ccd8d11bb71baf4d9fdff93a321fbeede0136257d487a1a77d3ce88d1fafc3dc

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
Size 2.8MB
Sample260814-ewa6xsvbme
SHA256 ccd8d11bb71baf4d9fdff93a321fbeede0136257d487a1a77d3ce88d1fafc3dc
MD5 6540434f0d32943459eb158eeab71d41
SHA1 29601e91cae43a4a11521a209a0199be41d9211c
SHA512 3fdc4dd9c15bc158d1d5c75d1abdaca182b36659933e3b6436e4a6f52e35af49b5d7e1b37cb88f72445564784d01808823029e419f512cf12b40ed29a4056591
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddj9Y+Ez8obnyMWmddj6+Ez8obnyMWmddj99I:irCrerCrFp7W
TLSH
T133D56C1F22E80076D96FC179D2D68156D6B0B03127222ADFA2A0CB7D5F6F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
5212	svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
3968	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAAABCCBAAAACBABBBBCCACBACBBCAACACCACABAABCABCCCCCBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe"	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABBBCBBACACBBABAACABACCCCCACAACCBACBAABBCBBBBCAACACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe"	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3420	sc.exe
2360	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4600	cmd.exe
4620	cmd.exe
4752	cmd.exe
3924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1936	schtasks.exe
2344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
5212	svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
5212	svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
3968	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
3968	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
Token: SeDebugPrivilege	1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
Token: SeDebugPrivilege	5212	svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
Token: SeDebugPrivilege	3968	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4620	2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe	101
PID 4620 wrote to memory of 1936	4620	cmd.exe	103
PID 1800 wrote to memory of 4740	1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe	104
PID 4740 wrote to memory of 5224	4740	notepad.exe	105
PID 2584 wrote to memory of 4752	2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe	109
PID 4752 wrote to memory of 3420	4752	cmd.exe	111
PID 2584 wrote to memory of 3924	2584	2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe	112
PID 3924 wrote to memory of 2360	3924	cmd.exe	114
PID 1800 wrote to memory of 4600	1800	svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe	118
PID 4600 wrote to memory of 2344	4600	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_6540434f0d32943459eb158eeab71d41_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCBCCBACCBCCAABABACCBBBCBBBBACCAAABACBBCABBCCACCBACACABAABBBBCBAABBCBBAABCBCBBACACACACBAACAABBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBCBCCBACCBCCAABABACCBBBCBBBBACCAAABACBBCABBCCACCBACACABAABBBBCBAABBCBBAABCBCBBACACACACBAACAABBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe" start= auto displayName= "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe" start= auto displayName= "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCABABCAABAAABBACCAAAACABAAABBAABAAAABBBBCBACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCACCACACAAAABCACBCBAABACCCCBABACCBBCACCBCACABACBAABCCABBCBBBACCBCBACBAACBBACCAAABABBCBABCCABCCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCACCACACAAAABCACBCBAABACCCCBABACCBBCACCBCACABACBAABCCABBCBBBACCBCBACBAACBBACCAAABABBCBABCCABCCBCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCBCCCBACCACCCCCCBABABACBCAABCCAACCACBACBBCBBACABACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f397595b552c6406eb8b600a2cadca43df5da5e0a60617ddf572f11d8f9a99e3
MD5 d34b9d843a82636f6d1b3d7e0ebfe254
SHA1 697a58ab793d9bb6984584c7888379b288dab35b
SHA512 fd8e9dfc70d9bc748d8635d0edb65b6eb18cde3d9e80e22c32ffce215fbc365c6850e68e5ce4350813ab4aac18ec25e56e79befd9f91f5dbdeb7cde4ccad4100
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 3.3MB
SHA256 422ff0416ab5207eca04e2dcb96dd57ebacd0311128b653232b0cc2634e14b9a
MD5 932de1fb1cd1e5d8d8ea9a1c7fe0aff6
SHA1 141f1d376cbd17483d92597bc587456eed794d28
SHA512 a179107cd72f55bc8c699120474c1da3838b8a934df4cb67bc1fe0265558b2d8ef1a2b7ae121add7f0d805d6fc0a4ead525ebbd76a12c679f5f74802f9507346
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddj9Y+Ez8obnyMWmddj6+Ez8obnyMWmddj99x:irCrerCrFp7Bpi4
TLSH
T1B2F57C1F22F80076E5BF8235D6E68156D6B0B4312B211ADFA290CB3D5F6B9D0A53DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 9405458e8d1fde25af7245b1d2bc9bb51cc12bcc5ed90d659a1402ed8070177d
MD5 c62e3881610e12dc3478690440cb3768
SHA1 a5e73c64e87978d9f632a86f8a75b4c97fb5f755
SHA512 d0d33ec56c9a3e42d49b062af0f2cc7a1be0911e6c5f4306088100483e2350ac7196014ca2c085f1479c7088bb97e1d9fb63eb547e93bc067e49c4051e5a66f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome\qap`g`v~dtlq
Size 10B
SHA256 4ba6b908d1bd5fa324340b0ec36a3b9e277666bc0800de7a4840b9e3454422a2
MD5 b21a67492d7b87b582d4d6556d4e9d75
SHA1 8d2fe170df1e9c8cb58a4726d5063819ad9195ac
SHA512 fb299e829cc4c1e9058224725f6e4dc0cb3fa599496e43c276d86dce3f4a8598cffe244eb01ce8032ec1cad20ed4c555ea34eb5b1b7f0916677ea533116f8de4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 fe346db26cf1305caa977ccb3078ef0b995e158fc568eb5c0c000981e0d50b96
MD5 4a78067a8cc27b85f6bf613f7d9d0e36
SHA1 729ccb63121807beb6c6b7e73a9047e87af5014b
SHA512 d886497e22d4473dedb30a23b58dba196705cfabe80e1226dcba26a181ad8e8d4fb47ca6b80e96b91b333435b4ba70ea887bd71698c6e2c631fc2ee227fdb128
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 2309d0c21f5999da6f349ebbf048c9007172b16b94576bab1d8a69176c7fb039
MD5 4c13bf390bf3b5425dfdb7a87ec008b9
SHA1 e1ed3d911e86312d0926ab355e8f516d01a514f9
SHA512 b1ae41b72af335570391c8076af398f3a7e64831b3a3a7ba742dcac7507a166dcbf05784943fa87a5d36c7630cc0e498a8e777a59b7d6a6b6c31c963b2dd81b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce4112c56de9b30c4772a07fee18029fb8e0987bb4f4cc91c28dda98b5b78ebc
MD5 3caf34f1713932d310daf1cd2c77acad
SHA1 8bf8459056b6264b47a870704df9dcb1fc9a7cd4
SHA512 02323c5f2f90a8a13caceced24b2850c80f335c9cbd2ad08b58e684073e092ae00467119b3190e75eefc3ee6a88ee6b7202228523a1b11e9cb5a5136608addaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 48b47ef54f89e2a6f58a0ae5cf273dca1df788f86ba012fcf1e1de619a81e185
MD5 8dae7c279d98c0da5f1bd2f6919c5faa
SHA1 a078bf0b323f2e04bca99cead659cd8331df7dcf
SHA512 bbdfe382536d0f4393ae1b6f6b9af8a0fb49c39402512482835bd24cc36c2be4caf503fbea5c86c2c834bfb3978383abff56933249d74d3ac083fb3a81ea71e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f58e1b9d5b96ca7316a7c5c7b3f2b14580174595fb6fb50098f26d25dc73238
MD5 5095c184e98811ed13b6549e6464d912
SHA1 db475c86f5adedb718ae101a6c9fe4ca6d3e8748
SHA512 fefaccdc53fe27e4bb51124f75da59e6e488885018aec3045982e69808994daf263ed955bfb63b41a4e945082173fc7865b8f947f76811e99eca9079fb696260
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd3fe795ac3af4d48d29299c44c3a71c14e77c30e817e53eb623811d7408ccc7
MD5 db8f82820ce17a3a98309e0b5493a5f1
SHA1 50ede27ae4522e914b7aa0aabf1f54a016999197
SHA512 d69f0a0946e8f0490e16a4d191ce5d5ec31436c96dd75eba21efe7c6f24f93df5fefb055306d8ad7fec709254f64ebadd8eb0befd2ce186655dfb66b94214d24
MD5 SHA1 SHA512

