e71cd3e2d3b90d89a39ddd198a5b43a9bbecfcd26570b34a3a08e2cfb15831c3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 18.9MB
Sample260910-c72rxawzex
SHA256 e71cd3e2d3b90d89a39ddd198a5b43a9bbecfcd26570b34a3a08e2cfb15831c3
MD5 cb1c2d9e901a88c4fc4b221c435b5027
SHA1 7b1b20e29c55ae6c5e062631ad42de7e0f6816f2
SHA512 1f620335bc29e8dec7b00089442a4bc14d9208fddebfd9d89b6d91c674d78644448eabf1961b8f49d98ed20ea93a8cbc480636cfa1a492cd1daf0650234274f8
SSDEEP 393216:k58585P58585P58585P58585P58585P58585P58585P58585acZEIv6:k58585P58585P58585P58585P58585Pk
TLSH
T12A175C1CB7D71091D97795B48896C2F69D31793047208BEFA684E63EAE23AD0F83DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
2004	svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe
4508	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBBBCBBBAABCCCACCACACBACBCABCCCCCBCBBBCACCCCCBCBBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe"	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBCACABACBCBAACBACBAABBBABBBBBBCBAABAACCAABBABBBABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe"	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4836	sc.exe
3152	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3308	cmd.exe
4632	cmd.exe
1336	cmd.exe
616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3300	schtasks.exe
3080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
4508	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
4508	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
2004	svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe
2004	svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
Token: SeDebugPrivilege	4508	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
Token: SeDebugPrivilege	2004	svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 616	5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	94
PID 616 wrote to memory of 3300	616	cmd.exe	96
PID 3544 wrote to memory of 852	3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe	98
PID 5068 wrote to memory of 3308	5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	102
PID 3308 wrote to memory of 4836	3308	cmd.exe	104
PID 5068 wrote to memory of 4632	5068	2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	105
PID 4632 wrote to memory of 3152	4632	cmd.exe	107
PID 3544 wrote to memory of 1336	3544	svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe	110
PID 1336 wrote to memory of 3080	1336	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_cb1c2d9e901a88c4fc4b221c435b5027_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACCCCBCBCCCAAAACCBCBBBBACABCAAACACACACACACCBBABCBCAACACACBACBACABACBABCCBAACBBACABCCCBBCABCCACABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABACCCCBCBCCCAAAACCBCBBBBACABCAAACACACACACACCBBABCBCAACACACBACBACABACBABCCBAACBBACABCCCBBCABCCACABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe" start= auto displayName= "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe" start= auto displayName= "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBACBAABAABABCCBBACBABAAABBABCACABCAAACABCCACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCBACBAABAACABACABCBCABACCCBBCACCAABBCABBAACBAACBABCBCAACABABBABAACBBCCAACCABBBACBBAAABABACBACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCBACBAABAACABACABCBCABACCCBBCACCAABBCABBAACBAACBABCBCAACABABBABAACBBCCAACCABBBACBBAAABABACBACCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCABBBACCABCCAABACCBCABCBCABCBBBBAABACABBACABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9001186c8112155c17b66b597a48a2224fa972677313fc5511ab41ad8fff89b6
MD5 af13887f2fec2078514f453dd3f1f3d5
SHA1 240846fd27e88237d961cde30f88ef0559012652
SHA512 f721d0cd1b458a0a6b99ee9d96342e6c53c5e9e548f7bf1446978e611afddc4c6212354589c7e8b25cc3a1632eea139dcf4c97ed38a4172af50894e58bf5c62e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 7ba1ac85c25f1ce2af03dc2c9a4ca2cc942f76972a20d27d724591c158c1509a
MD5 7c038fabf8daea548661f52f8a57e763
SHA1 b847e0e498c7c5c2c2e666f67b248f9235fd82ae
SHA512 50067b7276496870c36dd1ca52c65bca0d650f99be8e744e1e525e96d0d0ca7ffceda70c7ec8763ee37e46d405d40af97afc44822dd9fa2f2a2087818dba56e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{3A96B93E-763F-41E7-85C7-1F3CCC37EF27}v48.108.8828\qap`g`v~dtlq
