95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Size 3.5MB
Sample260810-cydcysdf52
SHA256 95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7
MD5 6aab8f567fdfb3062512bf6849b0ed10
SHA1 0022f3a47464ad7929c39145fb506b7e1405398c
SHA512 f9391fab1898b945f693903626c2c7026fa66b13c8605c10b9d4ccb104d2479983725da8b2699db4b388180042ec31ff6adc48570649bf78926b2fe50b1a0499
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WCb:Bp79
TLSH
T197068E15FB980CE1F873517C8997C629EA72B4251B21CACBB26C832E2F336D5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
796	svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
4236	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCCBBCBAACBCABCACBCCCABACACBAACAABBABBCAAAACAABBBCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe"	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAAAABCBACCBCBAABACACBBCABAACBBBBBCCBCACAACACABBABAABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe"	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
868	sc.exe
4432	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5012	cmd.exe
4916	cmd.exe
844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
796	svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
796	svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
4236	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
4236	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Token: SeDebugPrivilege	3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
Token: SeDebugPrivilege	796	svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
Token: SeDebugPrivilege	4236	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
260	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5012	4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	107
PID 5012 wrote to memory of 564	5012	cmd.exe	109
PID 3672 wrote to memory of 1976	3672	svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe	111
PID 1976 wrote to memory of 3920	1976	notepad.exe	112
PID 4388 wrote to memory of 4916	4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	116
PID 4916 wrote to memory of 4432	4916	cmd.exe	118
PID 4388 wrote to memory of 844	4388	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	119
PID 844 wrote to memory of 868	844	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACBBABAACBBACCCCCAAABBCBCCAACBBBBBBCBABBACABACABACACCCBACBCAAAACBABABBCCBBCAABCBAACAABCBCAACCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACACBBABAACBBACCCCCAAABBCBCCAACBBBBBBCBABBACABACABACACCCBACBCAAAACBABABBCCBBCAABCBAACAABCBCAACCAABBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe" start= auto displayName= "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe" start= auto displayName= "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCBCBACACACCBCCABCAABCBACACBBAACAAAAACCCACACBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBBCAAAABAACAAACCCBCAABCBBCBCBBBBBCABABBCAABCBACBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ae614fd19e06e17d39035bbab712d7ecb654d6aaed7cf856dd60f84ea41c6cad
MD5 cc470904d0b8c218e3b6178e5adc4475
SHA1 1306e2a5637d4e8cded62ed604a366b45b936969
SHA512 20a8d0a563b1cf50fe3166e598ee68010f648bad7dcd7175cd8a88f735a3822f712a5d113e230d5b9f4114dd41c3c1da0ff26c9288d62aeaac7cbf6142080d26
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 4.0MB
SHA256 b2bcd9efa0f8efd42c9ecbcce8658492624e83eb93d86f94e7684d2d931eca7b
MD5 ab88c7712f22066a4cb920016a5213dd
SHA1 809b4aad8d9a799b491806e5537fd58d275d5cb7
SHA512 c0b6698d31a3590eeb98fb4377eaffed92729058f1cc0bb5ca44666d04d9acc88213a945a797e926aff87ef40927d823a8dee4d308dc54eacf72b842f5138b77
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WCsXpiMR:Bp7apiC
TLSH
T149166D15FBD808F1F97352798996C615DA72B8251B21CACFB26C832E2F336D0AD35712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ja-JP\qap`g`v~dtlq
Size 10B
SHA256 d2ef1e380da235d77f1c8227c065235a4faeebcede9e642df8db460ca7b6c77b
MD5 b231ba2f19cbbf23397c080cec3bedce
SHA1 25c9d03b696ce33bcfa317f3aa3a819387173897
SHA512 c2daa2a711c537e73e0f5a781f22fbee7a251d71143a6d0dd9b618b8ee80ff648a00d7749ca6a132248c4187e382c1e67033c53525ffe9ead63ca795d74309d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bn-BD\qap`g`v~dtlq
Size 10B
SHA256 230afaefbe47235f87341d11f11ef61c2103a7b7565f35400b4a6f9da68dd69e
MD5 a5c1f9d32ed5532cb74f0d4657fd6190
SHA1 bbc8972ecb369f70a1a6f0c2f2ba55c613b9e37c
SHA512 eeeefae60036ff5af3d1da0d5c5a084a6632a2f840ba6dad0525d763a730e1dc816512b92bd3a394b1b5d45b363f2aa9d0e1bd655a2df6c544530696f10aabfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 7f0ff17092c91df3c00c1b5a50d03b464a09b060e2b643d554946bbff5a8d239
MD5 c021f5000bb2c822e020f2d8548bdb42
SHA1 46d88b0ef8b3d657a839f8dee9235930fa07bebe
SHA512 0376b76e6dc1051809fd4c4a689c2aeb6dca4f2ba95f1c4698b5ddba8309c7a71abd390a6a1cee67570b3f9905c8278fa0fc09ecfbdb2f7b30d1b1f4f9814984
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 281cc1894fc3b79d23a7ae2594d955258a977056469c9ca090e4341b434f7e9c
MD5 fd222a5f16b9bd7be4935f5103473b77
SHA1 f67e3c465be5d623ca24c6644a3c58889c0cff87
SHA512 3a4510576839f2c46ac9d00a5909cbef1198795a01c947757eb9fd3fd9cb932529cdf6ef223d430ae6154aab65e5f9d344988545f84c73bae7d732fef23de4f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fd7355c4044ce91f198e93ea4c800b061d118c84172bd49a1d97b70ffc7b9ca
MD5 49d824dfb4d723b5750ba9ee1ecb0fc4
SHA1 c2a6607eacee1693bbeb382d8e3a10fd8e9467e5
SHA512 827f590b38754eaff03e5a2b6087c494834125f76aad22dc1942b7a4210ea63b95e9a646138cc106d9c7a26791406385b31f927e484ac723f321f6750d6c3875
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8c4c53ef016b0f16a681a1418457ff94a3933a9d7868adf7eda6d5764ebea358
MD5 fe19df3186f7efc3530e1916df2a40c0
SHA1 47e5a6ce1fa6acd20d63ec94d6956c53b2a21bc3
SHA512 5765126c3c8fa1cec4ccc6770a6260759c0a09490117513e9ee257d8f92f4a4c668e8f15e4efadb5248cda1909480e4606efec1706c768d62b9d9481bb3828c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ae24620249eddef64655ce5e36f03fd0f33965d172fbf55643d3b496746c36c8
MD5 674d5d5271c1ec4ddf11823b023511a0
SHA1 4213f6b1b8212dc756ff84773edff649406dae04
SHA512 48327b8cd9e7cc3747ea3e5d0202423282d158b4cdff616765ae3fdec97e65c5bd351a0b3f2d5fc25dfde5a22e394e9132c2e9b9349c26354e45ed31c041976e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a4b26963e874e526ab961d14a5584e4da3da6f2a9d8014e4164d492dcb87ba4f
MD5 ddca10541593c9a4cc5256b45a9e3155
SHA1 1c65eccd864bc832c5e8579c300e2a9f0a1c6f1d
SHA512 b984609528864855dc2f621df9da1a0f74c615c5be74ed536d29fb8e8bcf5ed02e0a18eed0e824ff42239363c3da223845a46e5dc775365ead14d2e65301f994
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 41c75201ffb238d6582fa7cb40f390d76f40d4b14db64db6f5fa52b3ed5a85ba
MD5 3d34784f91f14c26e15608c27b600956
SHA1 2f9b30dcb4c1b16450da8c0f5e66b2ce2cd00c3a
SHA512 dc50e97764794e9d059df9ef7f45f1bb142a7ed0a28ed8f39194b942b9df6e2c27a09a41c2261376d5b714c751c0ccb800a647b3abde2e52cd04934596ce91eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bfef5da6370afc92cae7af8d5d09d1ab0ba3af0c3e8399e1c6beb99ddad4c801
MD5 f7bd971c3bb400b6380170e972bf453c
SHA1 51c1b86a20a40e9ac0b385372189858d95e35b12
SHA512 9bc07d7751c5c81ea7411f3c4d368cb8b0e3b2e2ce3c83bff13352aa21ee52bca9a38427cdeaa2113c955f3be280503eaf1f01b8b5b114d7811d68f2f314e4e9
MD5 SHA1 SHA512

