a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Size 3.5MB
Sample260814-e2fzcsvvaw
SHA256 a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47
MD5 54db336dc6aebd69755890b537470948
SHA1 9e7044c8d27fe5efb07075b0f9a7e39920f0c20a
SHA512 343252246e2b31a4c741d26e82f7d5c5290a03790827f39690bf6efded78680468587b93ac7cdb1434b22c936cd5ef754814db047fe0f83b81c2c10c7e0b1875
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaO:uzKzNp7d
TLSH
T1F1F58C1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
4588	svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
1852	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCACCCCBACCCBBACAABCBBABAACBAAABCACABCCACCACBACAABCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe"	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABBABABCAACABCABABBAAACACBCABCBABBACBBCBBCCBBAAAABBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe"	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4236	sc.exe
848	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4156	cmd.exe
4456	cmd.exe
1584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
4588	svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
4588	svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
1852	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
1852	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Token: SeDebugPrivilege	2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
Token: SeDebugPrivilege	4588	svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
Token: SeDebugPrivilege	1852	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4456	640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	108
PID 4456 wrote to memory of 3952	4456	cmd.exe	110
PID 2440 wrote to memory of 4648	2440	svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe	115
PID 4648 wrote to memory of 3128	4648	notepad.exe	116
PID 640 wrote to memory of 1584	640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	120
PID 1584 wrote to memory of 4236	1584	cmd.exe	122
PID 640 wrote to memory of 4156	640	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	123
PID 4156 wrote to memory of 848	4156	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBBAABBBAABBABABCBAABBABCACCCBBCAACBBBCBCBABABCBCAACCACBBABCCCACBBABBCBCBCBCABACAAABBACABCCAACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACBBAABBBAABBABABCBAABBABCACCCBBCAACBBBCBCBABABCBCAACCACBBABCCCACBBABBCBCBCBCABACAAABBACABCCAACAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe" start= auto displayName= "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe" start= auto displayName= "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACCBCCBAABAABBBACCABBCBCAABCABCCBABBCBACBBACAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:848

