f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Size 16.7MB
Sample260910-df2hhadp81
SHA256 f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0
MD5 c14b85175373d055b2e2bd0399802f29
SHA1 14336f28ad9d7e1d25d5ffd5ad5f40dbda2b8d6e
SHA512 f2827821dc0304756ffb7e8f774b67424db5c3f5107b59aeb1035f7d28eac3817533af811fab38c26d028346b21a1444e803272b429d603bcb520c074f346484
SSDEEP 393216:FO4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4H:Uhasshasshasshasshasshasshasshay
TLSH
T14207193CADE841A6D472C671C9A2A5DDEA31B8127B005ECF21D2534E4D3BBD26D70E39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
1036	svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe
556	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACBBCBAABCBAACACBBACCCCCACABABABAABBAABBAACCAACCBBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe"	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACCBBBAABABCCCACCABABCBBBBAAAABCBCAACCBBBCBCCBBCAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe"	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3016	sc.exe
1472	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2520	cmd.exe
1300	cmd.exe
4892	cmd.exe
2980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2512	schtasks.exe
4676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
556	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
556	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
1036	svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe
1036	svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Token: SeDebugPrivilege	4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
Token: SeDebugPrivilege	556	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
Token: SeDebugPrivilege	1036	svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2520	1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	92
PID 2520 wrote to memory of 2512	2520	cmd.exe	94
PID 4528 wrote to memory of 4316	4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe	95
PID 1116 wrote to memory of 1300	1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	98
PID 1300 wrote to memory of 3016	1300	cmd.exe	100
PID 1116 wrote to memory of 4892	1116	2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe	101
PID 4892 wrote to memory of 1472	4892	cmd.exe	103
PID 4528 wrote to memory of 2980	4528	svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe	106
PID 2980 wrote to memory of 4676	2980	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c14b85175373d055b2e2bd0399802f29_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCCCAAABBAACBCBCBCAABACAACAAACCBBCBBAAAACBABCAAACCCBBCCCCAABAABAABBACAAAACBCBACBACCABCCAABABCBABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCCCAAABBAACBCBCBCAABACAACAAACCBBCBBAAAACBABCAAACCCBBCCCCAABAABAABBACAAAACBCBACBACCABCCAABABCBABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe" start= auto displayName= "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe" start= auto displayName= "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCAAABCABACACBCBCCCAABAAACBBBCBCACBBBBACCABAACCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABCBBAACCBCCACBCAABBBCACBBBBCBABBBBBBCACBCCABABBBBCAABBBBCCBCAABBAAACBBBBACCCACCCBBAABACACAACAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCABCBBAACCBCCACBCAABBBCACBBBBCBABBBBBBCACBCCABABBBBCAABBBBCCBCAABBAAACBBBBACCCACCCBBAABACACAACAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCCCBCACABBACBCCBBACABACBCCBBBCABCACCAAAABACBCBBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 882563d07ee9d7108891c510a7c4344e299c586bdfbbf2ff6a4dea281a7431b6
