189b265213918717f78dc099c59357e7c6155556091848c12a500879b5ecfd19

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 19.4MB
Sample260910-rnlznsyvbx
SHA256 189b265213918717f78dc099c59357e7c6155556091848c12a500879b5ecfd19
MD5 8630dc4b169a17e409da08e3997f6770
SHA1 afd89817e3c408c7f445f29b7a06956f4d346566
SHA512 aab494189d9f02f46b20acb84d26b6750c6dc3e91b3881ae206730b92666e47a1a787d6456116db3f2d450a85e6cd88a2cd04ba05518a690e890da1f41f5d758
SSDEEP 98304:WK7K7K7K7K7K777K7K7K7K7K7K7K7K7R+4jP:UjP
TLSH
T130272909F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DDB5F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118c8-17.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4b7-25.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
1924	svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
748	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABAACACAACBBAABAABCAAACABCACBACCABABBACCCABABCBCBACAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe"	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABACACBBBBABCCABCCBBCABBCACCAAACABBBCBBCABBCCBBABBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe"	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe
5692	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2816	cmd.exe
5728	cmd.exe
1384	cmd.exe
4492	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6108	schtasks.exe
6096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
1924	svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
1924	svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
748	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
748	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
Token: SeDebugPrivilege	1924	svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
Token: SeDebugPrivilege	748	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 1384	6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	95
PID 1384 wrote to memory of 6108	1384	cmd.exe	97
PID 696 wrote to memory of 3628	696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe	99
PID 6076 wrote to memory of 4492	6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	102
PID 4492 wrote to memory of 1784	4492	cmd.exe	104
PID 6076 wrote to memory of 2816	6076	2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	105
PID 2816 wrote to memory of 5692	2816	cmd.exe	107
PID 696 wrote to memory of 5728	696	svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe	112
PID 5728 wrote to memory of 6096	5728	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_8630dc4b169a17e409da08e3997f6770_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABAACBBCABCABCACACBACBAACBCACCABCACCBABACAACBCABABBBBBBAABCACCABAACBCBBABCABAABBACBCBBBBBACBACBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABAACBBCABCABCACACBACBAACBCACCABCACCBABACAACBCABABBBBBBAABCACCABAACBCBBABCABAABBACBCBBBBBACBACBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe" start= auto displayName= "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe" start= auto displayName= "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBCCBACABCBABABCCCABAABACACCCCAABCACCACBCBBACAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBCABACABBACCBAACCCAACABCCAACCABBACABACCBBBCBBCCCBABCACCBCBCABACBACAABBBCBCBCBBABABCAABBBBBACCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBCABACABBACCBAACCCAACABCCAACCABBACABACCBBBCBBCCCBABCACCBCBCABACBACAABBBCBCBCBBABABCAABBBBBACCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6096

