9ac2e5558370bdda54a9823cf578237429a3c6d51d5b66b149aaca2e97cb60ff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
Size 2.7MB
Sample260814-dpwzdattex
SHA256 9ac2e5558370bdda54a9823cf578237429a3c6d51d5b66b149aaca2e97cb60ff
MD5 cec1da4459a06e1d286b76c79ffe482d
SHA1 450eab9bfd2a60687eb87b6e2ed9dec6a5f45402
SHA512 d41e8e9fd4536521c07033f272f9d434fad510e4042a9c5b73a00463daf4733fa094d995d1d5a08e9af5f375618f5cf18a07a0fb3f7d15e3daad8966cb37fb86
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVEiw2vhO0+Ee+Ee+Ee+Ee+Ee+EVEiw2vhOZDd79WCP:dI2p7l
TLSH
T123D54C09F6DA4465F4B7617049BBC27A8971B9614B31CADFE284C63E5E33BD0AC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
1900	svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
4956	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBCCABAABACBACAABCABBCCCCCBBCBCACBBCBBABBACBCCCCCCCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe"	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBCABABABAABCBCCACBABCABBCBAAAACBBACCBCBCBCCAAAACBBCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe"	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1144	sc.exe
4800	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4512	cmd.exe
3368	cmd.exe
2280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
1900	svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
1900	svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
4956	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
4956	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
Token: SeDebugPrivilege	3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
Token: SeDebugPrivilege	1900	svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
Token: SeDebugPrivilege	4956	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2172	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 2280	4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe	102
PID 2280 wrote to memory of 1952	2280	cmd.exe	104
PID 3160 wrote to memory of 396	3160	svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe	105
PID 396 wrote to memory of 4320	396	notepad.exe	106
PID 4684 wrote to memory of 4512	4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe	110
PID 4512 wrote to memory of 4800	4512	cmd.exe	112
PID 4684 wrote to memory of 3368	4684	2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe	113
PID 3368 wrote to memory of 1144	3368	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_cec1da4459a06e1d286b76c79ffe482d_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBCCBCCBBCBCAABCCAACBACBABBCCCCABAAACAACCCCACBCCCABCCCBCAACCCCCBCAABBCCBACCCCCAACCAABACCCCCACBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBCCBCCBBCBCAABCCAACBACBABBCCCCABAAACAACCCCACBCCCABCCCBCAACCCCCBCAABBCCBACCCCCAACCAABACCCCCACBCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe" start= auto displayName= "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe" start= auto displayName= "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABBCAACBCCBCCCCCBBAAAACCBBCBABBBAAAABBCABABACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABABACABBBCACAAABBACBCACCAAAAABABBCCBABAACACBCBBABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4732a2c7dad36c6d01856a471ece9e8a3e4362bf00a7e637fe0bd3cbaf759321
MD5 61b96a57e52e9638517dca5089bd6ee3
SHA1 cb09eea5be208e96e499006ecaa5f90fb0ade339
SHA512 74c252fb558f97c55468cc8bc6f006723e860a46ba3b409f32a2feaa3b52d5dfaf37da92b61b45580f5f42be2327a93a85fd4faa562c95d74b485183727909f8
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 3.1MB
SHA256 55b902c47b51380a6d0aa0721f6ed2c6b58812cc6f894496961cef803374f7d8
MD5 b37540092eb6f3a5ab4690f0072c7f63
SHA1 dff1ea290f9dac5b73a274e3d6664271635167ab
SHA512 6cf91c2c2c216d25595e105db7417d59ec8250d1f9a35bb93ff4933d8cb9f53664021874102c8851d8a93b5bf3cbef8fa7f63fb621fa27624787be11a2f4cb74
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVEiw2vhO0+Ee+Ee+Ee+Ee+Ee+EVEiw2vhOZDd79WCoXpia:dI2p7ipia
TLSH
T1B3E54B05B7D94474F5B366708DBBC2798A72BC618B31C6DFA284863E5D33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\qap`g`v~dtlq
Size 10B
SHA256 d987e4aae14ba4fe936f3a3acc3e62ed56dd777642de5276928bee1a5e747b2b
MD5 de744dbbbddc97e361d7b7ffc4686f45
SHA1 8bbd4738dcdd88a828320ed79c2edba234843511
SHA512 5b39afbabb8ec00de63b8f61a38c54c2195c5e15c8cf9ea0505db029126f6e0670cae7369adb25d12155b6bc77c38815b11f7d57e437a3a535dc58d6c7ff669f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 678dc1acaeab98713568b0e11a0a0541926a4cffbe885d2e79894d6ef9811007
MD5 7ea9db72edd59429b44a61b7ffb29e44
SHA1 1a7fca4a76000da6bbb6f33c9d680aa87d4079db
SHA512 0e59312cf8602bb5c8876ce2c82ca0925fab774e8051bef6f42b9203de1e12acdf168ef8067ced07d93cf671c0255d06c21976e8ade28e2ee799b1195c00e884
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 bd0a8be98634aa550e70a776420eb075a9305c14b668e5141713b39396d793a2
MD5 4ffb472119aab9354af1b4d2b4ed634b
SHA1 1b316011dec8de943ad0b5e2abb4d45b6ae89fd0
SHA512 957360bac00a1e8257cf4402a966d3dabb3fc6864c7e1ee1e91039c891adbd0ec9521f6b74be11c8a6b08638d9ba133e3a530fcb92b5d6d4ba2c285ffbc5eadf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9c809a9a856254511b281bce441086d2872fbb2afe54644de3b7116add85549
MD5 73dd2e8ea49b3f037ba88c8002dd5370
SHA1 23700748275ad0173f96e8083fba8710618dca57
SHA512 87dbac7605c56877b67e1db23b6f97271635c1b03ae6188c93f2f88c96e31db8a1a5127339b6e10a65ceb9fb629dc2c39d33fafd73a2c1e93bd16e148c6abc9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 354421c3b8b27de79160d676dbbd8edd5dd79d30c8bf36359ad4b2d35ead942d
MD5 0027257e020885ba7c94041c1adede80
SHA1 2dde61037cdacb0a20e10588adab14c218cea06d
SHA512 cf9bc376c30ceb39ba1c483fcb3600d18b187df0d79f874e07f670e1928126122f5004816e2756f5ce72cbcf35111e23046d8969093c96ef12661de7f8967cf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c63893222415f12d3f50102e933fa2cc23d2772b317d005bf02dbe1404b19bc2
MD5 399da66938551ce9dd3921b1637a43ab
SHA1 e14f3d82267cb1577f6e7ad349c8e1aa19d876f8
SHA512 040b28d08fd911fd33837785070f859aa22541242c9c4f241be1ea60a69c8b00cd4d3d25740effc82229ea77e64d97c6f3d1daf44ff708e45c8abc54bb42036f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b18d55a3a209c2edbff6fb0707a2f0dcdb3548c72508796ab55c86222eb22d5
MD5 b201fd4be254cf534d1da885f7fb6ba2
SHA1 83222c843969a9e76051604d68f2950b48a4d345
SHA512 b22014cf439f7d652fa7d6549aafacd324866afb33d07e2c9912444c0d28ac7ae552c78baf762532645615557aed18277b72c020dfce38e12fd5f854f4f8cb4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99b9f7f171a6db9125218e706d6d17be15a6647aa322226fe967f564a46ea4af
MD5 484d876b8149e5bf914c3d4b50beb7ec
SHA1 9c449d27f0108e4e3ef6eebb16dff3539a074323
SHA512 13975edc3eb81418e1f6124954378b9b2da3f31e22868b7b4c4607c6e204ba19d4f6bd3aa23ce7176b8e615dbde9d4d35cf3ea47cb4ca81ebcf4b2ea7bc1dc4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b23bd180aa6841ec342806ae4cbf7b8d0d91806d0ddb7e5d235a4f748787ed5f
MD5 3e45ceb51893feafbd22eb7715ebf384
SHA1 09cce68ee093b4c35ffc5e3a85ffde6a1fbee398
SHA512 c16dd218b4dd72f51157f9cf98310e4928266e5b05ac076f430b7204ff22b18e9190d262056e2a8c4fd824c036940ec3f70a27eb5ffe6599225ae1c518a3026e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 01cb1e1419c9d98a3c918043eb7f8ed84e49c270f82369ce58fecd9029d1dbb6
MD5 c3d8cb834883e619a4cdee50c2e6356a
SHA1 268a954b1b2980c9829b6cc991f15b292f3806ba
SHA512 711a5c9962ab91480c932ad5661e94bc848b274dccdc3722ed4fa5f861505f6c3ae62b416c6ad78af4d55532b8e495f610dd216097cb9d631dcf1ce1f4dabf34
MD5 SHA1 SHA512