Submit Download

svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCABABAACAACBCCAABAABCAAACCBAABCACCACAAABCBACABCBBBB.exe
Size 3.5MB
SHA256 95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7
MD5 6aab8f567fdfb3062512bf6849b0ed10
SHA1 0022f3a47464ad7929c39145fb506b7e1405398c
SHA512 f9391fab1898b945f693903626c2c7026fa66b13c8605c10b9d4ccb104d2479983725da8b2699db4b388180042ec31ff6adc48570649bf78926b2fe50b1a0499
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WCb:Bp79
TLSH
T197068E15FB980CE1F873517C8997C629EA72B4251B21CACBB26C832E2F336D5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 5e736bf6d59f6306f9bd8d148b6825748ac355c0175f7a52ce84237fbcffc627
MD5 a0545720f242f91ef464eae1e7fd71e3
SHA1 d0e962b9d20932a110eb69100661ee558de6652a
SHA512 708019b457b1df794f9a1209e6cece2644692e65784adeecc67247afc82f4becfd82ab341bf8eaf401d0ce301744a39a10c25aeae03088be0495d2c0b8f11355
TLSH
T1C701C46464F9D827EA33ACD75219AAE20CE876EBF8589E08230852196FC5C24CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b1d1a7bca83008dcc67d7c8ed38ecb322b13202a18c3d5d6b266a3a047d3f9a6
MD5 3fee304d79384fe25c833d347ede4b7d
SHA1 45edef0462e31791b70c1ee71765030f5e8bbe84
SHA512 a74feaf683dfb23f00e7bce9229ab354af5ab60b66181701a68ef8fded2f75c296eca736f25d23bdac5fa9bb7c9688dcb0ed527dbcc346e8f181ddb796942913
TLSH
T1D521956464F9D863FA33ACD75619EAE20CE876EFF8689E14230851196FC5C30CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-89-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/796-77-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/1976-57-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/3672-34-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/4236-90-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/4388-0-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/4388-7-0x0000000000660000-0x0000000000681000-memory.dmp

Download