f1fced8882a90bb92b8b30808bdc73821cc02d93fe74b21b8c933f421884b5ea

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 12.4MB
Sample260910-b64z7stckf
SHA256 f1fced8882a90bb92b8b30808bdc73821cc02d93fe74b21b8c933f421884b5ea
MD5 f0d621bbfdfe2aa28e6f19d566e26cae
SHA1 1d4736cee8dfbf2bb09cb4d173c56ebb53678da3
SHA512 88695f204a0259727302649d29cad97fe0c22ccd0b67b7bad6d79c053c9cc31f4ce950a849a98b599a09a66385658d852311de8ebe7e268f35944764a7f9da1a
SSDEEP 49152:U+ES+EST+ES+ES5C+ES+EST+ES+ES5rhOo+ES+EST+ES+ES5C+ES+EST+ES+ES57:Bkkkkkkkk6KjKWQckVgtev5mnlNLc
TLSH
T17BD66D09F98740B1D83B51B04DDBD2BF8970BA2187218DEBE78DC62BA933BD16438755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
392	svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe
1416	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACACAABCBCBACACAABCACCCCBCABAAACCABCACBACCBCCBCABBCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe"	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCACABCBCBCCBACABBCAABBABACBCBAABBCCACBACCABCBCBBCBCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe"	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
432	sc.exe
1712	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2884	cmd.exe
2820	cmd.exe
2188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
1416	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
1416	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
Token: SeDebugPrivilege	1416	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2228	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2884	2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	97
PID 2884 wrote to memory of 1900	2884	cmd.exe	99
PID 3112 wrote to memory of 4960	3112	svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe	100
PID 4960 wrote to memory of 2084	4960	notepad.exe	101
PID 2280 wrote to memory of 2820	2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	105
PID 2820 wrote to memory of 432	2820	cmd.exe	107
PID 2280 wrote to memory of 2188	2280	2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	108
PID 2188 wrote to memory of 1712	2188	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f0d621bbfdfe2aa28e6f19d566e26cae_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCAABACABAAAACACCAAAABACACBABBABBBBBCACBBBAAACBCBCBACACACCBCACBBBBCAAABBCCACCAAABBAACCACACCACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCBCAABACABAAAACACCAAAABACACBABBABBBBBCACBBBAAACBCBCBACACACCBCACBBBBCAAABBCCACCAAABBAACCACACCACCBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe" start= auto displayName= "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe" start= auto displayName= "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCBCBCACABACACABACBBBBCAACBACBAAABBCCCCAAABCBABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9f37c85b18e8893ba9d2c85773aedc584f38feda1da1c49a475e6fe9616fb2cc
MD5 5ec2d8bfa628e0e259b2db432a11c262
SHA1 de994ea8cb3614354f1aa4a340a15615c6b771f2
SHA512 800291eb1c013a86a6502dd05cdb05786bd796fce2b4562496b9865d789982e40375caf8893eebd65b8063827a33032bb43d199e7948cfef5749544c0a4c502c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\it-IT\qap`g`v~dtlq
Size 10B
SHA256 7d072aa8f8d53b0dc29e4cefc33e4bfc2c1be1e0b12ee4ff2cd873ddd1406b51
MD5 ba342a5fc89597bbde797e76950b9d92
SHA1 421bce0663499ee04cc1a43488364ef71e84607f
SHA512 e2142fdac8d18a309283f5f78f92da94768f1a4daa340034e64681c222b1ee9e529003846b7b67e04e53dc11d57c0210832281358c3d36364fc1d162a06183a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 f475077152731b5b940dcd26ec18a250e5a9d6cd14fb8f0908cbba9be9da9f96
MD5 ecbce526e12e914023b211c3c88ee753
SHA1 80766881b25f519bc4c5d64cb15870b7cccefda2
SHA512 b660a2ae25cad145936e035f9c5ed1dedca5d2a3c4284e6445586c739547e01f86a56d2dfab348044b41696ea19550e7d5eb234895dc1d341738132437cff3bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 7b314a05e93582ab8ab112c3e063976d65cc6bd3bab5d4305ee7a30592bab494
MD5 19c2bad167f2ed0e2c9208f0c22d44d3
SHA1 63ad9232454f485eab1de5a4efeeb8d904c9d1fc
SHA512 4b42df8a7602452cc8b98dc333544e36502b4f33565c68bfedafc9d5878a156b8a4032ef3c35f6079629202699ed46fc10a37c51e97c6b3bae75073b5b80e008
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7abea10731dd1d15b1e90f795f10bac105a0b9e3114708f863cec632ad9aa464
MD5 fd200f739813e33bf2e1802de099537c
SHA1 5da3ae2080ee933506b3a7842b923670dbbea802
SHA512 7e1623b83384ad1f335f7f64ca16f7ac75cf31cb753eaaba06c4e64a73c94e94d1627b5583cbbee37a5980c29a335fb5ccc21ec708fd2b85af6a64639ec0c134
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2c3b9585f6b3990e13cf50220778dd55981087e2798779b2fb821ff5a2149ec
MD5 cf9af02f1a9bec2836a089e75b070809
SHA1 c84a2b9b1484826e884320f2ea08b073378fff4b
SHA512 6e0971263f6b34c04cb5740c87ec73b5dab35a487f3add30eb74a181ffb63fb1132ce19d694405bf2ff1608f3e02a6bc4afc807e390963a6fe09fbffbb5b4375
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e76f2da54737e906703c85ec25c7f9639ba848599c5ab65e300a403c186e031
MD5 6ccd2c0b830433a456faea61b1af7dfd
SHA1 24add403735b83296ec6765d8bad8d5bb0018000
SHA512 fadd4acaa85f46b254c364ae8bd562f21470f56656fa2ae4d9d55c8cd58505c4c87a73d5085c43caa955ec583d3a1723f2589d1e8beb7f0c1b8616c022c31f17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b99dd92e90a7089ae9e8eb94be4d29feec8a736e29af63edd55c15a478639a48
MD5 3b5e1812ebb7992d3aa1c5090c86fa28
SHA1 e234c21ba606e33219452d7e0e2524917a4fe028
SHA512 076a997dc0911578ff0963197bc87044e4f3360cc0d02d1a62c1b6ee31fc5231652896c749cedea5dd2fd114c1999f12ad8a1dd19541672eeec65df295d3e4a5
MD5 SHA1 SHA512

