e05d83495d4bf692f4713f2a2ae0b7ab32be69fe83e22f10fa4700de4b4dfe9a

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
Size 2.4MB
Sample260814-ddsgtabl9x
SHA256 e05d83495d4bf692f4713f2a2ae0b7ab32be69fe83e22f10fa4700de4b4dfe9a
MD5 e82172909c8de288be61448be612010a
SHA1 a779adcb22c6160e971c3ffd2887154feb1e4f46
SHA512 63d0c3575ddfa66ae30789a6099c76f153831e7f53a9436633cdbc47947e05a1a12530639b16112662afc72ace7666bb884187cfeffd1663917d0e31a21757e9
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E98Dd79WCK:fp7I
TLSH
T131C54A05FACA40B5F47742704DBBD2BA9530BE258B12C9EFF649971E6832BD09D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
3744	svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
2128	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACBCBBBBCCCCBBBBABBACAACBBACBCCBBABCABAACCCCACAACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe"	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCACBBACBCCCACCABBBACBCCBBAABCABCACAACAABABBACAABBAABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe"	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3096	sc.exe
2908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1584	cmd.exe
4776	cmd.exe
3392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
3744	svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
3744	svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
2128	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
2128	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
Token: SeDebugPrivilege	2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
Token: SeDebugPrivilege	3744	svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
Token: SeDebugPrivilege	2128	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 1584	3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe	99
PID 1584 wrote to memory of 4944	1584	cmd.exe	101
PID 2364 wrote to memory of 1216	2364	svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe	103
PID 1216 wrote to memory of 3872	1216	notepad.exe	104
PID 3900 wrote to memory of 4776	3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe	108
PID 4776 wrote to memory of 3096	4776	cmd.exe	110
PID 3900 wrote to memory of 3392	3900	2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe	111
PID 3392 wrote to memory of 2908	3392	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e82172909c8de288be61448be612010a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAABAACBACBCBCCBCACABBABCBACCACACCCBCBBCBACACACAAABBAABCAACACBBBBABAAABCBABBCCCACABCABBACBBBBBCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAAABAACBACBCBCCBCACABBABCBACCACACCCBCBBCBACACACAAABBAABCAACACBBBBABAAABCBABBCCCACABCABBACBBBBBCCCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe" start= auto displayName= "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCAAABBCAAACAABAACBBCACBACBACABACBCAAABBBCCCBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCBBCCACCCBCCABAACBABABCBCACABBCBACCBCABACACBCACCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bda52a67cf636ddf3a622be53e4c1e7e8d30b6b460b90b8cafec2ba5c78f7425
MD5 84875aa275ac92574ff0c8e02a048eac
SHA1 5cc0a431b2e6c6679fb8f436e7addbb2818b4089
SHA512 1998c9a374d2b037ce5d2cdea9dd43dfa652f610b0cd9cb4b39a8ba6350c2d84dcf9eccd11a3344296694ebc0a0f812a1bc21c6516ca5d58b613262d2bc77e3e
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.8MB
SHA256 2689b1ab9d10b92bd3ebc371539a6dcaa7e2a261019a7598e9a25c18d1c5b316
MD5 b44cc9d5e7f3534cbc97260a8cf1e416
SHA1 f4437e2c311970a82259ce9ee2bca9f83cb6bf51
SHA512 0f063db382977cf96638fdad25a1ba879ea0054604ac4566966c647fe21b375338c1e5155c106335669edad87a4e49353c22649f2045c0e7736377fff9385ada
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E98Dd79WClXpiMH:fp7LpiE
TLSH
T1ECD53901FADA4075F5B356704DBBD27A9934BE218B22C9EFF248971E5832BD09D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\TimeTravelDebuggingStorage\qap`g`v~dtlq
Size 10B
SHA256 3d3bc9321cc5eb22bfab2634634d974c69a03265f8486d4659ccdfbaed284032
MD5 22c56a88780882c555274a224f0b6ed5
SHA1 27047fe98fd250989feebac15201e8d6cea67781
SHA512 e3848c8960d33e3e301d645eef67255aecf43723ae32d4af87b8f0510a241d9c933c6fcaabc68a6cf614f2358fe305fd2e278ea75e4ea400ea3c6d69a44cff37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 3ea5cb67f94d86a1b23dc0c1b696dcee558e9384077a588d689cd71d29f34083
MD5 d5d58f716ba95f1d2a002f52e9bc5183
SHA1 293b56a012084c5a9b4d5eb80631ed6661722d8f
SHA512 ab00ff3034c1c54acda05505cd945280f41a4302c9c486f1776666ea7e4d995f23b0b95b4f9873b3b2986da441875d13ed7d19ebd46899d08995dc5c75ee5a8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\AppData\qap`g`v~dtlq
Size 10B
SHA256 da34ab2541562f42d9a299275a10f3faf74b5c34e1dbcb9cf477b3ba5e78d6e5
MD5 3496daad94cd096dd7745beca04a02fb
SHA1 e6ab19508184a9a1eba439155a277b846baa7aa4
SHA512 67fe53830dda4fc0d8c3b421bff0abe9e04669309fba2834b6f652aa02870f288a10e88dccbc2f530419937ae0d9bf5aab8f604af8c59041493e4e4baf133793
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Adobe\qap`g`v~dtlq
Size 10B
SHA256 88f610a74a48fa38900414f2c004e24b2c68690135a563d7868d1f35fa953d86
MD5 18e3c0dbeed869b628ff032f455258ee
SHA1 01fb5edcb134758d67b9b0abdcb41b0723ab4836
SHA512 25794261b92ecd8b3c774376a853a38fed01a60d76eae456cc30cf0d9266bee5db6c01e4bb9cf1a2a57a46a32174d8cf168beb25ba6e22809515295a9388d828
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7687bf035de3dd28fce4ee1b72996449d5c89aeb1f44a5fd3c9175b0e6d3c333
MD5 b19974317d11d0e01cebd74532485a6a
SHA1 afd687e93fe0af6c987791a1ae44057d23d64df9
SHA512 e2a077dd776d97a0e14678b89f2b413258c41e69bdb571d54324e452bcb7b18855a9cc8ccaa8f8ef53a53118ce2ce17746115c74407e343750abf5690943f39d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36f996d16b40efc35c2bbc955628e954914fd5c1e2ddd9837fa0be5bf35e63dd
MD5 97840c67d5ebc30e8b0483e10ab97b26
SHA1 bf0a8083d9205d594fd6aae2cd88adb814af3544
SHA512 a2d027e11ee561ed42f8521d33fe0b386b90673c596acc8e06d410d7f9bd93e2996f6096fcf6655afd70094bd07dd7a670b4c06e64fe8aa48265af617a942c55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33d526ddbdc758b862117234aceeae5cdea3e9c225d8f47643cc47b00cb9dc44
MD5 8534af9ff23cc3092779f8d97d692938
SHA1 04c20367d180f7db646f249d3563fe7a075ceb09
SHA512 3586d851ac8a8ecbcca24bfd941448bc89b368fa5a48e169eb023ab2b1b62f2cc61154f777c19a50b1891ffec0f786e665cd3c03d38f36b976cb4cab342398fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 65648adb55f166d0a5d7fac2ba79780d9473d4da7bfc47261fdac5d587194e69
MD5 d17c0ec374ecae646db7348190494333
SHA1 ffebbff65784b37da1d86c6714d6f22f9f9ad540
SHA512 4e6b48aac610a6a5e327ec41cff8ce4a93f079d0de72adfd3f5c8889a8169f9e684d3237e546d44985590d22128ea2e6896dd8ec8bfbc672df31658c4e165f9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c8a2a80f5695803575e905ccb9c0107d74d38fca6bdbc373eca475a9d10bbbd
MD5 c2497e7fb42b2d2f2e8c2143b892218e
SHA1 efe28831695c7b6e1c11abbb3c723016a56afc03
SHA512 00181f5e45d3d9e0d15659f325662d6aa34272b48d02158895cf2cfc7f30627858b0184e0b40e660bd44a57f9340bed1a18af516052eb034835c021a80ec7cf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e9861539a8d0f266803356b896dac1990b88d45813f2c9a8afec9d1aa7ec6bd4
MD5 f5b6389d88b9a424f78c608636d8febf
SHA1 9353e238ddad2747147e4b65ed7cc190da54ae4a
SHA512 0261ebd38f5feca7a6a4dc24552235b34756fefff7a75cb7407b84a4e1133c9aa5d3af447e8a35fb6326241fe64445bd95067ce96e9b15b9d30ee22573df8ae9
MD5 SHA1 SHA512

