51baed3c12322f1b0440761b541647acb4004c0d86ed965cfe7d2cb494a89de5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
Size 23.4MB
Sample260810-ed5b2sdh69
SHA256 51baed3c12322f1b0440761b541647acb4004c0d86ed965cfe7d2cb494a89de5
MD5 e47addeaad52732f9c74bf42037e095d
SHA1 f3e788489d249ea6edd7ec65a011a06eed113eff
SHA512 b718051f2aa1cd21fd0fbeabab14688217752cec9a08b6d141de23cce9b144badac04baa68d53b6e475f4024cff2dcf768768e98e1f75e7f10f81619106d272b
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLk:Yp7Q
TLSH
T161374B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
1420	svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
1028	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACACBAAACCCBCCCAABAAACBBBBAABABCCCABCCCAABCBCBBCBACAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe"	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABAACBAAABBABCBACCBBAABCCCCACBCCABCCBCCACBACABBACCCBBAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe"	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1664	sc.exe
3180	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2088	cmd.exe
3224	cmd.exe
2464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
1420	svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
1420	svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
1028	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
1028	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
Token: SeDebugPrivilege	3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
Token: SeDebugPrivilege	1420	svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
Token: SeDebugPrivilege	1028	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3376	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2088	4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe	107
PID 2088 wrote to memory of 1968	2088	cmd.exe	109
PID 3256 wrote to memory of 4104	3256	svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe	110
PID 4104 wrote to memory of 4360	4104	notepad.exe	111
PID 4836 wrote to memory of 3224	4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe	115
PID 3224 wrote to memory of 1664	3224	cmd.exe	117
PID 4836 wrote to memory of 2464	4836	2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe	118
PID 2464 wrote to memory of 3180	2464	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e47addeaad52732f9c74bf42037e095d_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBBCBBCACBBACABCBABCBCCBBCAACABCBBAACBACBCAABBCCBACABCCAABBABABACBCAABBCBCAACAACBACBCACCCBCAABABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAABBBCBBCACBBACABCBABCBCCBBCAACABCBBAACBACBCAABBCCBACABCCAABBABABACBCAABBCBCAACAACBACBCACCCBCAABABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe" start= auto displayName= "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe" start= auto displayName= "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBBBABBBCCCAAABACBCBCABBBBCCCCABCCCAAACABBBCCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4360