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABAAACCCAACABBBAACCBCBABBCCAABCCACAAACCAACCCBCCABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8a30e254c065457280ac6ea7f940d6e35dabdf557619015b7a0a929f6271d64c
MD5 dcdb48d659513939e910677de1dd460d
SHA1 6f6a6fb3e09d70f9b1f2737f530062b5c7d6e379
SHA512 00509805d492e41e72b3388f49dd206508407396e2774f4e387f2364818a72d8dc25748c4f1315733f2c4ffd6e599b8aba4787999e18dfabb37b833b14babada
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 3.9MB
SHA256 2b3d7ecc59d5830e6f0f62f11d0e0af1dc6059803c1c289cd13aa097248f0156
MD5 e3425a689491896e957f6ba3a683913d
SHA1 4873d86d91481327e693bda289e6c026ef084ba9
SHA512 875fe2240a2338d615ab2d8277abaadfbd7142e7950008e3c53b01608866fb9230210b7240ade6761667b04f2b7b8ec50ca4c1781d6765d99316fc5f4dc2e24b
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaL:uzKzNp76piC
TLSH
T1ED168D1DB29540B1E87B5170CA9BC27AD670B83167319ADFB394C63E5B33AE0A43DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 e88db88f8174c7440c2ac9202429b41400264431117d20a1e238ced0088dcc8b
MD5 6e2bb4aa3e80c7938d2eee3e5752d742
SHA1 657d10050d3d8f6307fd48206c231ee1ca02c7fe
SHA512 2a1673ca6c93d3e0cb930a17d0c82df94365d5c47ce2633bd51d8d812fc85b2564f7862e8de113589ea378f637af4f40f56f835fedec8b2c3f730f4379327cb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\mn\qap`g`v~dtlq
Size 10B
SHA256 ec5390c6514398b76868dea5637df212987460a47c271025f0b9d604bd3255ed
MD5 c559bd72daa19424fd7c5c1d03ac09be
SHA1 9813ffe9236a2a0c5a8121e6fe9d8af2c3f7f9ce
SHA512 3084f3d73a296e8f83d7ee65fcb07bc9d000415f20592a4ba3713a51ef051b2b3262b80fed3112e332a4e5de45d0f0a2c3020334f6c31bfe85795800f3ee6ced
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 d67fbe9f3a2bfd149dbeef3653e660fbbd95748970eed0445e11a9b5aeebad4b
MD5 12c56afa16469a25699d1e11724a1e4e
SHA1 428bf2fd98ef415eb1ea1f5b125929105da57888
SHA512 dbf28944719a10a5f28ec46ae45f4d7490be78ab80880e4a3907395be385f589218d60cbd3d6a004bbb27e203d7535194fa75dea937f88b0e1a2952940382b43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\77wftcd8.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\events\qap`g`v~dtlq
Size 10B
SHA256 931006cd4d6b6aa787ee5cb97ca669a26a473a023c3673b3b52083cdc40614a3
MD5 6a575fcd475fb21daa5cbaecf16f0ec4
SHA1 e7c5ba6dc4a825bf58125096095aa41f4636992a
SHA512 e840b529e2098e71d9d4ae1fe8811960314e3f0b1738880dd3884bd8081173762792879758fc204dd35198d0c48ad416fe28f16e93e1830207596e6b27439d01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a4facf7dc5c29494c0e9b9053af4de1cd5a4454a0ac771cb0c66144cb509a6c
MD5 e0e543c35c4372341cf281bf8fcbd358
SHA1 8a5907b334c8cb62fcc69c3084c234084470be58
SHA512 34281e456a3ca302e21965905057906c2784b5f439242f82f66a995789cf787339fad3e003fa339a5ed4e15d7a6e53aceedbb692cd165a663312778f4f9db899
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b9d909e76fa88b65fec3b103316a4287d88d232c11d15f47d9d9091415bfa0a
MD5 2a42fa3a844a4c291415b880d094b01f
SHA1 f3fe0fc54215f4bfa017a03e6a8271e510617b0c
SHA512 59a60bb33813d4e72c843acab1b9cf446fc8b69c53a444ae72d339500f863b7969bafc32a8c832feb4ed24d46ba3520db44bd87f2e54cd77cd29b355007e2aea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b752bac3edd18cd71f08b625c1b3ec4ce630fb1c59d0d700f2c9a2ae0b47a65e
MD5 aee09c28f2e6821557935b0965d764f0
SHA1 0f3b4dcce336762a8a339b6fda0ab4b18f696fa2
SHA512 0a7ab53b8695627f47055e1fa6e2bdeccdc1ff843bfed3a7b62bbac1578f2474c5365d2c5f9494484ceabba0c4663fe33ccf23be0b741afa9d83cb79d6fc53af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43b07f1be5ca7329b3e0b61427dd6e59447c2e458a73ef8b94324f89f997105e
MD5 ce4b020569f0f709e1862a8d594032f4
SHA1 9bf9ecac07c0da318cb3906a9b949d0c32cc24f2
SHA512 70f7ea70f20702e99d4427cfa7c2e7e40cfa429c0ed7e88b3e4cf81c2ea370dfdf053f1f90894b09ffcd6308bfc246ad04d42102c157db0125fb939413968291
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 242a3d8ffbc3bc0520706973091a90734d841d3ed57bfcb6c11e3778e0cf0250
MD5 d7a5eb07f3bec7934af3fe5f0fb9816e
SHA1 cccfdb00a2512c51e2279e245900e198b3f081b6
SHA512 6ef9701f5607b81ba9374ab562d496d6187960da0379fc50e56e3720be9fc7e285da490ecff70d48f73525edafb134d942a2905797be703c57455c8ef1d42d25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5fc607e713ffb15fc4b4c4184a9ebcdda500e84d8a3342d4e7660c52a193712b
MD5 08dfef6ab41515cd70957c9800e776a4
SHA1 11a65184b826df34b4faac4b8930bd2e797a1046
SHA512 1b70215649119b9e537aa56efae1f05d06a84df430a1668e5cff23b21bbfb49fc723365a8fa7b95c9704b72360c73d76f017e94d0944135f6f21bf79b7d7c056
MD5 SHA1 SHA512

Submit Download

svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBCCBCABCAAAABCABBCBBABBABAABAABBBCCBCBBAABBABAABBAA.exe
Size 3.5MB
SHA256 a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47
MD5 54db336dc6aebd69755890b537470948
SHA1 9e7044c8d27fe5efb07075b0f9a7e39920f0c20a
SHA512 343252246e2b31a4c741d26e82f7d5c5290a03790827f39690bf6efded78680468587b93ac7cdb1434b22c936cd5ef754814db047fe0f83b81c2c10c7e0b1875
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaO:uzKzNp7d
TLSH
T1F1F58C1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 deb01337ef1f6d7108db370eec90b977e02c644df088bc997864fd2f2ed4fd7e
MD5 621da1c19e61f3bdd27f44ca52da1731
SHA1 6de004785237805761c13deb174d9eb044801a79
SHA512 d2bdcdd4f3df72e728067aae68582a78e470048aca734d47c93c8d97832a79b742bb2664e9d9b37c9b7b9a5fa50dc39a5bdadd467ece9fd97f75c78428ec22b3
TLSH
T19F11C861DCE6E833F9337CCB511D9B831CB4669FE81C6AC413054228BB94D318D554F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2d484aea60b02f9cc7d17973fdb520799691dc34901546efbe0ab382fa65c0cd
MD5 0d03974e637a8a0de33927a331b3b4e2
SHA1 13a47c2ad01356380a62c77a86fc7110fc531919
SHA512 d5d84f265e3bc0fb73988f912a6177368f99bcad6d595076898c8890da19278acc32d2e4567dd79f36b297e91f69e3c715e551748a9a9d08f7676c34794fdb7d
TLSH
T1AD21DA61DCE5E873F9337CCB521D9BC21CB4669FE82C6E8453094228AB84D318D554F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-6-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/1852-88-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/1852-2889-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2440-35-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2440-25-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/4588-86-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4648-58-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download