Submit Download

ReceiveDismount.exe

Path C:\Users\Admin\Downloads\ReceiveDismount.exe
Size 25.1MB
SHA256 2cae17da3358c8478c426191ec09568e9827a77dcc8b571e381e7239495448aa
MD5 21827ed20e87610c00b62dbe1a44afb4
SHA1 766db8c75ada9235e7f522bc5a5ef3f3775191d9
SHA512 14380c1094d9e12dab610d3729ea29627d725ac89d93c57a098a49527fa21cc07b51f32fab2a89ff3ed219cf095e9480debe6e98ae22176891776f6754c26336
SSDEEP 98304:Bkkkkkkkk6KjKWQckVgtev5mnlNLmkkkkkkkk6KjKWQckVgtev5mnlNLxz/o5:VKWQc0gEYnvLoKWQc0gEYnvLxzg5
TLSH
T1C3476D09F98740B1D83B51B04DDBD2BF8970BA2187218DEBE78DC62BA933BD16438755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveDismount.exe

Path C:\Users\Admin\Downloads\ReceiveDismount.exe
Size 62.3MB
SHA256 3e8e73b008fff284b060601238c4e5f230174d72d3286362a5f61a11d0af4df1
MD5 cd64d2e80cfca6ce50e4d35973d9cc68
SHA1 d358610cf0d295d1559fa3e2cf073e365a317ac5
SHA512 567ae0ec3fb403c297cf040fde1a11a35d539631b86cdceef784e784ece41b36e302627f09f1f1efb5a0575103ae3636f189bca1c194608b3718ce75cac31666
SSDEEP 196608:VKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLxzg+:EcZEIvNcZEIvNcZEIvNcZEIvNcZEIvH
TLSH
T199E76D09F98740B1D83B51B04DDBD2BF8970BA2187218DEBE78DC62BA933BD16438755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchPublish.exe

