA512 2af142363b7efbf8f47f803983d6a3a55d9e57004e55bda67d104c753402ca33a4e7e1f3c5c6363567a101d66ec78116a8f883f8e328959436fa7eef3d166697
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ES6:h+4j5p7Z
TLSH
T1AB273C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DCB5BA933B916438555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
3648	svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe
4980	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAAAABACBBCCCCBBCBABCAACABCBBAACBACCAABCABBABBABCCBCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe"	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCBABABBCBBBBAAACCCBBCBAACBCCCACABCCABABBBBBBBCACAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe"	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5016	sc.exe
4780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2152	cmd.exe
2428	cmd.exe
1304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
4980	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
4980	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
3648	svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe
3648	svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
Token: SeDebugPrivilege	880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
Token: SeDebugPrivilege	4980	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
Token: SeDebugPrivilege	3648	svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4560	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2152	1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	95
PID 2152 wrote to memory of 4564	2152	cmd.exe	97
PID 880 wrote to memory of 1960	880	svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe	98
PID 1960 wrote to memory of 4084	1960	notepad.exe	99
PID 1568 wrote to memory of 2428	1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	103
PID 2428 wrote to memory of 5016	2428	cmd.exe	105
PID 1568 wrote to memory of 1304	1568	2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe	106
PID 1304 wrote to memory of 4780	1304	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_90c4b37fe2ff60f87f841e9d3a7ad7e6_amadey_elex_hijackloader_luca-stealer_njrat_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACAABBACACACACABAACBCBBCACAABCBBAABCAAACBBACCCACCBCACBACAAABBABAABCBCACCCCCCBCBBCAAACAABAABBCBCBABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACAABBACACACACABAACBCBBCACAABCBBAABCAAACBBACCCACCBCACBACAAABBABAABCBCACCCCCCBCBBCAAACAABAABBCBCBABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe" start= auto displayName= "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe" start= auto displayName= "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACCBACBBBBBACBCAABBAACCBCAAACCCCBABBBBBCABBBACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBAAAACCABABCAABAABBABABCABCBBCAABAAAACBBBABBACBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9a1067e8d6bb6dacdbf6e3355e0ca3c907c9d0d9de800e1406126c390a65c1cd
MD5 e90d3ee7c2bda158e17f18ed4bf337d7
SHA1 c7f2d9da2caf4466719310e100c5a7683d2254ba
SHA512 58e3b836b3338dafac4a991b1862ecbbdaf99a4c971d284b151666a5e02d658af705783a93c031d5330b15de3bb32f85bfe5b8770567924c49dbf11c8706cf99
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 20.7MB
SHA256 5c7912f29bc63c987873f21c0e337680a48fb2a8484dc5f45df6bc8a414b99f0
MD5 6c40168ff9e51ca0d26c1fca006e554a
SHA1 d5a88a8dff488539b1c654a0d5265ecaa4b6955a
