4c47a33d4ba6dda9ff186866fae7ebad73ae570e0c417df88c6106ce353e9c00

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
Size 18.2MB
Sample260810-e53mjabj8w
SHA256 4c47a33d4ba6dda9ff186866fae7ebad73ae570e0c417df88c6106ce353e9c00
MD5 85408b4b11159fc9f9d39845f49ee00a
SHA1 8b831dc51f080bfbdc3912f4b0b3936ab532e62e
SHA512 498ea0dd9dbda4cf66f3380b9ea441323ea802d8f45ff684cd30f6c6057c2b5fc026ba8bc4ce70231edb7605f8d479c0700d1c26ad1b39a09b0a203034fe30ef
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Ew:Np7N
TLSH
T1D6175B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
3712	svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
2644	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBAABCABBBCCBBBCBCACBBCACCBABCCACCABBCCBAAABBAABAABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe"	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACCBACCACBBCCCBCCABABBABBCAACBBAACBABCACBBCACCCACAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe"	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1084	sc.exe
4156	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5524	cmd.exe
5712	cmd.exe
2560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
3712	svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
3712	svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
2644	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
2644	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
Token: SeDebugPrivilege	2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
Token: SeDebugPrivilege	3712	svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
Token: SeDebugPrivilege	2644	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 5712	4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe	92
PID 5712 wrote to memory of 1724	5712	cmd.exe	94
PID 2272 wrote to memory of 4748	2272	svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe	95
PID 4192 wrote to memory of 2560	4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe	98
PID 2560 wrote to memory of 1084	2560	cmd.exe	100
PID 4192 wrote to memory of 5524	4192	2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe	101
PID 5524 wrote to memory of 4156	5524	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_85408b4b11159fc9f9d39845f49ee00a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCAACBABCCBABACABBACBBCBAACACCCBBBBCCCCBCCACBAAABBCBBCBACCCBBCCCABCAAACACBABBACABBCBBCCCACCBACBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBCAACBABCCBABACABBACBBCBAACACCCBBBBCCCCBCCACBAAABBCBBCBACCCBBCCCABCAAACACBABBACABBCBBCCCACCBACBBBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe" start= auto displayName= "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe" start= auto displayName= "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCACACCBACACBBBABBBABABABABABABBACCBBCBAABBCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACBCABACCACBABCABBAACCBBBAAACBBABCBBCCCBABBAACCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b22c327477911bf6a35d56f477818d14926720a84c671edac12c979f3563024c
MD5 fe4ec349c62b13e923b8e079d2824c85
SHA1 69b265bae6d3613a6fc0463aaccba7335785c641
SHA512 fba70bfd0c63b31a5f26009a5c8cfc063b81f98e3b24b54c944d3131b0f0dc224223218004d8ee8c747c9cb2fa22c5c2b786b1d454ec119b47b797b5e5f939e4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 4dc0a110f8ae6f55ed55b8e335a0ad2dd6bc1e6332daf70bf2aac1fc4097bec2
