c1c583175cda4e16955d2278706a2f0e44763a9cd731253e15364996a78450b8

Analysis

max time kernel
151s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 28.6MB
Sample260907-z4qa2abd97
SHA256 c1c583175cda4e16955d2278706a2f0e44763a9cd731253e15364996a78450b8
MD5 5b91e592d0e7c50422a0a70b5fca68b2
SHA1 7ca4882ad2da45fdb9ebe4e358ec85c4587fd58f
SHA512 98fcb0e2c68c625959f5a8e819f30150b8b9bcd0f81caa0066b23f50135361c6151c5bd2ca37f208ac714a324f80e99c77aeb63365086946fe3664eadc90e582
SSDEEP 98304:fLLLLLLyKjKWQckVgtev5mnlNLnLLLLLLyKjKWQckVgtev5mnlNLn+4j7:PKWQc0gEYnvL3KWQc0gEYnvLfj7
TLSH
T192677E09F98740B1D92B50B04DDFD2BF8970BA2187118DEBF78DCA2BA923F906538755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
4180	svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
4608	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACBCCABABCAACABBBCBACCCCBBAACACACBAACACBCACBBACCAAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe"	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBBCBCAAAAAAACABABAACCCBABCBBBABBBAACCBAABABBCBCCCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe"	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5112	sc.exe
1756	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2904	cmd.exe
2768	cmd.exe
2436	cmd.exe
3276	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3340	schtasks.exe
1896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
4180	svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
4180	svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
4608	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
4608	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
Token: SeDebugPrivilege	4180	svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
Token: SeDebugPrivilege	4608	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 2436	692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	95
PID 2436 wrote to memory of 3340	2436	cmd.exe	97
PID 5396 wrote to memory of 3368	5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe	99
PID 692 wrote to memory of 3276	692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	103
PID 3276 wrote to memory of 5112	3276	cmd.exe	105
PID 692 wrote to memory of 2904	692	2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	106
PID 2904 wrote to memory of 1756	2904	cmd.exe	108
PID 5396 wrote to memory of 2768	5396	svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe	111
PID 2768 wrote to memory of 1896	2768	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_5b91e592d0e7c50422a0a70b5fca68b2_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABBBBBBCACBACBCCCABCCBACBBBACCBBCABABBBBACBABCCAABAAACCBACBCCBCACABAABCACCAACBBBBACCBBBBBABAAABAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABBBBBBCACBACBCCCABCCBACBBBACCBBCABABBBBACBABCCAABAAACCBACBCCBCACABAABCACCAACBBBBACCBBBBBABAAABAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe" start= auto displayName= "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe" start= auto displayName= "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABBBAABCCBACCBCABBCACCCBCAACACBCAACCCAABBCAACCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBABAABACBBBCBAABCBAABBCABCBCBCAACABBCBCAABBBACBBCBBCCCCAAACCBACCBCBBCAAACBBBCCBCBABBCCCACCCBBACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBABAABACBBBCBAABCBAABBCABCBCBCAACABBCBCAABBBACBBCBBCCCCAAACCBACCBCBBCAAACBBBCCBCBABBCCCACCCBBACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBACACAAACBACACCBBABBACCBCBACABBABCABBBCACCAAACCCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8590b5334363b50e77d90f9e7b65b3d06cb1244088b369d43c344c4ed88cb6ca
MD5 6e24660672b7c1802eeb0b45c14613ea
SHA1 d267e1edf134bbe4a7f1714c7b98a94ac484cc58
SHA512 80b679f528e2dcbd2b96aea237bbe486db7f96db6e8a9ca9a0b26c43a9907cbdf80c7a4df6434164f773f2bafdd5dbe4eb6353ff6c7fe97cea40da5b1dabf4e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 1bcd0a5ed3f66eb67273286651eb8aa183238f4722292baa8a7045c22dd9b989
MD5 311f8001272aa3d891d8420c907cfc77
SHA1 e51e59a2792b05a8f48e0c4dd27123dce817a2d1
