9407fc706fc9715c74df97ee200ccffa3807ec289e17b1b3e9150ba3733ce2bf

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 12.1MB
Sample260903-xrt3cazzb1
SHA256 9407fc706fc9715c74df97ee200ccffa3807ec289e17b1b3e9150ba3733ce2bf
MD5 f09093c070c6bf44ec34494c29300ad2
SHA1 c90a3792509522ff8cde8c41993f85de56fec262
SHA512 b8b896e2dff153c6f354f0ef883fa6c029b506731c4815ec53df1756550538f4ab5f646525fc97f748f7dc76859ab6ed17d257de144b4590d908a519e9cbf37c
SSDEEP 49152:U+EJ+E7+ES+EV+ES+EJ+E7+ES+EJ+E7+ES+E5+ES+EJ+E7+ES+EV+ES+EJ+E7+EX:xKjKWQckVgtev5mnlNLu
TLSH
T1E4D66D09F94340B1D92B50F04DCFD3BF8A60BB25C6128DF7FB8D8B5B6923BA16528255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
864	svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
1856	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCABCCBBBBBBCBBBCACABCCACCBBCBBBBACCBACCCBAACAAACCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe"	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCAAABBCACABAACBCABBCBBBCABBACBCBCABABBBACCCBBCACCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe"	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3768	sc.exe
1496	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3960	cmd.exe
3504	cmd.exe
5024	cmd.exe
4568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2396	schtasks.exe
6048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
864	svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
864	svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
1856	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
1856	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
Token: SeDebugPrivilege	864	svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
Token: SeDebugPrivilege	1856	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3960	2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	93
PID 3960 wrote to memory of 6048	3960	cmd.exe	95
PID 3328 wrote to memory of 5856	3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe	96
PID 2304 wrote to memory of 3504	2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	99
PID 3504 wrote to memory of 3768	3504	cmd.exe	101
PID 2304 wrote to memory of 5024	2304	2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 5024 wrote to memory of 1496	5024	cmd.exe	104
PID 3328 wrote to memory of 4568	3328	svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe	107
PID 4568 wrote to memory of 2396	4568	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_f09093c070c6bf44ec34494c29300ad2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCACBCABCBBACABCBCAABBCBBCAAAAABAACCACABABABAABABCBBABBCCBABACACACBCCAAACACACACBABCACACCCCABBCAACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCACBCABCBBACABCBCAABBCBBCAAAAABAACCACABABABAABABCBBABBCCBABACACACBCCAAACACACACBABCACACCCCABBCAACCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe" start= auto displayName= "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe" start= auto displayName= "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABBAABBABCCAACABABBACBCBBCCACACCCBABABCAACCAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACACBABABBACBABAACBBACABCCBBBAAAABACCBABCAACCCCBABBCAAABBCCBCCABCBBCABCBCAABAABAABABBBABACBABBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACACBABABBACBABAACBBACABCCBBBAAAABACCBABCAACCCCBABBCAAABBCCBCCABCBBCABCBCAABAABAABABBBABACBABBBABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAAAABCBBBAABBBCAACBCBBCBBBAABABAABAACBAAABAABACAABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 72c580648f205acb91b0855e610449fa8ac12dcc2b1d66d121d83cce9ceceb31
MD5 244491e708d2d6e5c187ba410433f1d4
SHA1 b1ae9a34d0e648361c07e6a2a3cf83043d9b8c49
SHA512 dcac9bade54f8e436e9270014faa93a3bc1da4d2835596cbfe5f123e0c32dea1a761ad9163fb817916e8f8f1699c3db5adf0a16d7be3c4b87d17e9b68b89815d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 7522f0d35a12826da4f1832b728e2b57b5a9594e1c7c757b3eed5a4d30ff4fbb