Submit Download

svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCCCBBAAAAACBACCCAACBCACCCBACCBBACCCBCBBABCBCBBBBBBA.exe
Size 2.4MB
SHA256 e05d83495d4bf692f4713f2a2ae0b7ab32be69fe83e22f10fa4700de4b4dfe9a
MD5 e82172909c8de288be61448be612010a
SHA1 a779adcb22c6160e971c3ffd2887154feb1e4f46
SHA512 63d0c3575ddfa66ae30789a6099c76f153831e7f53a9436633cdbc47947e05a1a12530639b16112662afc72ace7666bb884187cfeffd1663917d0e31a21757e9
SSDEEP 49152:U+E9B+ES+E9B+ES+E9B+ES+E9b+E9B+ES+E9B+ES+E9B+ES+E98Dd79WCK:fp7I
TLSH
T131C54A05FACA40B5F47742704DBBD2BA9530BE258B12C9EFF649971E6832BD09D34722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 cc586a6b049670ff9fe61398940f920980cdd531d475bc64d393a0fbffb949c1
MD5 3813713a55b65297b9a45f95a6b8dd42
SHA1 6f458b77772330606c80c1aadf60e0a621290f1f
SHA512 ab34ceeec67345a37e57469c413c8bed3a00b08040a49070cc0472d6c8a3e12f01d9c002504f587e16711dc067f0f47495ffa42ea6d3cfc1a121e3b3f7256e82
TLSH
T17F112E00D4F59853EC32A5DF96295BE30CE4779FA858AE402349562C7FB4C328D050E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 371bb92cad119cd837acc5fd2ca6d74fb51f4362099a9390187617894372dd0f
MD5 bba9ea661cdd276d2057fdae9ff4edbf
SHA1 b3f8d17866b97257345194dfb83053b0515d1704
SHA512 fc62dff3ebac790a2ff666a9886c9cefb6d8a175350aa58125ebeab94d7184d3d1af22094c1721e908feba2e540b8df0e9a31d32cc2d5c01d9f9c3ff6bb1900e
TLSH
T1E521F950E4F58853EC32A5DF97299BE30CE4779FA858AE542349562C6BB4C328E050E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-58-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/2128-2798-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/2364-34-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3744-77-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/3744-2876-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/3900-0-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3900-7-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download