MD5 2bede0a9338848359fb98da4e990efad
SHA1 a36a196dcd1995e69c0e33b3d81245773df83707
SHA512 2ca9f7a81ca627ddbb8a2f18a11da0202cadf0eb212aa921990adbe8b66a3497bcb210283920b2cbecde2f2ac926063df560acb9a6b4dd9e81911a04a3f801f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 092218d4112307498328f382acb6488915bc008e76e8ede98a1725a9409a7b8f
MD5 038b2373cca02440f593e2f4e886490b
SHA1 632272fd1e4a9a9842d733b998093898fe10092d
SHA512 149d0733a6277652ac33cc6d00014f183e9fdd57be0fd306fb57a47e8bc78860ef99dab73692a3b4c4221c71cb43a9b5f2cb565c11515c3c25ff0c81a99ffe00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WinMSIPC\qap`g`v~dtlq
Size 10B
SHA256 299a99e78b6621cd6cb47f79ea32a0f763dff6b98d3e5bcf3fd846770ff3baee
MD5 d2dc59c4687c3d8a44d36a80762b77de
SHA1 5de3bb6e79457c0757bfc73b3cbcb3209d7722e7
SHA512 a5a40c62aa7703b79893e6b27ccb18969b0dd3315059e559633ac9b19f4f4b27c67c9406d9d9c8d4c5a4541d5e9298ba8ad10353c4b8df8c8a0737b3a183fcf8
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 18.8MB
SHA256 fc711946e513dc287c0496b161aa4c690ad5e0f6e26785a99c0f1f7c6659f4bc
MD5 ab9f371585b52514c05f0a900cb3dba9
SHA1 8ad61b673dc11d0a6f298ff493b7fbfb987936f6
SHA512 c2bed87643f56d7dd27108433990639a10f92b52b3bd6da1127a49ba02478bdf525265cda8d26a8ce33eab412d3cfe3614149589a15e313cec34273b67c08dea
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Em:Np78gZ2Hb9t+2xS
TLSH
T1A2175C09F94340B1D92B10B04DCBD2BF8A70BB2587128DF7FA8DDB1B7932BA16439655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 82f87e4ca6a31d818e0cc32990bfc64b504f95c92c99620573482242fc427b1e
MD5 7cbf1b2816a5ee44be5af1a8d1d3b5cc
SHA1 221bd42d29e33804bdb6db735580a7aa11fc3598
SHA512 80fcb1505a4f3fa45c796b02987fd4a3fd41777c2d00c0897b7b1a602b1d2464a758463a47d3560afa6896e78b713df3fa8fa5a28d929686d27d595bb068dd97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\am\qap`g`v~dtlq
Size 10B
SHA256 1ec57438f549d4baf1fa0cc6eaae0391824da1e03fe140bd808393857bc3562e
MD5 f62aedbb57d570b73f21dcea58d204a2
SHA1 17c7bc5d635c1f9b35f20db8f3e200d93b7be2ca
SHA512 78e78e221382e37a022114be59eea68569f7bd6bbca9143c4bfe7c403a369ef6d40e7bf8d523295330e5b2f53b3dc0f70d6dbdb174d4f0ad31dabc37d80dc904
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tk-TM\qap`g`v~dtlq
Size 10B
SHA256 f30cc6ce5c462e9b047e292ea57676d7fe8455f0fee832aaeb413373cd6cafe2
MD5 7e1ab6643a890955520b0ba98f0d6ee3
SHA1 9a4b7d26904591cf0c4fb28ee117cd82ddb3da19
SHA512 38f853c4edc5df4c35245b8d97191b6a244b34eff11cc5f98da7933aac57a7287e345b83a66ee47ae0bcf0cc927079bd50453caf3aca27344b01ea4d557ba397
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e617b62a3e9af84d0ec648fda7f494c8148c04e37447f9ac221c8944f286fd3e
MD5 d72594fb5dd85e6689fb71522379af4c
SHA1 552bde632e005c5f591983c3921cd1b9d66c4c06
SHA512 33a8a639314915faddbe4f7e963a5b40486a66804a398a6742cb57512cc962763642b3971d1d808ebddd12242aef57d3c87d737b895e045839b7bcf81361c0ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b7715065e431d89108aec22010fdd3bc3744d8111f31f7c0276d7e9775a6f57
MD5 88649b1f4b0ff6e1268c85e7a24fae1b
SHA1 137deacdd4d794e6eceb2ee7651a5fe20410ec72