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCACBABABAABCBCAAACCBABBBBBABBCAABCABCCCCABCCACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 71eb75b00a4f80f0e8bf280579361dbc26ee9968b29975180534844b78cc40a8
MD5 636efde6427a87b3f392226d991fdbb4
SHA1 8190d0cd9824d1a7e06c39fae5356cc5f59aac97
SHA512 3096b5a91157e4e0726f3d0f0e558c003cfb49f6a550eb4aff30c10c92190a00301ce3826ac1c8f7b5ccbf7ab9fde5f431f4652f344e7f08df177a047c7026ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\qap`g`v~dtlq
Size 10B
SHA256 27e14384b3493570a4a3444408938bb04624f1b01677159cbecbcf2410f536db
MD5 24a0ca09f360308e444251f08222df00
SHA1 4c99093697f8befcf84053b30643eca5cc089a75
SHA512 ced7a65e65274699eaa10b62cf05d47b7a529fcf5c4afe921950a250e7e10ffe604ebfacbccaed0f5b320dd48cd3bc6bed7dbe96f4c6eec25a911c9052839dff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\qap`g`v~dtlq
Size 10B
SHA256 558be454cc98ff448600f0404287392e48fde51a5558131d3fa896b7c7e8bd65
MD5 c31bc78d9c176011da9b8169dc3785f8
SHA1 1dffafc40d251913adebab21977e7652aca913d3
SHA512 32c5c1d53985bf6e63730e02c02ed29eb2f3c72ff7b6c80fb5f453c459996cf59194ae1971d0d66ccb485f8aaac2b232308cee7490e7743e4f48d84377a663ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 32842beee9dc13c209acb554676788e502347cb9dcb7ad1a8e6b35b34a1ccf6f
MD5 0ced92261ce76fc2f3ebcac0103575bf
SHA1 691f0e6c9834b0f90d5a71cb64f617b2fbda3dd9
SHA512 9f482f4cd3bec48331c9966e190ac613358daf3d66d879b8eb29a48919a94139797785c73f2a1c4a934aaf7000ae6fa132914e5b3871f08426e0555068b8381b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 9020abbd31b09a05f481cb2dcc187879f12fc723fc8424496af99dc13b718a8c
MD5 4fa48ff67b4072f559102d52e147bc87
SHA1 792fa215d4e539a555f7dc0f29a4c84317707c0b
SHA512 cf812307b863a08ccd42ecd1aac7ec7dc2d28e173b6107d621693ca3bdf0edf52ad7c5bfa1bba5609ee13746ab9c4258e39ed565ae5aae3ad749eb6562002541
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 17abc67751303550eec858ae965872a1f02a8455f43752977821a56c61371543
MD5 706a8beb2b17fedd856b853c4b5cf856
SHA1 b7b9e6cb6c722c0922befd3020b9bb4d9b347737
SHA512 1de5c8bcadbcceab2a919ee08ff8b68a249ab6a1c1278336d08699f65dbae44be6222e4d466c37644117ada00a644b6747c52bcf9970f5b363e13282c09c0bb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 12bf47be3f7c2aa088664c2f24e7eed05fc0928d8a5b1361f5ee445b0e6c0cf5
MD5 ce1ac806982e5471aaf00cddeac00592
SHA1 a40cf821d666f2ff1d7b5d09103e6d8dfffaccac
SHA512 eea06fdf55f06cdb4e2ecf9a4e78b698db5be553ca9353741350ea4f608dbf382deee7c3c48569e1946e381ed8ef1f7977203be50c4a283d73f7d445fd3ec9a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 93be26ecad6965913f0a48b8d9dd4aa1a4d01138cfde3645a29f2df0db395021
MD5 46f7216774e68149866360e88ecbae41
SHA1 fab303a762ec12ef31e64e46c2595b6035dfffab
SHA512 de5f5de6ab227b42886fadb3c3aff9341bb61b4c6bfb07eda89ac8b11c3735462b105fff380736980c483ee42d37e7d56f65862af4fc152112827fed8b12f2e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 e1a077928e9d05491d70232e686118851f1b3e846a2d3bccc045d189a5748e81
MD5 825152e6ac1cd6dd7fbc248b0c2f10a7
SHA1 7d99034df5f220f6267972039a7811a72c1ac79d
SHA512 cd86a61ad759be5f8f1eab480aded8413ba982575426956549d33152c5ca98bf858932e501b76961e13ba9a0783379a98d624784e96ea4e8d82c7789ea687b8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 79fa9b8ed66cb6157fa651aaf4178b44f4c818736378207964a5c42f3e079077
MD5 5b72a536854a75c467f34f43ec980066
SHA1 559fa6da4bbfd8056bd63dbd8bba15ef3a2c7615
SHA512 00c3f7d27207d6d6b8898626578de2a6f4dbd60d0cd33ce8c83b730573c4fe78fe7e0536c91c3ebd19f2ba109e6bf03e45d2f8e60fea33c6a404a4da6781ac23
MD5 SHA1 SHA512