MD5 42868aae48ebbf8cff6b95313db44312
SHA1 bee589ca0914d53e5ce46622b15e2d2ef592bb29
SHA512 383a6f22ac95cb361cb82eac47d9171de273d71111cd227c11757841283a992748a48ac499cdf9ae9290bdef6faa9c5f4f80e8628c02c0c4bb10aa5a306a6a59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 ab4e67183b8a363f4c02ff56583af4a580c2f28f1d640aea9bba4a217681a50e
MD5 1e936ba6fbd22e2f9518cb17878a46ed
SHA1 2335e69e3a193f4b654ccbe2252933dcfd4de85c
SHA512 920a386a8a09dba3c6cb824c962f1e3ae55da6a32ac335a0b49e21aef3b4fa73d9c82f3177a1410c12edb99b4f12c2bf962dfa59af9dce4c9b36a44534c1898b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 993ca247ccaf6bd4d2db51b57d796cba6d9b753bd8bfb76b2abd2cc6c1c2b832
MD5 74b7a7719b70926fa1baff94c381107e
SHA1 be978d6d40e75b7d6d0cbd224f28755f3df1a822
SHA512 2242f60de3d1d78c2f984dc12ffb7dc2760076a034ae86fc0647d59747ef4503201be4e309ebe179521a59afb6e9e7f25fd68cc8ef6b84dcc5e1b8af03f0b18f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 e1c1a83907aaf4151dfe5a9fd9f1ea077ddae87c72b1004fbce448d2fa8cecc1
MD5 65e5db452747b00a6e2e912754f934e1
SHA1 59d1f120da22b325fd32d8aa4ecc887d33e19e3b
SHA512 bfdf842a3fa7f8d7b89b4492a22aa36ccbcc611fc8e383645f68a9c8aa2eedb531d303bfe0aff82921fcfd4900a5560138ac8aa6fd0ad195e8ede6c8269a6cdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 99da93fb0b527ea7b87c3d227dca6c11ba60fd3ee5164dc2c491bb7fc3c05f1c
MD5 420eea0a78fa4bd2fc4e43cb57d35e15
SHA1 23966bf94a7a37e9779c2beafec03df4a8510712
SHA512 1c0f40ce8d898806e506845051ca964ba15bf8cef6bfaf32189b408c21440827e31595281bec8e2708cf0dc06c6b41b60aad47266e734d97776a3374428e39f4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.3MB
SHA256 9db397aaacaf3d3f14cf9dd70ddf4d6fcc8015a13f5a4d340b76839c4e833562
MD5 17987e785cdf5f09cb0becb51919c939
SHA1 d8a45ccd57dddd32d0618cc3916e8b717e4ec184
SHA512 1d77ea91b00a0ddf80438e79b6e08df10d483ec16aa6c561f8f9e194691ffb12cb364707cdd553f252358a361332f16bf54cab807ff87de38b7c84ab4dca8c02
SSDEEP 393216:FO4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4G:UhasshasshasshasshasshasshasshaV
TLSH
T15907293CADE841A6D472C671C9A2A5DDEA31B8127B005ECF21D2534E0D3BBD26D71E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 c67507bcc680c02a8162d7c482f214af10fa2137ed6a91edbaf2d0c37c3e2c29
MD5 86a101029f3b198a51299fdcec754b8e
SHA1 895d3aabbea5949735e2165e8ca81c441c808888
SHA512 b54421e505a2fb87702265cc68ffe64c5b387f652b589312c9839b12cbbe819ddb382f38af79978067022abbd500a9116f3328eaae74ecaaceb76218bb228235
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 21532ea2f4e98cfb9be72eec45ce03a59110668dab79378bcc38007def50bcd3
MD5 4e36a7b0ee1ed2bb728fa3c9d9ecf9bf
SHA1 8b7de7df7a4d6f1eaa4a92496f568c59112ef87d
SHA512 5a4234cc35b3b5e77fa02c0e3b68b4a953df5cf562fd492bc4c395d67e16da7a2708d6280a17f4a227cd55b9d7ede187bcfa0bf2889aac5e1a8ea3265f8a80fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 5dd5209845b2451c822afe2e4efffa30152c9b9767022cc4b6e2640a6c2acc45
MD5 7041736c7796e770c1a3d505ea7fbd64
SHA1 53fc82a71b293f0c43c69760e0b0bd9ea84ea850