MD5 10dfa35608e0661921d1bafb48a72e09
SHA1 bbda7db862fb99bcceb33d1feea168f467b479fb
SHA512 31bed1870b65867c4a425b4ab39c0746ea02b98f87502b1ca9fa9a8194b34de203eb64fe017dda40f6d14f86af82afc06a4d4485be2a3c3b9ebf9aa96b420b84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f450408658c044f19560a8f89492a322a906a1a5050d29ae3dbb2d5c2e53f84f
MD5 980173ff4684c1030807d129ca4f5625
SHA1 8db465ab17138ba56b6ab73269917a7de4ce045e
SHA512 8c0a5408b07b910b0a3d420db48edd126cd9b7bfe2e5d3aec49ec89ce6c816f74d917f9f5d46eb3f30406bd552cb306c7fadea4c5a2e6606015aaf30121c03b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\qap`g`v~dtlq
Size 10B
SHA256 d218a90ff1fb69ada93ab6d302329f60f69a88bc4b35d36cbe6a6acd0f7166cb
MD5 0b60bd23666f1bb11d2db13f641446cb
SHA1 24e5e9f4f9a3daf9b438dfd52ff1145965f6010c
SHA512 f392da9e2f9191d6b3bd4fe848c77e4461e004828283d44c939b695d58833e0a3e48cbef4b8e5ee7acb0b526647b2621d316c43baf9f30d89cdafed27ca6d151
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 12.7MB
SHA256 7c6f0662d66c0a2b8342fba52c01c95bb08a587fe9d66916bd81ac65d978d97e
MD5 a3f9787bc5c918b3c046cf7c71800f11
SHA1 34df362b4c2f35a78e55daa81c10b32b42fa6f65
SHA512 9bfc45a4d01dc0bc8bae6200f5f4b9310cd704ab7b5ea63b48d112fd102fed3f36a478d9f154677d530a9a518b85d840df67c75ba18cc8a551f05ed2c5696f5d
SSDEEP 49152:U+EJ+E7+ES+EV+ES+EJ+E7+ES+EJ+E7+ES+E5+ES+EJ+E7+ES+EV+ES+EJ+E7+EW:xKjKWQckVgtev5mnlNLxgZ2Hb9t+2xf
TLSH
T171D67D09F94340B1D92B50F04DCFD3BF8A60BB2586128DF7FB8D8B5B6923BA16538255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 51929330bd88b59c62581398ecee99a7516ec263961674999410b223b6888f5b
MD5 7c4d4789bae3f2098188af2c718308ae
SHA1 005e11f9f40e14340a459e3aa69d4c8c16c2838f
SHA512 d8b3d9c7e6132ab6150e2e2f11325bfbc7e62978cb86b56b9057f775dea6173d50c7c8038a1de3555b47799781c0a963bc8596148aa71466dd5a764f0b0f9154
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\qap`g`v~dtlq
Size 10B
SHA256 31a1e241ad8f9c7c6416f8d6aa32f70ece84e26c9cc363e2f928e7d265e16469
MD5 b7b9f84f04180b026a448ea44e01d023
SHA1 08c9ffb16ec4f7341771b6a8e1d082c6a3dc6be9
SHA512 d1fab54848ffa601cf8f338bac0ba46f0a572a9655a3bcd489acd2c0f8bc6c9f347c89f43fd8db1d1e32536d2e34c08e17b611f6a6d4274c76439b09bfe7b225
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 e2e03dfd9b90a8013ab81870b0ef3d9cd77c64b5e3be04f9b469e06beb0b0c19
MD5 5079627c12bfd08307aa4eaf2cf76b54
SHA1 6cea2454f5e3acdf2387e91e10971dc36f30b35b
SHA512 affbc3ddab55aae829f8fb9b845b204021465c5da5995272be2f5b6f8d779e4f6a56cf57819c7ce798fef67373fd74261863d344d652118747a6d535f69863bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\qap`g`v~dtlq
Size 10B
SHA256 89daa9dc95e6e2dbe125a31ef2fe80e0786d40bb8c245525952ac96c6ef23a3c
MD5 8ad08cd99d9722cf6509973a10ce2586
SHA1 9045b13a7eda0a913ce00c352fbbc7ad7859adfa
SHA512 45a5bbcdb87ae4178cec2de6ae0dfcc0cc10eab3ed09315f8003750831b1607f49936bde6b2c9cd38559e1122efc1ac7e6b13daa93def9522d925f33e945767e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f84397f617af8fd63f4f6411620c798675100849d66a5a1ec61ebf6fe56ec37a
MD5 7ad967fea9db3b8ea32f86909a6dacee
SHA1 be0c9ff56a7745804715751cdc93948f776cdbe7
SHA512 fdb51c90af4dcb3e4854df651c49e6ddb114764d39db384f77709fae3b6b85d66b19940b7694e45168dceb344df9728182267bbfdde43e105113e4bc0edf05de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e850c951cc80dd74680fa7621028c5bf7de096eefce924fc559b480257257228
MD5 1ab069bf04c57966212054c9e8c58bf0
SHA1 aa1b4596987a845b67368817bdf3c193d47fe88c
SHA512 e6903081e4c26cc3967b1f4202929e27d999f641f51f30d5df055de7b5cde6f116329e17c02d9b26e3c6b652f1df732a00d4b51092a7e54d88bec91c5ca20715
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96b8f27c204a5628a0937bc51a287da034c24c6912b485e494cf69f88bcb9c99
MD5 59f1e468db75ae56eb57c94a3b578733