SHA512 a2a56a11b26892506209b9673397ae2ef7be29103b6d98276e94bcebf3ef0eb118b55e54d1b86824be71341ab89b5e516556383c25a782b296a2f6e4844992a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 e187e03021a8f8b6af399c6ba58dedd77842dc288eeaceb31051be9f570cd18f
MD5 13df6285d87725aebd126154f88837d3
SHA1 055de8cf40a76c3ab72788a8521b4e24793d9f5c
SHA512 606f29ddc894ac4e013a219304d2055e332d3c18a6f564f112da779daf2e0326161f045e75225dfa50e391ed7f56d5dfae71dac97abfba97d70cc86e4aae3ed7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Provisioning\AssetCache\qap`g`v~dtlq
Size 10B
SHA256 ea30df2d5fe003265e049ba1f53eaba692d029ef0bb1aa36177d24da05e95397
MD5 157cffdbd7816cda72654fd83ade8f5a
SHA1 f8a1465817f8834c779f9e2d80a29b86006436b4
SHA512 41598f6d9280ad4dea615dbc8801456db2f9c217b37070ecc88c7e51ab3bd7bc80c3e945d0fcbb52f0224eb38fc252be62e43af5a6b7b501fe50bdf0e447629b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 059c931b57aea4bdda8a7190b8814ac22001b15fae917d46da1fd552f74f19fd
MD5 901212208cfb6049bdca9fdd6b282fdb
SHA1 2e84f8ffe605f05ac2c1d223f8724b63ce7eff19
SHA512 8f15462f833f5336c1dd2eea18ab37dd72d16a2f39d1751a2b954b544d99f808385c8b0486c88a95c1b296fe806e6555261a15fbb7dcdd6dbeb093af050dd726
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 7f252df38fdbc09956ec5aeaf10423323a665adaf371c8a419e7902a88f07cd9
MD5 f18ce26b0ccaec7480a944842aa6f99a
SHA1 859ce406c5bf21b1a645c5d795d0615b77b03322
SHA512 60e0381c9bbb83073bace4e5134acb040b1c11e31c6debfbd07a1cb90af2fcb9467a5786b2ef773e4901c86cde9d0a16f55985763d022445eebfa89a294635b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB\qap`g`v~dtlq
Size 10B
SHA256 a66fef469a818e8c3ace3f818a5ce468393e671e0936d98bd583f37aedc4472c
MD5 96162e16b63714ffd67725329bf8030d
SHA1 77b7747a102276ed5a7b421f1ea07bcf87d73f37
SHA512 374e86d1f5e7613187b43c221d639dd3bb4f0a3105a6315eba54b70c8742adce42e034fb98813b6a53612d24b6d782c169537784697cf256031ecd18928ed5ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 4d6c174dae785551680c8ba0f5d83dda954558c50a30e60754216732901973a3
MD5 c8e003e634f4860f7899e0aad9681027
SHA1 8ea5ebae0c013f1ba15eb9fcbb7e1447a0d7bf9c
SHA512 7e8632fec59c46ba0f9817a42d1c837d00beac40d70f6b0755f9460033cdd2023471a7e475a3cfa090463bc0ddaaa1d02c0e4a532eddd1ab4eb7ab1eab304299
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e5dcf81a1851050c9d3f86fedec69ebfd116936740e1bbd290aa666bd54e934
MD5 f1425261f42583a69c191a8e040b2239
SHA1 1a4882bf429c55ab021818e92c520686edd4ffea
SHA512 e8415f7a2f0fed768539d507ffb9cf500b89f4ad17aaa32b0206d24246af6426f4418341ab4425fc3b49548bb624a8af97f624aea4e79acb02c909a5e0ddef6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a22d90bbbaee0ec7fe5e0e038553f30c09c3abe15e87deccd2993de4c448095
MD5 c14b59a45de74e297cb553bdb0abd361
SHA1 36805de2bae4caddc76c4b1c47dbeb4a5c24a9c4
SHA512 f32eda0c471231a17af58e0652c340131d9b1b111980df6de6281a3088ba8af9d1d6f7a2dcd381cbd69db46659a19761e911520cfc5f9dd409c33e77099361ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3054f4d3c5c280efcf7b032c793048aadbcaff538b68fbba24675b5076e6a834
MD5 2d1582afb7a77b87fc5cc60ba09d958b
SHA1 f607d8c3e7c1e09f98cbc0e95394a70b6a8e841a
SHA512 82e0a6e4589dc228bf0031197050a5053bbb16b187a6495e6bff02bb51165d21d7f6ad878e8259339edbb0ecaea4f6e6cb73422c2a340977325d3727013b597c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 55e4e0701f3915326eccf5fbbfb308f1cec78ad174c4f5024ae14215bff24279
MD5 5dd905c8fb4761c0bc091f606c98bb2d
SHA1 1f60880935b2ab525e578224c40efe458d7eb361
SHA512 8db929130154f617ea6abfb1c322edcc6196781d6c727e547536a442e1ddcaba8de5eed83bc5be35d16205ac3a1ed9fbd8d39065f7235ae4ddc7a61a05ad592c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b362f24c0fe458db4920b05af69a1eaa0bb9d5a2ac2685685a7d5468cd76bcdb
MD5 53310c8aacc4f6c8151842df6f93f8d5
SHA1 d692c0ce5291f4bfcdc4c9a491717a8cc8452530
SHA512 841dcdc1ac76dcd0850129d1746e308ed6faa40058a00165ab7aeaa50739a37a663905123d7208068a8ce145b678bac7d25088bba9fab15714d1ed0113a0d5c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02b0bbb52f9cebfeeb0fdeb06713ce06cf4e179a4f1c4ee469d4e6026ba22c03
MD5 296d7c071f51082a51a8a791f59822f3