Submit Download

UnlockImport.exe

Path C:\Users\Admin\Desktop\UnlockImport.exe
Size 58.7MB
SHA256 b6d3e2e38f69af63bfd34bd2dfd9602fd3b9ed1d6d98a890330235873abfac30
MD5 9b64f94c1212670b5494e65b927c1b34
SHA1 507b46ebbb4c8dd616a1a15bdf48027889d73e85
SHA512 970b6ea797c84661956531daa12aa6247011d1cf3e8e60c2859ff33b2ae11904db18fce13d1e850cc3836fb757875107d88d62eca4ee88ff311c5269cc9e8162
SSDEEP 98304:WK7K7K7K7K7K777K7K7K7K7K7K7K7K7R+4jeK7K7K7K7K7K777K7K7K7K7K7K7KA:Ujcjcja1
TLSH
T124D72909F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DDB5F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78db395a675ef2bc90f9988bfaaeef6004837951289c07446972e12283b46a11
MD5 0831d338320d9795cb65458dff2edf7d
SHA1 b3e9bec69f297d5c1712c6f2182fb40d07c99354
SHA512 1e328e0c1561858a21e511779c908b23cdadeb3a01169fe8a029c12212a3a453a7e6c261754d3d58a22aae0d207f62bf43171bcb20bab2247faa5637964707cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8c80923050fce69ad51e8520d476f572d106722d58d395d367f13053a40d4fe
MD5 ac72fcebb1db84c6099b487529110232
SHA1 b7dcfd5bae8c8078ddb250ab009646667ab7925b
SHA512 cbe3019b83b1f250ccb727b0966709a40b15fcb75671a593e2ccdda05996e6c4d8633eb4199c16efda7ac9c1b6dcbb959d5c8736b6e9b900da909ca34f685dd6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffb3d1d90a0455f8862f58ad7feea7e106589e993a0f1299a065afffc216ca25
MD5 112e978dfffb42d6d6803a0451d15eeb
SHA1 e307f4b5e263ce5d7370bd6cb5792408c8979236
SHA512 f28594e06449ad88ef1d51576211a8a1df759b44f35d88229ffb34e2e7d6bff3c63677253a633fe5d50bee0ddb2547a9dcdf724e80d0273a95576f1eb7b5095a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07007633d520ec8f69e359c2aaa068c08b21da316cb05aaa6bc4db208498194e
MD5 91668c3294ac0a86bbb300be8015e99a
SHA1 7f5b16fdee25e5041a9853b024c6461779fe22b4
SHA512 83ca185067baa152c512625fa8178aca0bddb4e4d7c3a6211b09d508aec7abf172a3b6cb43fd3876e778643bbe39155689f1068283fe19a853b62bc3d7895318
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 ee0242cfca2cc14a10878d2ddedf0ab923754aff2d1d400a0373673af8df1e90
MD5 e037d502386c1921e43a0035957d5273
SHA1 04fbedbba096a47dd9414641ca4247bc5951dc0a
SHA512 4736948d749340403eede8bbc9ca3d8eca44c2ebe5744ee4ce37a46046a1d803f811f05506ab14709f61efdbd3437c867133098ae8b6dd197edfbfb9534500d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 30a0a58b5c05db4c8055449f13c0e9a4873b3faabccdb94b0d6901bb6fcb9a33
MD5 9ecae799619919c9f04afc75ddd5a193
SHA1 e2e6efd3d895e9e76c6c60a4f6cf3d41a126d30f
SHA512 4663bb76c791974a663b7b4ce380a4a3c228ca9916ce5221cbf40e6b3761099609113463b18a949a419305dc0a4ac7aa66b241b9d7b26a0f1ee8f215e7c93ef7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a8876093c2fdb277378a361af5973a12a1556e2151f4d632fb12abfca65db4a4
MD5 357ac17857ac3b8f7ca7d5491d37f71d
SHA1 05e40ca41287d9f6abf154c0012baabe5c8cc791
SHA512 cbb058c91635927396a9884893b4b8fc2f6b3675c19441b2133fb84a4f7cb1b0bb651a640b731383b372665e0ba9d6a6cf746c16f2529bef7de94998242dab12
MD5 SHA1 SHA512

Submit Download

svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBCCBBACBABCBCABBAACBAAABCAAACCCCABCBBCCCBAACACCBACBC.exe
Size 19.4MB
SHA256 189b265213918717f78dc099c59357e7c6155556091848c12a500879b5ecfd19
MD5 8630dc4b169a17e409da08e3997f6770
SHA1 afd89817e3c408c7f445f29b7a06956f4d346566
SHA512 aab494189d9f02f46b20acb84d26b6750c6dc3e91b3881ae206730b92666e47a1a787d6456116db3f2d450a85e6cd88a2cd04ba05518a690e890da1f41f5d758
SSDEEP 98304:WK7K7K7K7K7K777K7K7K7K7K7K7K7K7R+4jP:UjP
TLSH
T130272909F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DDB5F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d5000f56254d726c3c9ab4a61a6775ad1dab62f524a79fb584a8faf72ad467df
MD5 7c4185d1beb5f25e6061a575094bb80a
SHA1 cf68ef6e01876ab061c78071200da1f8b30c264e
SHA512 9d3765cf6668db8903135052c67a429aa798e371effa8e979fcb4ae4f11a21f0dfc9e0293b76d317205a6c58898e33079ababb6cf3308c9d06d773ee6b7b61bd
TLSH
T13F2126A0F0A5C4A3F1712CCB5325DF9708A837AFAC5CEB80630D112CE765A359E554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 66216c8853e08c6f086482ef6441f9f14e299ad262944095ebc074fa28c42624
MD5 8733d49023c05cd2c2eada7a45033d7c
SHA1 2dc62745c7edad9c24d136f950077fd54069fe1d
SHA512 ca0ec736b44f5a70b7d0b31545bb3c4d7fa5f356c43ecebf393078e9e3bd0138024c195c0b19a5f403dc0fa5bb9b60f81f7e76e5a852fb5f74a90bd58712cd02
TLSH
T10A2107A0F061C8A3F1712CCB9725DFD708A837AFAC9CEB80630D5128E7A5E369D554E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3556c62de531a593e9007a425018f4b9072a666a6b7d5f1d989daa81cda2d53f
MD5 6942e038e7ed46a34a4643f262d23c79
SHA1 3e4b9c4408fc7ebacd478833c89989af2ac2d8f1
SHA512 3873efd87786ee31300e8bd1b52ba09bc09361dea0c546b365889b8421e1791b42c6ae7bd24e424c9e8143e7a266eaebd621e9faf7892567ec6a880b8b66e06a
TLSH
T1B41127A0F065D4A3F1712C8B5325DF9708A833AF6C5CEB80630D112CE759A35AE590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-66-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/696-47-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/748-1775-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1924-101-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/6076-10-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/6076-46-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/6076-21-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download