Path C:\Users\Admin\Downloads\WatchPublish.exe
Size 62.3MB
SHA256 35e462c24c7590245eb4477bc8ad829f9dc17fb271b0471aba25dc2561a7451c
MD5 a8b71dae6b0f7a8ba081d189bb34dd1d
SHA1 2d4a65bcce896d5577dad29371df3869d49a6990
SHA512 ce31c4ff559d5be2a2d8db3015e57113c0fb2ec012fbab7d5780df97c76396c2ca9f44aedf45748ca94930d3b6d9f4073abe0344c434ee799ce1e0410ec21656
SSDEEP 196608:VKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLoKWQc0gEYnvLEf:EcZEIvNcZEIvNcZEIvNcZEIvNcZEIvM
TLSH
T14EE76D09F98740B1D83B51B04DDBD2BF8970BA2187218DEBE78DC62BA933BD16438755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0145794e37b2d932f61082d9c1e3afd7475535e319c7726860a9f5583838ef3d
MD5 02b9b1c6c83267832c60d5d514d2027a
SHA1 883f0c15bb6ea7598cb599334122b7a1414774e7
SHA512 cd3eccac9d41321c165578ec92ce399f8c1f00e2f6f102c5dbb51526b162f597fa67371342e248d22a7fa15770eedc9cdb4393805a1356db2554258ac7bb2dc1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5d4db6c25baccd1a3482bc38198a844724d74f34861750515e9ef4acb55964f
MD5 62e2ae11566cce59cf87a43fc0eba4da
SHA1 eb49c3bf1643adab6bdd9586dee5a3d928bd2195
SHA512 90ebe685a4dc69bdba98378bb2c436508efa31dfa12db340ab1807c8e7e58282f4ce0612fa46f5b682d9434d648450b6558c742fcd5824e7bc5c66f6cda7fa18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 ca0d60479f6f577c246f0e501b38ed474963b76e464aefd64e328e7dcfd1fbd2
MD5 da83f31a52517503a975cddecfc9f8bc
SHA1 4fa0e57394d9c5e21a70f72454e871aa4db875d8
SHA512 35e05a766ab4821524feb642c38b20487dc48b2eb53fde6b35869edb2546ee2a464e8a6ed6f55cb09edb17b14653ca382434fa7058bfa0b0d6b358ff107f7e6c
MD5 SHA1 SHA512

Submit Download

svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACABBCCBBABBACAABBBBACCABAAABACACBACCAAABCBABBCAACBC.exe
Size 11.5MB
SHA256 61744d12b84ceacbf68614725fd34502f5325fa82131ba35bb134fc805872183
MD5 8302fdadb9439adeca257db7cc438854
SHA1 e56d74d338681cfd80ef792b9becc59020145d7b
SHA512 337a7c69571d2458c19a3aa9f4f9dd4d98b5a461d77d27e7af6cbf275bfb129b95acd9fb804ace347895b618b3919bf36b99e454df91efca7dbc3db78738fb40
SSDEEP 49152:U+ES+EST+ES+ES5C+ES+EST+ES+ES5rhOo+ES+EST+ES+ES5C+ES+EST+ES+ES5g:Bkkkkkkkk6KjKWQckVS
TLSH
T19AC65D09F98740B1D83B51B04DDBD2BF8970BA2187228DEBE78DC62BA933BD16434755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBAAABBABABCABAABBCCBCBCAAACACCBBBBBCACACBCBACCACBC.exe
Size 12.4MB
SHA256 f1fced8882a90bb92b8b30808bdc73821cc02d93fe74b21b8c933f421884b5ea
MD5 f0d621bbfdfe2aa28e6f19d566e26cae
SHA1 1d4736cee8dfbf2bb09cb4d173c56ebb53678da3
SHA512 88695f204a0259727302649d29cad97fe0c22ccd0b67b7bad6d79c053c9cc31f4ce950a849a98b599a09a66385658d852311de8ebe7e268f35944764a7f9da1a
SSDEEP 49152:U+ES+EST+ES+ES5C+ES+EST+ES+ES5rhOo+ES+EST+ES+ES5C+ES+EST+ES+ES57:Bkkkkkkkk6KjKWQckVgtev5mnlNLc
TLSH
T17BD66D09F98740B1D83B51B04DDBD2BF8970BA2187218DEBE78DC62BA933BD16438755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 81a08887173fa35dd778de2cf94350685768adf82bc980b9419c3dd0e537cd82
MD5 1388609c597d71be4c6dbd18588b1bc6
SHA1 8275df6c40e7cc5b2ac6e61aae99096e2079c43f
SHA512 557a0d59353423a675e035094c395872a7d8950d1e73061a75495aa7f23a84df41f0be82698b2fcf64a73feb86fc49a4e69060633859ac47bab440823885ac6e
TLSH
T14011C451B0A5DC57F132B4CB96158B865CE836EB389CAB05630D811CFF99C34CE294D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/392-108-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1416-1434-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2280-31-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2280-0-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2280-67-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2280-95-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2280-15-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/3112-114-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/3112-57-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/3112-84-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/4960-96-0x0000000002D60000-0x0000000002D61000-memory.dmp

Download