b28db106b13e7396bd85141445d0286402f7d6bf7834df1e93326a6c44c739a1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
Size 18.6MB
Sample260810-e7wl1a1ejg
SHA256 b28db106b13e7396bd85141445d0286402f7d6bf7834df1e93326a6c44c739a1
MD5 80470a31801e8aaeb2b8f6022335aa85
SHA1 7b18b2421ed614150f2c3bc8ef0b767ebc919569
SHA512 b5f826b4ed4f4812d349de93dc825d144b04802fd5a580377dfa40676b4d4a185f0db52a761241586cab7d7664cdb128a4e4958e472d89bcb2e8a01b6b888e52
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EX:hp7S
TLSH
T160174B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
3768	svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe
4156	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCACCAACBAABABACBBCBABCCCBCBBAAAACCBACBBCBBBBBBCCCCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe"	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABABBCACAAABBCACACCBBCCCBAAAAACAABCAACACAABBAACBBACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe"	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3784	sc.exe
2792	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2216	cmd.exe
2884	cmd.exe
4228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
4156	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
4156	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
3768	svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe
3768	svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
Token: SeDebugPrivilege	1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
Token: SeDebugPrivilege	4156	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
Token: SeDebugPrivilege	3768	svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4012	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2216	1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe	94
PID 2216 wrote to memory of 736	2216	cmd.exe	96
PID 1320 wrote to memory of 960	1320	svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe	99
PID 960 wrote to memory of 2128	960	notepad.exe	100
PID 1568 wrote to memory of 2884	1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe	104
PID 2884 wrote to memory of 3784	2884	cmd.exe	106
PID 1568 wrote to memory of 4228	1568	2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe	107
PID 4228 wrote to memory of 2792	4228	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_80470a31801e8aaeb2b8f6022335aa85_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBAACACBACABABACCCCBCBBBCBBACBBCACCBCACCABCACCACCACCBCCAACBABCAAAAABBCCCCBBACBBBAAABCACACACBCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBAACACBACABABACCCCBCBBBCBBACBBCACCBCACCABCACCACCACCBCCAACBABCAAAAABBCCCCBBACBBBAAABCACACACBCCCACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe" start= auto displayName= "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe" start= auto displayName= "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCACABACBBABBBCCBBBBCCCABBBAACACABACABACAACBBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCACBAABCCCBBBACAABBAABCAAAABBCAAAACBCCAAABCBACBCCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f08a3c6e89672c289925e80c1d3e2935bef6ba542c08fad7d7fc528370692869
MD5 27180859aa1ce4a01c4ab2f2f714bc08
SHA1 7cd6779be884b07bef5faa6dfcddf33ffdc1141d
SHA512 44faa678eb59a5167ee26947c18d95b4acf599a1590e61cde0614207bb56e27d5715c8a8ea0eeb7e26ea95c437cec88f82efb880596aaea93f3c113b6b4c65b7
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 19.1MB
SHA256 ab059b623d9f56fd54de9ff656aaa7339a7fb4e87179eac2657d44aac9b34339
MD5 3e74a5f54abd88648fe14cbcd33a1ca2
SHA1 794f79a629fd784e82e2d7d47335019d5f250ada
SHA512 a6931356487503963126ed7e55afd083d75db10be997e55330e3e2f28c38afae664c8c49b44fc7d2f96bbf43b55ba34bc22959532c59df82968784d2e1054169
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EN:hp7NpiL
TLSH
T113176C09F94340B1D92B10B04DDBD2BF8A70BE2587128EE7FA8DDB1B7933BA16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 c99e2eed387c3337e3f37fa597ef445a8648343c7585ebd8f6757f173b9568f0
MD5 e626a8b44d047c6ab9f2a6d3f75a24e7
SHA1 69f1935f5eb9c6bd3d67bae2af4ee485609a8bf4
SHA512 b9dd2463fa03fca9b2912b8fec0357859d7656aa7aa1294d6fe2c517e431982dc3212831b9fb5147aac0eddffc448e5bccee3aaadc64d45d52a2423fea24268a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\qap`g`v~dtlq