SHA512 852c12944b3288f101955d48998fed0603a3972cce97aa9254cc5c6c47c7debc25a4588ce6bbd626a631c1c297c912eef9fd26c71a3f9b497568b37a783a6c78
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESd:h+4j5p7Wpio
TLSH
T143272B09F94340B1D92B51B04DCBD3BF8A60BF2586128EFBFB4DCB1B6932B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 accfbbbabf7ae1217777d18fd30142d429ec7cf4da451edbdb4e9fbb5c22c169
MD5 9a454f7381281f2c19d69b463ecac183
SHA1 58ef79628ca7c4d9d82350e1ebee59c899ee8ec9
SHA512 62d5da72f41a7379d8da6380f0a65d87e8b251b44288e766223d6d14cd736945fc59bcd4800666fcc3af5236a00c6eaac5ed7922d90df0a7a81076a60a1f8569
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\Install\qap`g`v~dtlq
Size 10B
SHA256 28120ca4f3589f84214d85dde3caf3926e493e322d21f9cafb2d70806041b15e
MD5 1ff75bc127e2b81d260ae026cf79988c
SHA1 4b4b688ee3099f20ca4003ac84853e50ca27946f
SHA512 acca3e7e761c46654d6ffc5b8e50cfb42afc8309ce3fd4664020e4515b8b47e8ced553d29ad9211348ba1e076857fca7a974de0d9b75ecc999743acb6bc676c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 66fa91bd791ddb806aacb1b9468e5e5a8b9d2355fc8799454689334f10c83f53
MD5 aa0523f57bb08c292b2fa6b4bb84eeb8
SHA1 4761f0b85434f2fcd7c2d6d323cf250eae5872aa
SHA512 cbfd0ffb16cd38b5cc3f2e1de738cf622d799256a0bf59a5a522778e938dff432302e3740b6e9a3d2ac3ad2b5472e2fae4b89543b072862657d28fe4d6e7593a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 7ce9cd9ba352ddf74521664e8f369f01fecd996d7a91653539c848a72acde2ca
MD5 215d0d1d35dac575d241cfa564e00634
SHA1 22cd49377079cffab7cc73f724529a61823b1596
SHA512 ef178724f86838f65e9b4cd1682f4fd561de3daba5252b4c80b1b93913da399a5b004ec6922f9b2b10214ace21728ddee5451097bcb98a32e96f61fa2927a2a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64\qap`g`v~dtlq
Size 10B
SHA256 7e722c18c4327260e48f3d8b4686870e2cc291d1df4453a6535a70abfe2e6374
MD5 1100523bdf306738df976c9d5dea3e54
SHA1 924361e0abce5d6d636fabb602a625e6accdff50
SHA512 5adc21508fe600bbad80587bd8ab7836621068b647b2cced9042870e932124bc738e48d50da83a651604558782224c02b210be063d1d84150c7522b43a5dd675
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\qap`g`v~dtlq
Size 10B
SHA256 d43fcfbd935aa51884c74d8e66ec6277eb1a92057ca212b0032d1ee76408ef77
MD5 2fceaef101b060dbf9248827f5bb9e10
SHA1 fc68c610b8dc27d058052cd8ec2269a322075342
SHA512 fa4398bea05a47b2c6b5caf4e4c509d9f811d2304f147ef476d755fa625367696c6f2ce85374e72008fe9fb20c7f086b9e606ce630a2836966aa2de3500534e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 03d963fff4178d3d936152207f3e2df5951a30fbb8a6212bd3a300bd3627f20e
MD5 a8437afaa6211dd45005cb71745893b1
SHA1 28ff5e234dab0aa19d54a18e439e03b89ccb60b3
SHA512 2be148c343aa6ea5b155be2d0273ed0b2378455d32be6ea3459603cfd24a2da037b494590115193bc763aba04d361e28dc2d147948da90f6bcc0362b2d255d2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 4231e89d16aa1ff0eb4e9e71ae8f134ffa9870d7712bd5948dcf8c41b52325f6
MD5 7b5dda8fe37c826fa1f7151c0f31bf70
SHA1 2d39481183c60a0a9f5398446fcd580e2652ca8b
SHA512 d4bdcd9058a77835dca87b8c9582020fcc84920c32e9cd4dc56e30c3b926d87a9748fa3dab883ba47b0ce80a65e7bd531ce705d786502ae532ac34e2a8687667
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d6d121905ffe9a86347e154015e92dedc9c33de12368b156e65008d25420de2
MD5 e633e448e2459882f08e0289eae95796
SHA1 9d4034a43bbcae5eefba88eff2ccb55edb0e4fbc