Size 10B
SHA256 a12ef868f234bc4bd2f809ff4c43f5cadbca2feffc9f3a8c392b4299cab18b3d
MD5 f0c916bf43ed301f1f43d8953e5ebf71
SHA1 0f9794ac34ef0b35ed5b3d7b3ec83d2079664b53
SHA512 8f4edb1a76f38a1abc912368e5ac0a2313af8be3d9edf5017abee7a15e06915a37fe548bd684c0b9cbd5980c0eba03195e338144ae7563797147aa132d7acf7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 2941c47f9f722cdb680934a320b92182a39dca505f6985da3207550967f2d8e6
MD5 906827e9956f5dc19acc4da436db3e56
SHA1 d32ea0bfc170e431effe8cbed03412f8bb79f60b
SHA512 9bd5c42c822b8c2df3a5770393ff439d6e6e6765630389426a055d3d33aa321689b3d0a2b68aed9dace9ff0b433cb7a80431ae6576a93d54a8ffa774cfcc6245
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 096df65a43de10e488b8bf7617298cdea2a80e5db0a89a7007832d81ac6d3baf
MD5 b5f9c51dbcf5a0425c0af54b21ed5a09
SHA1 225318d146347e8a93e3eeae1cb9b3ffe4e58004
SHA512 4c047f5af17315e6bdce498218ff630242977c2fbbb36b5fab5f4ca758d443ea47b635ebfdfa66d210f496b8c258e7bce2d5f86c4d3460e4ee8c387445e314c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 3162238e7387aea6f35e8e66f72cb0b1cc8d9176b1063d89885c33f956dc6fcf
MD5 d8e65862f70421f3b7a74b5c7e3017e2
SHA1 e8207792dcfcd2879fed74b48ade7554bd12efc8
SHA512 c6e55d219f1eff7249943c1efb16e251a7589b7ea35047d57e30ae33b459ef187c7e1b2437f005b37a9bf0c001a4fc384cc3a680d7c08cc8a615599f9dfe0c69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pl\qap`g`v~dtlq
Size 10B
SHA256 1e3e560dfd3978b942712c6b29106812daf566a5b4f5fe4fe80e33c65cea80b6
MD5 ca484879b89a0fcbbc92de002c91f3af
SHA1 b6b97c3adb6b8cb89ec3727b64193d73f4ec32be
SHA512 b70cf3e479ef784a665abab721e7a75778696ab51851a41755dd7e473307a92c025b07449d935d137449ff715bf3548cf2b423dc8c3dad9bf10217249a8d3eaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 3d4fd764c412c8e0ee88475d9c020f60e9e7bbb93d6dc815aaaff6bb83edb604
MD5 97a3d3d1a7d50d8557e8e8d293253e51
SHA1 6a3b246c61e8aca3242cb2a04e88ec5c0c768da4
SHA512 e0be0de987b4b8c8648db75ededf8915a8752d4683bace95d77f29e464d02f49de06ad3ce994e0b321d9e0b0639b6564eba7f2295e5cfa4d756bb1582eaeb052
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 7eb880f29926011a8560e1181fe9350ed5e1974b0967c5f26a0def35a004d051
MD5 82447b0c4386c43f3a10f5424c5f1cdf
SHA1 e3617a217ae995a1768d516bf2e377f3b11bb976
SHA512 a5d721e17f4f78fefd8820832419aa99cbca229c43bcf97fa7b9249520dad7bd212ca363f95a1ada7fe28d1e07d7aaf3123bb6a1e465481809b493a29e44f37c
MD5 SHA1 SHA512

Submit Download

UnlockRevoke.exe

Path C:\Users\Admin\Desktop\UnlockRevoke.exe
Size 56.8MB
SHA256 8f39c8e8981bdf1c5a4dc24455df49a0895dabc7dff2adc4c5db27c33c71495c
MD5 521d8f17f3e7c2bbf938c8ba6fe70cda
SHA1 f1ce8ac5b49a61a20111d0edbeb049d0c49aabe2
SHA512 e53bfe934abcc447d3d1fa32492dbd2b23819250c09ec129a6a867c5249839c74f2982873f8754d0b3d2f4c63c65d6cc8fd3b72b802bdd39a551b0b12ef07f48
SSDEEP 786432:k58585P58585P58585P58585P58585P58585P58585P58585jEIvf58585P5858C:U77w
TLSH
T136D75C1CB7D71091D97795B48896C2F69D31793047208BEFA684E63EAE23AD0F83DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6be80f7ba332634f2030b99a8556c4c4033bcfa870fac42be8ec8a64465c9f66
MD5 54ddba8a7fb84afa43d46aa2f0a3fbeb
SHA1 fe2840f33c9de1e9bdae033c178677712f635c13
SHA512 d18d142896b29502f38282e9bacf4df77dd436d69606dce52dc4f29bee263e11db0492f80912e249f8433129a9dbcae6cb910a919941e73370e835a8fa87acea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 acdb23a1ec48e4a11bd4064d7d2191a9edf5a31b67029ddb061d367dc81f3737
MD5 30c44016c8797182168af56513a01ce5
SHA1 1725e5753617415635c0480f2a24a20aacdfb699
SHA512 40481c00897729156ea6ee03480ae137f1ef5ed90fe167955136ec23a19a30f50a65101e5737339107e291e7f5da561f4d06ace0097f1f235e4801cb148249d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84c0d0a8fb4d57d44781af1cc7449e3a7909ce01bce6b9626a0e63610a6ef247
MD5 d65206f336bb86ac464de024f3807eed
SHA1 ad9a53179247eb7f9eb6450ba86a879a6a2b7486
SHA512 c1deb68b0f9159729d75abf120d39c2ccf2426fa7664f7fec26a2c865a6a7319e1a12c732a578a7bb40a188972125b930de891895f50386f3d31ebcd308c791c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d49d8dfb5ff38e0bf9ce77e80e1fe2e5cd4f34a2e46e044a1f532ed72ab2cc1
MD5 1539eaa8c0596abd0db6c8be5e770208
