e490f0cda840269e705ec8346c8d66b86e6c086222756714280a0175eab941bc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
Size 5.2MB
Sample260810-dbywtazdpb
SHA256 e490f0cda840269e705ec8346c8d66b86e6c086222756714280a0175eab941bc
MD5 32c8301c6413f2a9a91dea2074835893
SHA1 16a91c8b5c79521b9669ba073c5d6417510b379a
SHA512 d72fc77a77ed6da239af8fe49d8f2914c2de19870ee29aafdabe40fd1df2b65f2558017cf2ab67a26df84fa10fd520ea63606558a58dfa16bc5ac88e1129e5c9
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1Pszd:vBBB4xs6BBB4xsJ
TLSH
T1A1468D11B7D18035F5B329314ABFE339593DB9214F748ACFA3880A2E5E72AD1993471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
824	svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe
3048	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCAABCBAABACBBCCAAABCBCBCBAABCAACABBBACBBBCAAAACCACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe"	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAABCBCABCBACAACBBAABBCABABCCAACABCABABBBACBBBBCACBBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe"	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4688	sc.exe
820	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
3928	cmd.exe
4432	cmd.exe
2688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2116	schtasks.exe
3760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
3048	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
3048	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
824	svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe
824	svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
Token: SeDebugPrivilege	1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
Token: SeDebugPrivilege	3048	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
Token: SeDebugPrivilege	824	svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4476	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 5104	848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe	95
PID 5104 wrote to memory of 2116	5104	cmd.exe	97
PID 1028 wrote to memory of 4396	1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe	98
PID 4396 wrote to memory of 2064	4396	notepad.exe	99
PID 848 wrote to memory of 3928	848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe	103
PID 3928 wrote to memory of 4688	3928	cmd.exe	105
PID 848 wrote to memory of 4432	848	2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe	106
PID 4432 wrote to memory of 820	4432	cmd.exe	108
PID 1028 wrote to memory of 2688	1028	svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe	113
PID 2688 wrote to memory of 3760	2688	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_32c8301c6413f2a9a91dea2074835893_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABBBACBBCBACCACCCCACCBABBCABCACCAAAAACACABACBAAAACBAACBCCBABCCCCCCAACBCACCBBBABBBCBCCCBCCBBCBACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAABBBACBBCBACCACCCCACCBABBCABCACCAAAAACACABACBAAAACBAACBCCBABCCCCCCAACBCACCBBBABBBCBCCCBCCBBCBACBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe" start= auto displayName= "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe" start= auto displayName= "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACBAABBABCACBBBCBABCAABACBCCCBBACAAABACABBAACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACACCCBCBBACABCCBCCBCBAABABABBACBCBABABACABAAABACBBCCBCCACBBAAABCAACBCAABBCABCBABACBACAAACBABACACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACACCCBCBBACABCCBCCBCBAABABABBACBCBABABACABAAABACBBCCBCCACBBAAABCAACBCAABBCABCBABACBACAAACBABACACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBACBCABBBABAABAABABCABABABACBAABACBABBAABACABAAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Adobe\Setup\qap`g`v~dtlq