SHA512 c48d610e1c338d96ba57c691b8e28527cb5471ff4e4f9fea612eb56320cff421a63814058b4ae5c88ad26c962c663d124758d611955d3af76979709b8a20f68b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b4d3ba9b6bf2b47c8b114566afd4b723f3e93e16483955e29f867300d39ac6b
MD5 aaf28e7942951308a3991529679b3d8f
SHA1 62323880b13f8df19ca0e48753539f6ce701108f
SHA512 a10afe9d44e5fd852a8140cb22a1dd5fda733c5316c369a81a07b755d9f8d14e74146ea4264e99d4f57e388947302f6e08ce565e90609870ba7fbae18f1119ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e9f9dd38cd250aee710a71333b8d0e6203e0119e4b0e8a9631964befffe2261
MD5 3463a17fae266995ecb21b1b010f3080
SHA1 4047ec9bc223ee5a7354e3373c830e8d0e4fa48e
SHA512 efdc9483219426a935a51959f576a22165074995c34f80eab42c078a32e8585bdde82446e65915652438edb1c1e0fa6b5d2c44b08d7c425ddc0de7c12205445a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f25b758e4218545484f891874cbeab44bb60cd6626ef2824504649342887686
MD5 b4d630631d2c2db6c2222aaceb6ec87c
SHA1 65742847fa70ac778e0d4b8226c108b1a8b34011
SHA512 a09d2c1e1d5f649d1b9240a3aeaa8818fea12693f8b1573a73b65e7f7891c21b200961f617d72c73eb585d67b939005798f116cd9c1415d46849b8f604130731
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 317259e820d86b6cf1fc78c8bab43c3a38f95f4a1c59224021147d13a3d70dc4
MD5 52b553eba30f144a51c422052b890e77
SHA1 8c33ae6d6016fac299bece65f8907e02ffffc6d7
SHA512 cb214814ea893d396f47a115ce756b0e0d9d2be396b7fedf4f706fd734016ce4ee1f6066bf40a3c178a665746f01058c416570dafb6475a8e9b7c2b50d6f2a63
MD5 SHA1 SHA512

Submit Download

svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACABBBBACBCAACCBABCBAAACABCACCCBBCBCCBACABBAAAACAAC.exe
Size 20.2MB
SHA256 dcb57ecaa0364e588f8d8616e03739e5e2f3af273724b8817b89bd71d44b7dc8
MD5 90c4b37fe2ff60f87f841e9d3a7ad7e6
SHA1 220404571f2711898a395db1cd1cd7bfa2f425b5
SHA512 2af142363b7efbf8f47f803983d6a3a55d9e57004e55bda67d104c753402ca33a4e7e1f3c5c6363567a101d66ec78116a8f883f8e328959436fa7eef3d166697
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ES6:h+4j5p7Z
TLSH
T1AB273C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DCB5BA933B916438555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f7b65eff933c59cde2dee2ba09b54437486aba1654383e8cae7c9817ffa9eb68
MD5 4f4da2b2540afaef1af23f754b2410e6
SHA1 bd84f7e43c2d3a6196cb7bff54b1f8885e7479e9
SHA512 c439669ae392af0c6bee495048f85d601def21a5219fb6882d519da2ca255e05437e19a9495572ef739184fbf4559b1ec4dc0b28afc422fe1a3cc585d6842249
TLSH
T12621F970E0E6C857FA3328DBD621F9C70CF4358AAC5C5A196309811CB7C8C708F194A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 74a222249f7eee2506103e6094acd1ca7bc5f79f0108108527d8fe31be62567f
MD5 167ac832dac5571e1116ad4c486fd3fd
SHA1 71ecaf040bdc3ea803b7330fedadd33b7f24b447
SHA512 dbf1e176e4b880a9eec4298fc8552f6729fbf03f815ce8913dd711507e2904bcc87dadf683377a085cb6ade97c7e0c9be5a1ca94a7881f072acd9dca17e96ea7
TLSH
T11211EB71E0E6D857FA3228DBD625FAC70CF4368BAC5C5A19631D811DB7C8C709E194A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-35-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/880-25-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1568-6-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/1960-57-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3648-2890-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/3648-77-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4980-1792-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/4980-3025-0x0000000000690000-0x00000000006B1000-memory.dmp

Download