SHA1 f0117d4d7a27e4891a5a68dfe52a886135e8aa57
SHA512 1c12b820e4293c27caaf508eaf6acb853dab4cffec0fa7653b0258347140ed5dd59ebcb30c1d110dc690a8b2b247162a1819fc2202454dccb73864a0532be10a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 469ef65c23f5d5d9eb83a93ceaf90308bd4f95c902e5d9ec4c3059d05929dd51
MD5 bc77bc1bf8d80244a8dda46ebbfaf80d
SHA1 9d77a9a4f48b27345c52d1680179d07f08b14423
SHA512 186d5a9a617163fb7b9e722799979e5d5ba1da3861de68271497fc0b789fbdc22d8ee46a75a858fc55aedf98f8165373d1d970a5cf2c0f6c114a66f97f408e33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26027a9ec0887b9a86677939f8aa97303fecefcd17acda17f0badb29b8cac1af
MD5 7d93e95037ae741c99c4240366364974
SHA1 701910c0faf44434940ce2091c6cafb20c48373f
SHA512 47100698fcd9d56ee9418f7b82c75ef150b63fc2bbc4e7b2bf5792ba4deca21fb6d6be068c51979e688e8194a833f0069b983a919e1577855cced191660cd00c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3dbddb3e03cfdb3f495a218aa71a94a224e8009683603b143af5c26331a3895
MD5 d2ce56e94c0c98e808a8b7e116fc05f6
SHA1 58332d43674574099179d3b671c50dc53a5d0cd5
SHA512 7fde93d930a9e52d560c3e4e1726413d46dc9ff6b5af20be13b1591039d1943d78f9cb7e7f803d1700804a4a0c19ef63e9e93885db58332298658dc6c0917782
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 779fb19e3ce63cf1567701375cf30702cf434e98705860b6ee6eca371d6bde6e
MD5 7543275ced84cc8a7be86ae2f6a376e0
SHA1 ee7ae281ce3a2eae78ccd90fc91896507124f13a
SHA512 03fc31cb41625944c4204f27d75c6fc29949ae2f84b042b4f0465760fa623081afd597aa030d75ef18bd72ff1a34428f5b09f41aa6a5154632f7aa4f1646460e
MD5 SHA1 SHA512

Submit Download

svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAAACBCBABABCBBAAABABBBCAACAACACAABCCBBABBCAACBCABC.exe
Size 12.1MB
SHA256 9407fc706fc9715c74df97ee200ccffa3807ec289e17b1b3e9150ba3733ce2bf
MD5 f09093c070c6bf44ec34494c29300ad2
SHA1 c90a3792509522ff8cde8c41993f85de56fec262
SHA512 b8b896e2dff153c6f354f0ef883fa6c029b506731c4815ec53df1756550538f4ab5f646525fc97f748f7dc76859ab6ed17d257de144b4590d908a519e9cbf37c
SSDEEP 49152:U+EJ+E7+ES+EV+ES+EJ+E7+ES+EJ+E7+ES+E5+ES+EJ+E7+ES+EV+ES+EJ+E7+EX:xKjKWQckVgtev5mnlNLu
TLSH
T1E4D66D09F94340B1D92B50F04DCFD3BF8A60BB25C6128DF7FB8D8B5B6923BA16528255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 71e0487cd23ff60b380fa3b0ebf8c7aa6b7b8f4af2b37d4279c38506c97c6fd9
MD5 82681c0ede9dfae2ee495827235372b8
SHA1 a179b50a8dc55aede3d3e55d6e834f7fd63243c6
SHA512 a099db85ef5fe5614a9622d1479b33ba8255a1ab898a84866ee347290dfaad5e571f624ee35e5b1cf5075cf975982d4f8ac461a4aee0a668a83307d72cecc11d
TLSH
T1A721BC72A0E5D863B13368C3A316DBC70CB82BD75C9CAB40631D9218E6C9836DE1D4B1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 704fa208d2010d1a5e1ab9bdb5fb7076ce1c8b36be092d215e4deba726464e87
MD5 fdb6d6210e790bc7e86590df009f8294
SHA1 669cb6ee2ccf0abaeaaa52c559e13dc43b1a88a3
SHA512 bde8c1200f3ae0619675b1a223a247140a4cc947bc21d3b691295a6a1d88fc9e4542f82c90189ad33584940c9494cbafdeef2a4b2fbe139878b897f29348f0e2
TLSH
T11D11A772A1E5D893F13378C3A3169BC70CA82AD75C9CAB547319821CE6C9836DE1D4B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c594323db225b2e07b39577f445ca7599c4ba79ccfb2cc527f2e7b16767542b7
MD5 2f868a49193b29c446b7f8a42d2dd88a
SHA1 a305a9e20ce196a3cd9738a67e5fa682db49cbcb
SHA512 03bda71b2ffe26bc7cc6d0d5e6f45d7e2ad53b4ee41d45e4ad7b1098a72706b120867d58d34693f7a5864a47976783cd837bd0b06c6ee6ef66b4b99b994a7a03
TLSH
T13E21A771A0E5D863F53368C3A3169BC70CB82AD75C5CAB546319921CE6C9836DE1D4B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-1587-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/864-63-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/1856-75-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/2304-6-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/3328-33-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download