0bcf7714b976ec8be977db2916f1d1b7f7f021baf2c1bfd1946a3112e6dd44e8

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
Size 20.2MB
Sample260810-1ncwfaag65
SHA256 0bcf7714b976ec8be977db2916f1d1b7f7f021baf2c1bfd1946a3112e6dd44e8
MD5 c599626290c692eacbedd71887277770
SHA1 25da7907b90f4d098839db89854aa4df8ffd8165
SHA512 b185183d299377c0211446899e27f99bf84c4a0cba764f9bc3a6879d7b36f2bd9876135219f55e99c1fc89f0c4d7be63fb5067f1aabd17a6040112719d85067b
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+EC:jp77
TLSH
T148274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
4244	svchost_ABABCAAAAACACACBCACBABBCCCCCBABBCCACBABABBAACBBBACCCCBB.exe
1436	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABCBCBCAAACAABAABBBBBBACCCCCACCCABBBACCBAACBAABABCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe"	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCABACCABCBABBBABABAAACCAABBCABBABBBBBCCABBBCCCBCCCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCAAAAACACACBCACBABBCCCCCBABBCCACBABABBAACBBBACCCCBB.exe"	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
1556	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe
4660	cmd.exe
4612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCAAAAACACACBCACBABBCCCCCBABBCCACBABABBAACBBBACCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
1436	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
1436	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
Token: SeDebugPrivilege	4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
Token: SeDebugPrivilege	1436	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4300	3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe	92
PID 4300 wrote to memory of 6004	4300	cmd.exe	94
PID 4852 wrote to memory of 3508	4852	svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe	95
PID 3696 wrote to memory of 4660	3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe	98
PID 4660 wrote to memory of 1600	4660	cmd.exe	100
PID 3696 wrote to memory of 4612	3696	2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe	101
PID 4612 wrote to memory of 1556	4612	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c599626290c692eacbedd71887277770_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABACCACCBABBCBACABACACCBCCBBABABACAABBBACBABBABCBCBCCCCBACCCACBBACACBACACCABAABCABCBCACACACABAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAABACCACCBABBCBACABACACCBCCBBABABACAABBBACBABBABCBCBCCCCBACCCACBBACACBACACCABAABCABCBCACACACABAACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe" start= auto displayName= "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe" start= auto displayName= "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCCAABCCAAACABBCACCBBBBBBBBBCBCABCBCCCBCBCACCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAAAACACACBCACBABBCCCCCBABBCCACBABABBAACBBBACCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAAAACACACBCACBABBCCCCCBABBCCACBABABBAACBBBACCCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ff2a94ca9bfe9b74c1a16c67040a0a5c6ef882d980d39cb15254ca667bdf9bc1
MD5 2960c9804cfc5593d6bd17f4f679c4ce
SHA1 7b8b073899bbaa48cc88bffa1bc569694a02638a
SHA512 84dd98400ca00e49ec9a156e5daaaf4d1991292036adaa7fb4d7480ce2e5dc23114d866b0934cad9fda885856be60a5832c834f7a6d9dfabe2abc42d737603e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 9a666b7f95aa8f89b26f90671f85520cd96a90c17f7fd0cc5e4f81226e6b5345
MD5 91868ee5c329fd4f6fa1a143662ef1a7
SHA1 34b102902fa1f774e55fae9f190fa7b3a665059b
SHA512 c590478d8bdec4326c037783452725b863ae578b025cc9c48616cb799644eba90dbd0184301fb402c18cf48b6eda80137ceb967bd2bc3fee57b28459a0f495d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 e5728f1e45eba5712255d82cd793f2d142e46cf30e76e5d4018625afe1996510
MD5 4201d24be8b9a0728458f87b1ebf6f79
SHA1 93dc26a776d4d4eba9b44d8fc839f7dd08add535
SHA512 317c505cd39872805f7839d7087529ef23d0b5f1a580f8c921c979a8afd86498a78e85255214adc6c1157ad032e19961a34633cae006b010498c8676309c1737
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 46952f8ec311afaeb59051012e70394b439b5504aa2bbbc1d9104a8f030313bd
MD5 3fe3b741b8417cc4339edd1dcd81b773
SHA1 349aff836e969cd308ad6265dc4e52d794d161c6
SHA512 fde260d2f3c7cdc31d9d155290c2afd8cf9fbe768611aeb3a1561aaf7dfb7fe519633403af55cca0ce4c6c7711406d7b23db062006ec4f8a23abca4ed9778780
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Feeds\qap`g`v~dtlq
Size 10B
SHA256 28edf63e14d3b5017b5a4c1215f87f9f93a708eb32068acb0e8c6183a40f16be
MD5 b387cf5d6d8820d424cc52fadaf77e68
SHA1 27330505c15f5a0f9f6bc43c1974dcc80d51e084
SHA512 bde68d3d787482cda8afb6338b076ebc8620acd56a5be9941d7aa5a6b12626dbb69f7b3f95158bd2bb50238e287b3df38eba42446265f586b7cf71478a2921f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 9d5a821c6b9ac31a1f2a0351345509078a6a8c000bcc5aa0529238965342e6c4
MD5 84f5e6c08df97dd99c63ab6aed9e5e0e
SHA1 d9defad84376e4a28a7a772b79853993a2ceb2f0
SHA512 2ae5618599555a671f59eba4f9135e7a53cb6df9c9a964e1cf345581bb4dbb4e7e3bbf1330c4a494d05dc1537ba54441cefe7d931992f748041267db92a4b423
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a8d5ac479d97b6903e7673df14ee5e33495ae7b64e8901f509b9d31f0d16899
MD5 705239f0b3380836006180010b5e4a6a
SHA1 883f2f8807b79a08213844bb8f73e373a87e0d7d
SHA512 6586cd2fa88b6d2236725a7e3373dae1a3d96dbdb237b740e06296eecd4721da765a89e741d433e19b9a5895a37d5c43a8cb9ea18976a0e27631c52e354f5a1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4b35adfa0bb41cfe70fe2b82e194cad9c4f92139d0402f3ba78e54d7d0e256e
MD5 2a53456963f96af3b06dab8e3d97f846
SHA1 bd0f5ddf75030d5a9ce62c19eb7742bc1e44cb33
SHA512 42e12c468b14e65cd15cf8b543f63e71a5f2a8a37316ae252d05b664f37ae1150b7249176bf0ec7c2aba5bad888af138f294156bc8ba3f61026a613aab74f22f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f6a2b3a7151a4761c76962b6596cdb2fa78ab7dc30253f03cc6d919508e75b7
MD5 37614a32a98d3b33eb831cbcba7fab2b
SHA1 ed827c90074cd35dea47619ed63254b5edca4e8a
SHA512 ed534f802b89f93801d4f0998e96a51064d4d85af0bce3d01e12191219c2134854b2fc75a056dd0403d26e6b8009dfc7a37a78bef63dba6a66d11f34f45d3739
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60741d046239ebcaca2a8b3a65422c15d5437ccfbe2479cb8f17e20d91e7e606
MD5 6f148ca7395b4f895593892ee127971d
SHA1 d7f1492a5cadf4a41f29a685683c69c477b71a95
SHA512 9ce2b93fa4e66ca4baf45108ff66ca311147894650bb652263e3e97b777ef32fa1876fc6d24b1f57f33ffa5715dda6641b20ed7bb715e3f129983fae249a14f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0dd9cdbf982ef771263ed8d011f626f6ba810ad69e731ad31adc97805398b2cb
MD5 af3a898b67b5e87af136fbc970eceb03
SHA1 53380b92c8b13f7a81ad795334ff27d34d7c2292
SHA512 a976eeed2a09a70afcf89cb1add2ba08f65fa5e657ca3edc154fcf5255d7d9efa41991e2331b6f45d1d09f85741e95eb726c7f3d2d40380f5efc08e04d68ec49
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 61.5MB
SHA256 c48d0b7eab14ec68e75e839b005a9f14fcf245ea75b42422c7e8c786b3a43287
MD5 1f5dec128972aa42e9e87fbc2c55a5a1
SHA1 ed18c09737d9e98da9d3c586e2eccc4ce8a47fb8
SHA512 c52f26af67e4a7dcec0c7ed2cbdda88ad27a767aac06277dd29204c472be349d2577742203398e74810ba789a3e386b51edf8df10cef848c54b686f0b4d52283
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+En:jp7Pp7Pp7lYwUyPzJyjmJBgqVjA
TLSH
T13EE75B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 5f923f0a2c6adf953758f6945162bc3403ab73b7d7e383794d4a24814dd40974
MD5 47a1e7760a972a09429222e9a7d66832
SHA1 5d0c9ac40a1ccbeb82f540c7c6e804b0b2c5927a
SHA512 cadbacac0f42d6a62d8afbfa05ae9e8db59316812e57fa87fa10b05ef604e9f042cd1b6ad7bb383e508d53b9a66f7284d2cd2f3ea34e3dae170a18f108576b76
MD5 SHA1 SHA512