SHA512 4e83fa62e34e8de5d320ecdbfb92c611c712a72d96f6fffe9038fcf3530418d588f61d5c21612e4cd43c78a121d210cb94af1176029b7aab5d58a07f1c2b9403
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\qap`g`v~dtlq
Size 10B
SHA256 e5df703aace414b37319bd2de5b33d9f31318fe345c1c8405d73110c3143e192
MD5 3f5fb7a27db5cfd228bbda3605632b0f
SHA1 c497996e46127d70b4b232465ab5cbf2258d03ae
SHA512 c35963fdebdd958c0ad827a1c5760400146648dad5b0ebbef0a07d58bb22fcba6e904e193b05e9a554fc874a937e2a41683b6f58c05faf834a5fc37580360389
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 a68765d7b23fc6a80a843946e43c13d424414c2623ab44d151b7b2c5c73979bc
MD5 fd71a4140bdfe9dcdd12518df7f7882e
SHA1 efe745a3f2ca26481d744dbf8ad81fa2de41b730
SHA512 48d71cd2dcaac452db7d1e88b49f21e9566b12a1e65aed5b442896bf5d87a805832c2eb3717c83a747974878d94bd7d2694aec711496eee2932a64c01b2f2b52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\sq\qap`g`v~dtlq
Size 10B
SHA256 1d0bcac5dbf397470b86dd0f5a51461779794e7098f4f0b3e2c2d729ae967846
MD5 eaf56cba09af9983f6fda829dc3f1409
SHA1 f61de10742ba323458571dc4ad7a54f0ec34b35d
SHA512 d873350f0afc92c8161744710f6ba25d136d1de26cd262be91213b7a903d01f46a39b6f77a679d7d86f716d1415311753b374d1824089c4978cd2cd98ad3d473
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\qap`g`v~dtlq
Size 10B
SHA256 8054ae4b491f23687e747094e951c39f63a9d2798e7a63b69e75a898181e97ba
MD5 b5febcdf73284cb8cf1e2565bb25ae75
SHA1 3c8d161efcd787edd5f3b095d30cd5cabc1e2382
SHA512 1e3fa2ffc50f02c82ab7fea63dae1d30dc755298890fb02b212056831e5496293f11a8bf14b03d35e85c60855448e213109ee0e14db0440d0e530af00ce46421
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 c61a798e2e18ef1555ffc58540ec3efd453ae3dfa36f77d03dda4a90ba60ffa3
MD5 37d086217221680f5137568c8c02ff31
SHA1 6c90e37e24790489cafeaa75a74d87a88e06e440
SHA512 5f8e67470569e06c198688aa58f5cb32e6d8f8031969d740fd34a7a56166c33b862b4c72cbd7b2a3aa9e59e91b0cc3011e3904a005df774dc4179ed8e48d8493
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\qap`g`v~dtlq
Size 10B
SHA256 15995acbd428fe04ec99b36de1c35cbd4d24bbc86e7c3816e60cd9541dc5769c
MD5 4aa9cefb2379df94c5fffdfadd7069a2
SHA1 c1656a9006f399e928954e1b9a72f82ff11f634d
SHA512 6ac4f68b3677e6352a5a92c8fd4db47428f64ffd6b3d83023ebd9a05c484fed0e7afe4e622aed8799e851d5838cae87b2c51d01b4a817510c4b3939d83b42e2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73d014ae70b539850c2c1c8327eeb11f914074c6155a8c8de351ffa0b4a02a10
MD5 45674455839ca90e37a0ad922624058a
SHA1 3dd2355d54468dee877e010720cb1d2928bd2c64
SHA512 b5cf186b45cf22a3024040474536a9d5e8b869b6229883f8467954f5322b215f0ca5035c92f72ceb818c333675ebaf05792defd0d2aa1fe15798f14da4d8ed98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0c01453f431634a006c0dd935f2094a3a17abd43ec4b51d13a94b1982609ad76
MD5 cfb6bc987e150027a3ad2f0debd27bb3
SHA1 35b750c1295ae85a1255842a7c1b3b27fba89808
SHA512 f4cc63986a8a576fc17ab252018e4458c43e08672ef5dd8abb0421b76bfa33e4e27e20ca3668eefed1bedc9dcef712c285b7cb8403ade994391993c7024e2189
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4a432850123a86c788461e2d9b33cdf3144107747961b42c3831bb224ed9952
MD5 b86c80fe818badda0a3ba8f6bfb5453a
SHA1 541d5d347059bf79f63772a414044b6de60732b5
SHA512 b089315325f0cf246c74596f518a89a604b8460bf4b9a1baf764483a650f6e2b4371b4b35dac90e456145d5b3900fb4c00ba32b5316811d5746e430634a61ced