Submit Download

svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABCCBAABCABCACACCBABCABBABAAAABABAABAACCBCAACCCA.exe
Size 2.7MB
SHA256 9ac2e5558370bdda54a9823cf578237429a3c6d51d5b66b149aaca2e97cb60ff
MD5 cec1da4459a06e1d286b76c79ffe482d
SHA1 450eab9bfd2a60687eb87b6e2ed9dec6a5f45402
SHA512 d41e8e9fd4536521c07033f272f9d434fad510e4042a9c5b73a00463daf4733fa094d995d1d5a08e9af5f375618f5cf18a07a0fb3f7d15e3daad8966cb37fb86
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVEiw2vhO0+Ee+Ee+Ee+Ee+Ee+EVEiw2vhOZDd79WCP:dI2p7l
TLSH
T123D54C09F6DA4465F4B7617049BBC27A8971B9614B31CADFE284C63E5E33BD0AC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0dd15b0f64a5406d986cc42bfa313dafc86811aab7f08f0d7b0ec44625717a99
MD5 87db7c2f575a97d5256cabb1f9d22ee9
SHA1 6bedf9918b4f33791b92bc22a06a95007075c733
SHA512 e10cd3b7d0c6003f68082ccd4ac0eef570d485d56720604304fbaa106004872a52596309af5f9e64086d2f2cc255163bfa122dd76daadb69d4518cd204257928
TLSH
T16411EB7294E5D813F83224C7D51AAB820CF476876CAC9A25638B422D7BCCC21CF154D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 352c8ee240712da71feef3289530083699399793e586b5b8025362db297025e4
MD5 0cadd27938dc4ef020c7f7cc1cb3c1ed
SHA1 baa3d0090d3d4c6e7bda090f5883c35faca49bf2
SHA512 47c5ea6ed6b06bfd14b4ea5bf46b5a2153fb23e50da3bf95d5d0124c07b195c29e3db3a216a988e3dc44495af21cf90ff379d4f89fe68e56ae9ba9c48d667fa9
TLSH
T13921F97294E5D813F93224C7D61AEB820CB4768BACAC9A25634B422D7BDCC31CF054E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-60-0x0000000005C00000-0x0000000005C01000-memory.dmp

Download

memory/1900-88-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/3160-36-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4684-0-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/4684-7-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/4956-566-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download