Size 10B
SHA256 dab747842c092f1364bad616a722304313c93ab8c184f0c9db1553579401977f
MD5 bed742c646550f754cf593632adc8beb
SHA1 08b4549c5cdeff5a5f2cb2d0f658c8d712886a1b
SHA512 72ac7ff88d5dda2c84391ccf72a01c49298e0216e111f527560cf169970e452f727a572d79cef8a7a8dbe8bacfd3490183e164c3fe96d3da6b2747738227c5d8
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.7MB
SHA256 e6872ae10919242bf087756d3418d08d64f45a4287ce330c026a99b68fef0744
MD5 13b694c639fa8fcc3849bbb49b328db6
SHA1 bf51bada8e90d5ecdf4988664e4bdf140e711ce8
SHA512 8968bcb7270188db903ab919abd269cbef1e1594bb1f48bea0b339191547005c9349621d48dd1555eb1764e100188e96191ec54bf342bf2b50413eb40a39a9a2
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1Psz6pig:vBBB4xs6BBB4xsI
TLSH
T1E2567C01B7D18035F5B329314ABFD339597EB9214F3486CFA3881A2E5E72AD1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 66521e3dce564bebae2e18eccb76f4be33b1c49897cffc3f811ebac0f12c9e48
MD5 53b39503fa01731c49bee733ac1a722f
SHA1 df792b1ca813c7b779f32e215f6a32a490e44309
SHA512 4a18122ec6290e8a45503b63079f23be31c8a1af7a4fa17c2597b9d855cbaed9df962240f2fb4d77a83590f3b503e604535de0f0ac74ec93a35884e68d7dacf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\qap`g`v~dtlq
Size 10B
SHA256 11a683318a51796302cd82d11fc898634091643ed52c26f8db89f8dda2f34213
MD5 b0115bc46264b802626f35ca2eca8fa0
SHA1 e709689eb098cd24e0714ba4e88f63fc5d2a0d77
SHA512 1ee13a0006611eaa62682a2f1d0706f7332c2f344f8c8f6205e826e5045044b126150f1d733e2f96f1121ef936913a1d60b0204e698f89d3e2229ea1c026b1ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\wo\qap`g`v~dtlq
Size 10B
SHA256 1ac729792023cc907dd6f69fc46209147eeba82a77718ae5d1dcbd3a8a944dd6
MD5 404522420c4d1651f70e533d4e4cbb13
SHA1 c107e061f5b8a533ad548be689e7e101e83281a8
SHA512 a4074dbf199607cf83b54c6d2e8dbbdce4537424f9583556712a755c431202c6855d577f0a8eaf3f7286777c2ac26b998e5342ca66220f3717fded7dff7ae09e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\qap`g`v~dtlq
Size 10B
SHA256 87b843cc425c72c157a8833a564ce1d9acbd835503a22492f2342fdfa66cad60
MD5 e7c8fbeef1051031bc236127eb85824f
SHA1 218d58707c8af0856fd2d38a86f11d6d457870a9
SHA512 74d63e23ef6a5a8c0ccacfbd727ad9bbc0d7792552064afa5893b2d13d0fbbda6c79f095af19e6233cba56100d2d1d4fa2bb4c26b963f2ff37112507be6e5424
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22f17ba7cf993ae69cf8a394652d9747e1dc51c3030910d1ec719546d43769fd
MD5 45aa5b8c1bfaf3568000d29b9f25c866
SHA1 1ed0b1089121b6a98a89664ca1470e303b58ec9a
SHA512 8f291f68ccb19ca0d3a058d85060d82a6639251b3eb46601b64813b3f1b93cfe459c20b381771a93f97c65a43d1e5899850b97cb4919ab1f0a7375f2aae5ce85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0b1d67dfec156813587389a951add2a24bc2d3186f6b29fe8305834abe93636
MD5 cc281c00f2757f1a3513cc8d973c2ebe
SHA1 5f89e9b2123845684cd70fe80be6b944017e71e3
SHA512 469fc20f7c314f5430a3ffe30699f51b5e256dde17068751b7bd0dc85c515e164e8d274aaa3fc85230445c5883c6444f07485d83cea4eb742810e2108bcfdf3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c792ffa943e16f537dc37e8bdb42a74218f69083f73f4090e466d3901d68c076
MD5 bc15546b8db60a9a5bb6e47b91023465
SHA1 2ff6fc07854ca394732678818406f05d4e6bea52
SHA512 134d26bb5cd8fd54a1910171d6f16b105da835cc450c63154214d1444660f1f2122d0df6966fed4e355b974dc0961f2ffbc02cab423111ffb94e53e1f2d6152c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1f5177c65ad05a821a56ff8c0eedeb309183fa5233928b7392f578fb9993bdd4