Size 10B
SHA256 645b8fffb8a0cea3bb92366716eb66758b672753794da165703653d6b8161231
MD5 0a52728700660774302ea1057e59444b
SHA1 a6dd5284b7c5a1cb99be1783f4d337c23d31a1ac
SHA512 fad047b6f7c3ec42ce7fe927be3c724874e05e7b466aced44974db5018484f2f4b911dbe23c189f3dc6252f1362d1547de0bfc43bdcf388250c7463427ea0480
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 72781f003e422d9db11dcc91b2880cfff5a25bb082b6223ec77b3a13d5156c7a
MD5 553b84e88c3e4edaff46124a6434e5f5
SHA1 74f17aa7a4e71f405c6b2bc7d2c369e478558002
SHA512 82e7c7673552fdb478fdd5035f6c0b27f1caa95d0ffffe98d9063bc50588cec255584fccb7d362fae2b0207df0cedc03adcccbeba4edd20a9dac839db90cc24d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 cf6b932d0566984ab87fce09c5b2a304fa4bf952131ed6ac8fdfbd0edd8ae030
MD5 837bca67ffd60e3bef6f8d75f725a225
SHA1 877b797496efd15c2db3157279bd5708a896dd80
SHA512 c019885edbc826e3e118c9ddef555fce4cbaf8abe3f95c652558acad70e15ef496e466f1644f72e5e3690a63a32fef324e1e1ce1a0ff29e12dcfcbad1553d601
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 54d046d3649fa1b4153b0e197dfc06bb16b404992b4597c17c58b00071adb89a
MD5 16b6b0a7fd41f0d7f85edf7ca6594216
SHA1 f3ebb7e5c3b20555d9a1a43535bf2e8fae23eb9d
SHA512 92339fd22ac5efc050c12dbc8869393b5f2d35ba66944ec391d1187686b30ca3d3da8a551b439e88dc8c71e11aeb741f7e2f662e56621ffc814ff215374b219b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 c19e72285a88ff9e4178b443cfb0efd526609728488aff392e4ef1123943a5c7
MD5 1ce05051cb24b34c47344a3408eb48da
SHA1 8b744eef9fba596c9e31ddad94d455663a5699b4
SHA512 397bba5597e0d3739f8063e1875caa52d51c21029150b11ef256f3597868a05cbef8ee0afd142a5ee414cbe9df19893ca664e6a4afeb28fcabc25843185e1abd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 b8e24cc6f6bf35efbd47cf6cc84f891ea2b300bc9b892c4b62525d4f679908bf
MD5 0629c4044114b533c03ea9c88c276c8a
SHA1 3aacea856c839b2443ebb302e18f8f2d6cf78d2d
SHA512 ab5808c4c993f3e76c52063da5bc54e32904bc52bae171395fcb90b5d967494267c64b3f43383e07a259a5498d116f93ca266137c5eee9f59b6cabf5896e96f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\AssertBlock\qap`g`v~dtlq
Size 10B
SHA256 66b9950cac2cf29879c3fac1d15f8ce6c1bca1ddd07a204b89c286e6b9e06cfd
MD5 7a595d7cc5ceb7d6385540996e6f776c
SHA1 7993c6fdf75e3420ade7144e82f2ec8ea1e7480f
SHA512 fbbd2690f92f8f364a886f01c09208b7384bae266cd60b11a6ef426275e8c766f14da47f1393ac4fa1802d569a4b7e9375d9d6d5159b5a1dc4fb058e3a68206b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e862421db72ccd2475275e9d255a82301c70ee8331a96d3f8580257d9903f290
MD5 bf496e08452e3ff1eeba90a78215cadb
SHA1 395a85a16b442efe16409ca62fdc414f055f53a1
SHA512 4dab826318074d42120cafc2cc6efd1931d9a3215f92ce03335b98f2c0b63fcd449ca493d937c40cccf7b0604321aa97c7ee70c1390b8c7a52fd4f6dc9eb1238
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6cc89308a477c5025b086e9cedc91f2c652e44685c1a0c221ad246d88fde190
MD5 538f063385f2f5c7a667c7354f21d58d
SHA1 fba4124c9c773c2a5ac2d4998434a62c924a5077
SHA512 8a59ddf986504574d84ee72945f595e3207b027a3d360ebad6a42edee0f9cabca32ae2772eb3ba3f00d9b053f17908a0b65cec9135b1c7ce6f12e7faa09fe0a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfa8dbc27ae8a35e6bb00fb8a3e2cd1031e13a6e1d66da54a4ee7c648d037712
MD5 2112f0ebee883a38092aa351f14100cf
SHA1 aa60dc4d9aeb69c4240fece379692a42be2ec08f
SHA512 a9af5c1d9c0a8af98c87300d0c7b2c04cbda007dba1dddcf39fc0a35b4154cb06e6219699b413dada49ebc8821ca4cc447b835be91e190a74143299944f9b3ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcc49da4f2baf152fb57c69ac4b691d7a0aba8d01fd00da09fa7c47320ffadec
MD5 c954857f0739ca62ce65f85d58d2357c
SHA1 5a8b963456ec3b937d679c59ee8a02519ebba05b
SHA512 58c644317d7250b6ed6e2d691af6e43e96803c7d781c1f5bf4a02aa5600ad93c4b18929c91aa36983276d390c1942f5f04edd8637013983e24d07b6e6d7951ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 877bbda959041f999475b3094615c0dc846e74b9c3109dd6c1dd6e257b6d21b6
MD5 a2d7ccdc3c74e4e685ab1611e19e49e5
SHA1 5195b8005f1dcfd459c93ebe00c4d093d3a4aef7
SHA512 65839fa6404176a30cfe95cbfb04d50243fe0b818e42d4d5c67bd9af7f7df758337d49f231779da12274e478849312d253e750cf7cb3668b0f4f2e34f5c5ce63
MD5 SHA1 SHA512