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACACBACBCBCBACBACBABACBBAABBCCBCBAAACACCABCBBCCCAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 688e178203fe21bcbe6dc388ad72ebed2077ddeeaffab346d9f0fa29902b6c88
MD5 2937a5893c1967f0f44a1f110a80627e
SHA1 ee7a9e047ba8e6c5567f17e04a57453d66e4fde3
SHA512 741034174eb33595a8dabcd3e07feb599a41e70cd503c1efa85ebb7d0319bdb4e4ef4c67236a443c6e2523c06276bf71098ffcf8015e4d6efbadb8fb929cacaa
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 23.8MB
SHA256 51030d4cd3a9dc5c169a0fd6414793ec2a2d264115d888562f65856f436b10e0
MD5 834dcddd31af6a99454aeff782e64e44
SHA1 a831d0eaa53d230be4df333ba2520d8408250139
SHA512 b2b8061055947bff53cd88511d43d31b0d2b60415e7eb624ef7c4c2a2548bb7860ef98ab52d4d8fd2a0a084bdf84b7e39ad7c4d9dbf32d23e2a2a8d2af205d47
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLB:Yp7Tpi2
TLSH
T180475C09F94340B1D92B11B04DCBD2BF8A70BE2587128EE7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 faaeff0cb00d31227c10d7724a2f0164bce1dc991478dd831effebb59f66cba7
MD5 cccf375bd8be5adf34a4e0abd52db432
SHA1 03c0a6ba2eb1c6e2c99ada72a60d51c2807ba955
SHA512 a43786237eccaca88c10636a7d96040393129f5544d70d33cd0dc4821cebcbef6594c9e2842f36781b28022571730acb000f65dbeaa84c2bc5bbef0bbfd64528
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\qap`g`v~dtlq
Size 10B
SHA256 94a5079656a148078ecf3bcdc6750f28daada70461a5fe60ec6fb6c1c9c196d3
MD5 d4598c7873edbb05e4c53ca881947696
SHA1 984aeea01c68613ccd15df14979227d5cc0fd7a4
SHA512 ebd66dbf2e5eac6dacc7634eae17c66ca47950abda9cdc0d6f9d96303f948f69cf9fa84b667a3a4b26f733c6f9e43a5a1ebb5c70ca8ba41ab25944dadbbcb385
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 568988f8bab68fdbd2023ad916d67ef3d96c6bd6ca4ff538a45dcfa8adef9abd
MD5 d9e50f3052b9bc3257870715c484d461
SHA1 574d6cc4799cfba8c03fd590970144f5139ed9cc
SHA512 4c11edd123f404a2b50beccdb61a817c14c26aa8dc52e39ef7207b87c242021b9f12a6c46a55598edd2bf0a5ac97b692d6d494c4e3d53567a416eace9e5abffb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 d0da338600c5285828261318b56484896513ba72ad2c0a0f738462c6ac739bf0
MD5 49f51131be3eb91ef0ecc9fb06632b53
SHA1 7e767757ad849822bb420084b2babaab45141594
SHA512 5c29b22dfe4a9982007380446fc968a1612455338ffa82cdbc35c34cbd327368ef9a26d3da092c73eb948ae8bd56f0d545446061f0deb9ef625d3e73c16424b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\qap`g`v~dtlq
Size 10B
SHA256 579eb9d23728659f706b603e996b6373afd6d0a6476c22a6b8ae6b05e4ea6ed9
MD5 ed4d3843dc630a51e105b18247c35f92
SHA1 149aea491a0d8a8a19a173611b13af3d83571fff
SHA512 7795a5657cc01d09c5bd94dc0a30319bccb372a8f6ca7cfe4f253627df70b953e7d9ad4062195a5cc76b929251ffa052bf8da951b2e47a76a550738e905686a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 428ce06351185ea7e974f8d38b4b78d4b1efdee2a582fa02ff27ff808573c3ec
MD5 a23bc43e6c1054b6eb886387015b3926
SHA1 4714e9e918f25cc22a6f360a04e02d92308fe946
SHA512 f7c3399848d55a1712a2310076421816204f0db19768cb46b30865513ed950af091fbd737fe6ed5cb19392188d477a56e16349196e86b42edbf27178daaffd41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\qap`g`v~dtlq
Size 10B
SHA256 c973c892d1a6dca86b6805506ce3e59a0678d5c4b6e2feaa4bd882e689e1cfd2
MD5 3e78579341c4e35de9cf157fefe1b478
SHA1 6408046bc5500d29f1c413cfe5d10392d4d0ea3d
SHA512 ed124d494bf0d3cdcfb3ccf369da875fa95648a14bf39beecedf1e4ffa386efee72ae713e105281e2288701c97b98ad915a28426d90a66760869b635be8867b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f064b6f977a1c6b14c66105906eb008933c1ce08ba1e835eb6524218e66773bb
MD5 79e2f8a2e364cf8aea3ab61ccdce7702
SHA1 fd3d9fb3a469b5c98777b2c59415fee8e7553876
SHA512 bede63049f162e9e75b199b99ef39b13c3310922814fbc0215c4d12988036885b3498562342122335cac64d8ec39da4b9371a71ac0d18972759d134b19cc54ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 75b7acec35d47b443eea017a58dd0f41f3cf463dcea789e07b446a61555cf94a
MD5 656e8c7977c695ed0d1626e951fec796
SHA1 f043973f38ff963ad5695e1bb08129a4cb24c28e
SHA512 7a42c7b48d85c4d5195be00e9cd1e9f4cb2ffa434271afe0f21e47210140d8df9afff4c587448606fd608c5e5ee66933e64d3d1acba8665e8838a7fa32f4d86b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6dfcf372fdef1cd023a65098865710c5fafc139abf9aeaf5d38809063f508281
MD5 9d6c9e13d0889d5db20dd6f79bb718ef
SHA1 d3d8aef9ae73011d05d559b2f678f188ac26712a
SHA512 0cef9c2041a40b27ccfc2d823abbbba902d50f97e1e148f36d8206875c408b66e441b04309bde5f383674bf6c23794c10d3cc5a8349c58acda51affb6078be9f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 74a145ef7645055a58c52b828dc2a9335ac07d268529cab84d9d42a41122e019
MD5 30ec634f73c0bd46a9bddc0337bf4446
SHA1 f003389dc75e01eaa6bf3396079e2a8f2673026c
SHA512 5f4e635149e2104f4a61336cf7ed89530714529628c840719ccc5007c6a5ac0cd10754d3dcb328fcd49c89fd256cb754bbd998144a4b1815c67fa9fcb219a260
MD5 SHA1 SHA512

Submit Download

svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBCABBBABBBACBBACBACCCCABCBABAABBACBCCABCBCAACCA.exe
Size 23.4MB
SHA256 51baed3c12322f1b0440761b541647acb4004c0d86ed965cfe7d2cb494a89de5
MD5 e47addeaad52732f9c74bf42037e095d
SHA1 f3e788489d249ea6edd7ec65a011a06eed113eff
SHA512 b718051f2aa1cd21fd0fbeabab14688217752cec9a08b6d141de23cce9b144badac04baa68d53b6e475f4024cff2dcf768768e98e1f75e7f10f81619106d272b
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLk:Yp7Q
TLSH
T161374B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 2a84bcd656fdcb48670abc00f333b12c995539e209a5f4ec0fa4b9ecc96c54af
MD5 cac117c832270f264d86f4606cf69c93
SHA1 72dda7032e63c018263538d96429fe67974680b9
SHA512 3985ef84f81b0f37e82f798b872bf8353dd62cd8ddd00f5cc1983b9e5194808a10bcb7a4413cb76fae3b87899bfda0270bb64d750198c470ad216d7fadc0afbe
TLSH
T19B110D90F4E99C63EC2229CB831B5BD20CE836877C5C6A64134C891DBB4CC32CD55CD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 01bae9592076fee77fbd993a6f8e612ff65164327366e2503bae85c9e7930f2f
MD5 ecce43dbeb37fefb15ab516d4da3fbd9
SHA1 26429dd00e3face873a8c622797793cee9079ac1
SHA512 1a69ac18051f4a6b31d0ba45f9a7fb4e761d1b7af5333c2032d21e42d9a596e26f051b2f35877a86f28d618cd38d1dd59ea87f73f6275506b8d8610925c40265
TLSH
T11E21CC90F4E99C63EC2229CB871B9BD20CA8364BBC5C6A64134D891DBB4DC32CE558D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-880-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/1420-86-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/3256-34-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4104-58-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/4836-0-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4836-7-0x0000000000910000-0x0000000000931000-memory.dmp

Download