Submit Download

svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACCBACCCBBCAAAAABACBCAACBAAABBACCBBBABCBABBACACAAACB.exe
Size 20.2MB
SHA256 0bcf7714b976ec8be977db2916f1d1b7f7f021baf2c1bfd1946a3112e6dd44e8
MD5 c599626290c692eacbedd71887277770
SHA1 25da7907b90f4d098839db89854aa4df8ffd8165
SHA512 b185183d299377c0211446899e27f99bf84c4a0cba764f9bc3a6879d7b36f2bd9876135219f55e99c1fc89f0c4d7be63fb5067f1aabd17a6040112719d85067b
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLE+ES+EW5+ES+ES+ES+EC:jp77
TLSH
T148274B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 38cf226d2f7de22b3ffe3307ad88a3911689ae8d69176628e4a0321c0e5a7ea8
MD5 15cd191e311c778c097f0cb25ac344d2
SHA1 42255401629bcc0b33b6c5e1f694f6d4ab889361
SHA512 c596443ba56fd6444e0b83a64a5fc6f7bda460a48385f254a18da62dc26295c381d5d95e88a6c0c43a6d96f449eab5b108d357502690e35d4cda41fffe01ec71
TLSH
T10711C462E4EADC23FC3224CB5539DA524CD576CB585C6A94230E421CB7E9C31DE6D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1436-95-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/3696-93-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3696-0-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3696-69-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3696-47-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3696-22-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3696-11-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/4244-92-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4852-94-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4852-70-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4852-48-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4852-33-0x0000000000440000-0x0000000000461000-memory.dmp

Download