Submit Download

svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCCAACABBBCBABCAABAABBBAACBBACBBCBBCABAAAABCABBBCCCCB.exe
Size 18.6MB
SHA256 b28db106b13e7396bd85141445d0286402f7d6bf7834df1e93326a6c44c739a1
MD5 80470a31801e8aaeb2b8f6022335aa85
SHA1 7b18b2421ed614150f2c3bc8ef0b767ebc919569
SHA512 b5f826b4ed4f4812d349de93dc825d144b04802fd5a580377dfa40676b4d4a185f0db52a761241586cab7d7664cdb128a4e4958e472d89bcb2e8a01b6b888e52
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+EX:hp7S
TLSH
T160174B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c01f586be9fa9a5325a90aa9d2c05b790e2a9092e5c40126184f7178b1e53d64
MD5 b6f2f17feb094019f2fec1d5f556bd1f
SHA1 5bb3f80d774b039756573674a762104bf26e7bcc
SHA512 f1e2e2bcc7025b8bd69f60705b84e7334a97448e7c1220b89eb14b0ba94681ebfa31e5a325ce0013bcbbae279dc839184e6819611042842fd5b34f91d32cbee8
TLSH
T16F21DA91ACE9CC23A92378C7922ADAF30CE427DB785C9A1053054119AFD5D30DD898F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 57f7d1bfc5082132debd59853e28c6bfe26b6d7c3ffc4dfd24cb7a042c7eba2c
MD5 4944a254a74e2c78c43e954b3716faf1
SHA1 88b5c16a5bea2d11271fa3f9d233651e885c3610
SHA512 321e537fa643cedb890fc00334662434435133cb88ee97a3516c09505354b1d6e316dc7b51df742b61197405f3906f1997ea9d603aba327f91210cb1bbd1100b
TLSH
T18411EB61ACE9DC23AA3378C7922ADAF30CE427DB795C9A1453054118EFD5D30DD994F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-58-0x00000000022D0000-0x00000000022D1000-memory.dmp

Download

memory/1320-36-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1320-26-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/1568-6-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3768-77-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4156-79-0x0000000000800000-0x0000000000821000-memory.dmp

Download