SHA512 4f1ab391d90af452ffe4f6ecf2f90fac7355495302d7f4e1ac2f63cd1f002f5a474e88673098df22f0903b14c355b4badb4dbc8e13767dd42ad11f58ab48c22e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db76e9e12350aff455a070faba9befdfb4325a11df174a85ba0cdd071f5fc6d5
MD5 cb5e8c3c677ac669455cbfe3909a20dc
SHA1 ca68244663d8f9db99e551170efda6b5d653f142
SHA512 3883e856a358a408ea89508fd2c49a9c8489790624cae764915bd140bc7d1bc90281821573794f38dde91e99cb8b99135e203e65292dd3495f52ebd929291e19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 564526ff5fb02655a8a9527c61847c4707d85012058284b0c3bb18b2d0230807
MD5 456c06eef739e96f315ae098f8ed6bf5
SHA1 11317a2c788307017171bfa91ec01d9c3873da10
SHA512 b2ef0f3034747375a71968715aa6914dedd10dee62e5ef1701f5f60ca61364feb8de6120693cfafa47a5685439125ae5194d1b4f52387144cea9305514afc20e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 abf1d9b817a60b04597e73a3758994a8f0126e8778ef9ce92b19d99c5691e411
MD5 e3781452e616856c308c1b7b909d883f
SHA1 644c6ba2d8775762e78c20176e1b1327c70675dc
SHA512 10ee891bcd2949a983dda76e0c5b42621ff6163254dea1784d075a59702d566b2d9ab3b5578dce83b85b8437e21439579b976538767b22ef74fe72aa271e4140
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c889e6752402ce288ed9ef955b21ea72dafdde857dc6dce2f70d2bb93a7d26a1
MD5 4f98e3f62c8726ce3c2c905327fea137
SHA1 41c71d3b94823be20f1550f5ecf23831148e709b
SHA512 d93ec34fc18e3b6fabd9f8bbe87fcd72cfea0edb89195716b96367655923c014e9388f196db1ceef63537f81a2e68fe096558521c9bed7118260d32a2b4287c7
MD5 SHA1 SHA512

Submit Download

svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCACBACAACACCBAACABCCACAACCACABCABCABBAACBABCBCCBC.exe
Size 18.2MB
SHA256 4c47a33d4ba6dda9ff186866fae7ebad73ae570e0c417df88c6106ce353e9c00
MD5 85408b4b11159fc9f9d39845f49ee00a
SHA1 8b831dc51f080bfbdc3912f4b0b3936ab532e62e
SHA512 498ea0dd9dbda4cf66f3380b9ea441323ea802d8f45ff684cd30f6c6057c2b5fc026ba8bc4ce70231edb7605f8d479c0700d1c26ad1b39a09b0a203034fe30ef
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+Ew:Np7N
TLSH
T1D6175B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d1e41b6f446175415c0c1d329c75c82319f2a689d2bd5996a0cd8d8ee1f6d281
MD5 b97f6d1e36b24b6c88c09ffc0eb6ec74
SHA1 291c018347ae2aa8663e908e294dabc9e8efb99b
SHA512 ffb018fce688a1a7d304d52ec23b7d504bc6ea9b35e3ac8218a4d0d098272635b56c01969e302e60a821b9d015eab3c22b4cb9f36f402a202b5255753f3fd694
TLSH
T19111EB50E8E9D833FE3128DBA92EDF6318F4378BBD5CAA14520941187B65D31CD950E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8794017623e1d27b36586b52c6b8e0825ea7f33575d7670f33185cf10f1f3761
MD5 1c6a8a5d66dfee3c2952794d8aa3d2f8
SHA1 e0298514f342eace4705f3d41f3e02b2e9ba19ec
SHA512 9853f8d14c05aeeb5ddb922da4547f00b764005922252ff76bb00ef05dae284fdfc37e4888cf3b6a5c76df8c1d42e9f394f3eb29838e8aaa61760ce8b1fcdb01
TLSH
T17121C650A8E9C873FE3228DBA92FDB6318F4378BFD5CAA14520D41197B65D31CE950E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2272-33-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/2272-23-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/2644-935-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3712-78-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/4192-0-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/4192-7-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download