SHA1 c6234ca661f1ff31ae9a7fc51e98d8f2e52eb8ec
SHA512 004cdc77e49ce4b3c47dcb771a079451f18c2cb3550db5c880f4b76c5de66864e1670c784b5cdbac61454373759d119beb125ebbc7310b22e3ca9622154629f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e554995505d72feace66c2d8bb7332f2c4bcce6a87b94ed3b7d9b0b216de32b5
MD5 e26dfc4c293e0696455d0af5f8147aa6
SHA1 cda9f3e3e180225085ed36613a0f732ffc316deb
SHA512 99a92fe55cc5bc4325fe743392988f8f62c3a30501af7ff821a6330b211baaf9cb35c9375118859e75423a6143e6f689de6cc9e84911741d9b24afd9b4062ffe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 210ac350e6ec0b3c334a829a272a139203e9448c38f210ef202fa56716bebbf1
MD5 8fed14f29b6dd1c5f26f4709dc50edc8
SHA1 a9a58dc040c6ffb4c20d1e9d50ae58ab3be68f12
SHA512 c6a30edd8bb54e4dc45aefffb45634ce1b882527ffc81590d9b614274c13d3acb7d700dcf132bf84226fc6437902ea5b346b465d38a56cf31e73475a81773662
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 885d30aa0fe323f29ace61f6a5fa031be0e42da3a0d9f202543029769630e792
MD5 083c8052437b00cc92807e4747e977a9
SHA1 1e1b540346d25b3e4d106846f6d34fd3390b0b4f
SHA512 2b546b6ac1787cb477d70f2af96c9f52a5751e0e63f2361548f837afdb1f71c105fb9cebaff1b60febe592ebb30b3a8fae72b81c3b55fafd084018ba323eb3bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 03ef55390b6122d617472aa57c597d440bae4d643edc89cd07d571df031cc8aa
MD5 fe8e6039400c2459f9505b9cf853616f
SHA1 c6d510da5b31260c777ab532d5af3e4056895b2c
SHA512 bfa199daca6be62d321b1208062fef39878b64156d63dde3ad756a957673dd5b8df8bd3f0179b775d17725acbc87ae72787316f8e4f4959fc88400caf0d08945
MD5 SHA1 SHA512

Submit Download

svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCAABBBCBCCACCACCACBCBBABBCBBBCABBABBCCABCBACABBAAB.exe
Size 28.6MB
SHA256 c1c583175cda4e16955d2278706a2f0e44763a9cd731253e15364996a78450b8
MD5 5b91e592d0e7c50422a0a70b5fca68b2
SHA1 7ca4882ad2da45fdb9ebe4e358ec85c4587fd58f
SHA512 98fcb0e2c68c625959f5a8e819f30150b8b9bcd0f81caa0066b23f50135361c6151c5bd2ca37f208ac714a324f80e99c77aeb63365086946fe3664eadc90e582
SSDEEP 98304:fLLLLLLyKjKWQckVgtev5mnlNLnLLLLLLyKjKWQckVgtev5mnlNLn+4j7:PKWQc0gEYnvL3KWQc0gEYnvLfj7
TLSH
T192677E09F98740B1D92B50B04DDFD2BF8970BA2187118DEBF78DCA2BA923F906538755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a9f519a2cd2d355fbc6e7c222e7395b862958fb95528a0e510e5ba281fc774b1
MD5 107ea6aa5a198fc932080427796e2ef0
SHA1 455a86c69bdf3bb17be6971521701bf317497bc9
SHA512 3b41188ef55c646ba5abf7b1049554bb50882e59c8cdc45f56011111ebfd332a8dd0569d88cd78d43df6bbbd9bbedd8a0af7514f0289a3a3a6b333dda2353d3a
TLSH
T1B221C541F0E78C63F43168C3AB1DABC74CA93B8BED5CBB581309411DBB55C368E25492
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0554b74c531fdc5e3afbf07a6720d0a73d397b5c3138fcd630195015928c9f40
MD5 144f379ef0da3cf18fa502dbe49cf09e
SHA1 3811090e533c5133e3593f26f83df81645f5ee9c
SHA512 62d25ded7f539e7483b5087d8829be0e4395d77f048fd6d8335016356eaa1e98ba2529407962cbe8da19fa71837c6093df23e71727a8f5fa3d47b5041118d245
TLSH
T1E421D251F0978C63F431A8C7AB1DABC70CA93B9FDC9CBA4813098118BB55C368E298D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 00987e683d490a380572a6dd6d37b5b1cd06a68992d0e24b2384ceeb0d4978f6
MD5 20d1194aedab55f40d3786bea7b96330
SHA1 d5b0d11eec51648f064d0d85d7bcd7f390653f19
SHA512 c195271284fd0b0f6d35f6cc5a9dbc92c67ec998769692b801e1aaa4dca15615dea60da7b85cb4e7430f9a9673d02d0f4165c17e0330ca7de5ab2d81b2689c92
TLSH
T13D11C441F0E79863F43168C39B1DABC74CA93B8FAD5CBB582309461DBB15C368E25892
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-108-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/692-48-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/692-10-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/692-70-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/692-21-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4180-95-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4608-110-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5396-47-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5396-104-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5396-69-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download