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6df3622f2288e8a162dd2193f53936eabcfd901b266b74fe7560b2646a59aeb
MD5 2fb36d39fac1afeea7cfd8a16f3d927c
SHA1 f7c52abeb060c4812ee8076bc79f8c62e95551e2
SHA512 a309d1c7baef1293624a1a4751b9314ce39f6c53df6fbb3e9dae3e04f9d5d88e7cd0b58d6261c85e70787b1a6237d94393cf8b84e9cdc7d52fcbdcd48cf53ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e4ffd82b15ddef9926142b3524bb33b78c6e6002ac9ef4fda2494c642a184e7
MD5 4ade4a022f09f3bf130019b21e1ab721
SHA1 d87a689637d64dbc9c3f7967f366ed6b31dedddc
SHA512 24bb31d97ebd6dfde749e6314a4ca79f28ca2dcc1b0749415d155222dd863c4138cb59513cc1f7d537008a0c649ed2a7608d1ea0981b1d5bee41ea2c1c502cb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e68e457e4704183bc578e7496f1e51d5fbbb5d33ccd8aa4214fdd7b4931eca9
MD5 2bf8fd1a68a42266206632e057892455
SHA1 8feb31505ab2d2e845129fa04ad17322ebe7a8a9
SHA512 6a57ad9338b4aa49c067f219d3cb5bec75a510f5d7f80e3d5cc9a8e600df4f2790b2646637e811e8f9f3794203e5ed42da047d1d0cbc19e25eaaa007e61f3390
MD5 SHA1 SHA512

Submit Download

svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCAAACCBAACCBCCABCCAACACBACABBACAACCACBBABCABAACBCCB.exe
Size 16.7MB
SHA256 f9c31c95d24d392990db0f2af656d30650a2b2f21590276a7458d5918ca639b0
MD5 c14b85175373d055b2e2bd0399802f29
SHA1 14336f28ad9d7e1d25d5ffd5ad5f40dbda2b8d6e
SHA512 f2827821dc0304756ffb7e8f774b67424db5c3f5107b59aeb1035f7d28eac3817533af811fab38c26d028346b21a1444e803272b429d603bcb520c074f346484
SSDEEP 393216:FO4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4q78Uhas9O4H:Uhasshasshasshasshasshasshasshay
TLSH
T14207193CADE841A6D472C671C9A2A5DDEA31B8127B005ECF21D2534E4D3BBD26D70E39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 959f508b5c39ed690c8b5910832cfc2ee6766bef4a34e52fabf0427e05c001fa
MD5 a3c436e07b773a788a0d33a09db92978
SHA1 34fdd6cd3b3ce674ff3f0b5384dc51ca3970e1f2
SHA512 483336d0b8f7888da6c994b44e27e977b993c1fb70311b9c90a0aadb692e1d42a56c5d4512d75959c2d31c270cd304c4fea2c1b8e4058dcf15be6928b3590c9e
TLSH
T10F21C652F0F58C97F12168C7AA269F570CE4779FBC58AF145344421CEF46C3ACD194A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bc020ad161f00b678357af0a850ee5bff8dabac410e2882a86ba19d63436a04d
MD5 d5cb604186d38e276c11a0547d198cb4
SHA1 18a87bab9ae1d2b867061387c70b41ca04ec9eed
SHA512 85e29f630c3ed46c6407fe1ae13b07f6a0917a4164cd861eb539bd350032efc25f787bc1c53c125ae6c1551090893da6afdcbc6ef8a1d336d131cdf8b158cd3e
TLSH
T140219652F0B58C97F12158C7AA26DB970CE8779FEC98AF1453444618EF45C36CD194A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b0b26693c61d94c9b1ac34b65d8c383f0b4f4c6a02b3c54829704450e990a5e0
MD5 0b52a56b8fbd00eceec8f1ef13b89eec
SHA1 d77137c0c5a41de61b2ca1213886e200af83df4e
SHA512 41b19df5bb92cead794f66b623817f1a6d151fec31fa9cfad0d2fb9f156b03b8b143a22c57471300080e8bc53f217b051978d30002fa50a4ebdbf707a89f6c7c
TLSH
T16511E742F0B59CA7F12168C7A9269F570CE4779FBC58AF145344421CEF06C3ACD154A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-1524-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/1036-63-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1036-3811-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1116-6-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4528-33-0x0000000000990000-0x00000000009B1000-memory.dmp

Download