MD5 af210264fd13ba37d9c33e8fef923ef0
SHA1 f9ca1faf76072c750555ab8ad111758c2aeaff85
SHA512 f327cf2a9469f00f77779b5dd1a31d99459d4f32f230c0954a14f78b29814fb681e634d44eb8bbcde3e9293272de07ad2608d7f5ea91d71ce93a27a6ced32918
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 359a9ad6b59b4cc479912d8f2233dd69e48c9b8f9975780a0d3e5238b9cf9576
MD5 4ab1bd3cb9d1d08084d586f5643f4c39
SHA1 42cae5dd35d7c8ee289f7f350cb1ea7251424ffe
SHA512 955dd1352a5e36bba07bf247e6622ef27226d4fe5f6c7ade6b2c9ec9e5426f51d462b02a6a9ceefe497dd9c71e0ef6391bccb159a2d2be7a77d1de17fcc381e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a1ac3b8104278b8f2c781a1a271eec3100e684f63e15c60b22ab833b2968b9b
MD5 21df93bfba7d53ed7a2c85c59b1c3939
SHA1 40b9c3c2af386c4c355b72f4b5a4b8a556ca448b
SHA512 3bffc5fbd5bf57c4bc3672bcf5552451981c294ca37d4951744a9b78672bf9aecc17f01d54a0db0169cab095a189f6be671e8a2fefa790e816b5625871bd42c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d32bb6124bd595bdb8610b0ac40e220b59238aef3d77f16ed0156e8c9c048b37
MD5 a9246a21057cff11213591e1d9272053
SHA1 7a9f00332f8bd9fb6e53f4342149f60404ecd7ed
SHA512 3db0cfb4f109ab6307f4c05f61827785f67a07539837d1af341766b034c514a1cb91e2e0e4c95939194a9b5c58dfa053dba4410ecb9c04d66c8c6807a70155e6
MD5 SHA1 SHA512

Submit Download

svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACBAAAABBBBCBBBCCBBBCBCCABCBCBCBBACBBBCCCAACCBABBAB.exe
Size 5.2MB
SHA256 e490f0cda840269e705ec8346c8d66b86e6c086222756714280a0175eab941bc
MD5 32c8301c6413f2a9a91dea2074835893
SHA1 16a91c8b5c79521b9669ba073c5d6417510b379a
SHA512 d72fc77a77ed6da239af8fe49d8f2914c2de19870ee29aafdabe40fd1df2b65f2558017cf2ab67a26df84fa10fd520ea63606558a58dfa16bc5ac88e1129e5c9
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1Pszd:vBBB4xs6BBB4xsJ
TLSH
T1A1468D11B7D18035F5B329314ABFE339593DB9214F748ACFA3880A2E5E72AD1993471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 974B
SHA256 bb1c934016f62d489db4c7ad183e755d0a428fb84c5b18235236f2863d8ce77f
MD5 a36e04a3c2ed0bbd8ba4d18be3193e30
SHA1 32913e35e37e9739e545fdb92c53a857ae999c7d
SHA512 43e3cc1b6330cd3ddec1c4ea13579b98f8dccce0b6b705abde15ebc7c33e6711cc5cba4005edce158d6d5b20fc82bff5083aadc0db45d37c8252b73c4973baba
TLSH
T1C111E66594B9D893EC33A9CB83199AF20CD8764BBC5C6E401346461DAB88C31CE554F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d88050afd16f740baf40ad6b076f9f496636c070e99aa5170b9f814dc8e64781
MD5 2afa198aeb3bb66afa34750f0cfc2b06
SHA1 83a47125e4285754f2fbb4fdc9dc86ae7a3d2421
SHA512 8e98a6afc65b51ff374cced2ea9a122e3ff87160681a7aa7049aa5d3c9b1abaa55a6c603706caa180140dc68e4bfcef4121e3c0e6cbc7b76be46bd7906c99272
TLSH
T14A21B465A4B8CC93DD33A8CBC215EAF20CD8765BBC5C5E40534A861CABC9C31CD454F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c7b24622fc8f2981093c72536e48030e53f67ad26d3ad7ba4bbac1ffaa4be432
MD5 02e516f9185665726ad27a684e2daeb4
SHA1 2352d8b9c795b463a0618970e311f66841c19428
SHA512 0e7e89face942a96ee88f119a7718df079f6063eb921817f4355a5b46540bf323490b7b79056cf5385630d033169d77354300f71f555f7a119095d1d0c2d35fc
TLSH
T17311E761A4B9D893EC32A9CB8319DAF20CD4764BBC5C6E44134A461DABC9C31CD554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/824-71-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/824-3014-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/848-6-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/1028-35-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/3048-3001-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/4396-59-0x0000000005820000-0x0000000005821000-memory.dmp

Download