SHA1 1ebfbbc5692b227af112c08191d3a93dce6fc262
SHA512 354a5ab1ab88dc6f84193ec9423fe451ef3ca7301936a5cb532cda097ca6f16080112e5fbbaad1e91e7fdebbd8ab5246c06e8a94247301fbcdfa6cbffc37d85c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4464e476fdd65b72760c8140c6814b0becf567134da6920cbd2982b3397bcc7
MD5 6d6b617a2a0797aa442117db9d6aeaf9
SHA1 b8c64765a1553f4d71ab84bd4cfc2607fe2e337c
SHA512 c458d5d8e5b3f9572370b568fd66ad79b1ffa3b69dda44788a8a8f27a26695159d3aa16f7cbd44022935b3acaf4b23bd67e114eb765b5b1801a87f141fab72a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fac6bb656ea5e320ac83307f36fd34cc2099f248de7531442984a831713379ca
MD5 fbd6a127edb5e3bed0a36276711acc92
SHA1 77e7365ca11ddb62c84ec0fe41721c30633212f0
SHA512 26a84aee7d436e0da50fa9f7e136ef99f482c8cf90b9bd40454b172d8431c6527197729a605984048fbf3982fbc1349aff8cdb2e07d621121c43eeb1a2db2e31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 e3755c8bd26a70b92deb12c0e9aa32ccfa623ee6a55f50453ca8c5ad8a737b7c
MD5 293d7ba23edb6d63ff228eeb46dcd8cd
SHA1 1501c0ce983955e09d9f18814470c05cc31e739d
SHA512 534510134c9db9d093cbff2012dd1ca1af00909276ffee37662e9ba6b24565aa93608c84a36605e4ff5c82d0206e79af48ad1cbafdb9bbc7ef4d596303ac32d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 208158fdce4ce47fe55acae9533723da7072bdcdfec41f4d6a2cb3505e50188b
MD5 8887f12f89c6c5c8301c9804fff682af
SHA1 f90343b3d63c12b70fa1c189340349dc6dba2187
SHA512 c83287ecfe4857ff44b08c16cf1c5066282c8782e8ff10438d9d53ba410c9a3f914b6e8c3130dce3333078228da7a1846076360df8d4fc4f06f83d53085777a6
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBAACAABABBCBBCCCBBBACAAABCACACBBBCBBCCCCBCBCBCAABBC.exe
Size 18.9MB
SHA256 e71cd3e2d3b90d89a39ddd198a5b43a9bbecfcd26570b34a3a08e2cfb15831c3
MD5 cb1c2d9e901a88c4fc4b221c435b5027
SHA1 7b1b20e29c55ae6c5e062631ad42de7e0f6816f2
SHA512 1f620335bc29e8dec7b00089442a4bc14d9208fddebfd9d89b6d91c674d78644448eabf1961b8f49d98ed20ea93a8cbc480636cfa1a492cd1daf0650234274f8
SSDEEP 393216:k58585P58585P58585P58585P58585P58585P58585P58585acZEIv6:k58585P58585P58585P58585P58585Pk
TLSH
T12A175C1CB7D71091D97795B48896C2F69D31793047208BEFA684E63EAE23AD0F83DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c7b2eb3a162e43d525c9ff9a9ca9afc8c4de31284525ccfd6340a108d3a5836c
MD5 df214c440289cd279580e036ba2a3ead
SHA1 7b756ed8c2af993e1443614748f9dcecd9ccfb22
SHA512 f7decb3510e1f664aab2f4ad836f10b3c3ecd99d04df7058585ca1ed699c22a0983290057c9a218e168cc0638a80fd0bde9d82bb9193707f0f7902e3d322780e
TLSH
T11E21B560F075D857F122A4C7AB25CBE608E837BBAC9C9F0422084218FF99C36CD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e66c4218bfaa50fe4d894c85081f093ac5b846c56744446b347a27b9388efd4a
MD5 700df1fa3f5e889e463888ab86fae8a7
SHA1 ea3ed754a0713806b6716a36101b1fc2616ab079
SHA512 f0fb51096447d7a67991469e04b99d509ede82d8494883a9377f7883019b94a663402a6f03690d72a7ef1b18deafd4020c27cd6d374fafa747a392b109572b06
TLSH
T14A21D260F1B5D817F132A4D7AB25CBE608E837BB7C98AF1423084118FF49C26CE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8879c6b01d7fc705b73b60da75b8670cf1f3557e07e29bd286ad284f78f7e02d
MD5 e44bad0a60c829fe4d866873c419b784
SHA1 dd89e4d80335d3d128c9bd061c3524160429684f
SHA512 e2ff3a0404111424f8b39a72aeffb63d9109f6908a066186c0f6c83af145124fd3fa95030562c48497cbdb97e95f870c4fa1317b3dbaa95f7ad1f6b1a09cfbfb
TLSH
T14111A061B1B5D857F132A4D7AB25CBE618E837BB6C98AF1423084118FF49C36CE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-80-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/2004-2384-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/3544-88-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3544-69-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3544-47-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4508-1066-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/5068-2-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5068-107-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5068-70-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5068-48-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5068-22-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/5068-11-0x00000000004E0000-0x0000000000501000-memory.dmp

Download