Submit Download

svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBCAABBBABBABACBAABBBCBCABABABAAAAABABCACAABBBBCBABA.exe
Size 2.8MB
SHA256 ccd8d11bb71baf4d9fdff93a321fbeede0136257d487a1a77d3ce88d1fafc3dc
MD5 6540434f0d32943459eb158eeab71d41
SHA1 29601e91cae43a4a11521a209a0199be41d9211c
SHA512 3fdc4dd9c15bc158d1d5c75d1abdaca182b36659933e3b6436e4a6f52e35af49b5d7e1b37cb88f72445564784d01808823029e419f512cf12b40ed29a4056591
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddj9Y+Ez8obnyMWmddj6+Ez8obnyMWmddj99I:irCrerCrFp7W
TLSH
T133D56C1F22E80076D96FC179D2D68156D6B0B03127222ADFA2A0CB7D5F6F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 19565cff8a76e9b6c6af0978137f1a1c0b94725aff8bd38fd0e0d8214e56df08
MD5 85b53d3fc17081c58532e02ca08fd043
SHA1 eafe649144bd053f5f55e2f34f09842efb371613
SHA512 33cfbd2255bacf95f568fcbc7f90928e17f9b28b879e7de9917d4e82eed9161d29a16ed0a3ebe062789f354e92a3f72b8e2120d52c9fda4a997f175e24ccd504
TLSH
T19D21EA21E8E5CCB3EC3298CFD6299BC21DF476AF686C6A40134A42286BD9D31CF554D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 01bcd4ab83930618abb30928de02eda74145acd55d10d6b308f900abe1ee7578
MD5 6ea27ccc5d822bd3d67b4b431cd5a570
SHA1 1331eb9d89a13036ee57cad95da426302c3e4c5b
SHA512 e0eeeec7583dbce5ef34f9451ff67ee5d7ab46a8e17501cd8cfaa86f5f5e978240dd0ff8c19093c3079a37fdcf94bfb92bcd24f9a3675f69249c70d595c95102
TLSH
T19411C851E8E9DC73EC3268CFD22A4B831DF4769B286CAA44134946286F98D318F550EA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e653d67638c834f23a3d8556d363a8d85064987687eab36006857d1edbf58a1c
MD5 d3a3e7098054ecf8d538926cb5b04318
SHA1 b8088423d47ce50d2a07ecf32965c6974d8daf07
SHA512 6cef02295169b8d1a49249a0c5e5190dc8e5070ce28bb42e813f7dc354646696543bab506a8cc050a63832be8b63acb49e4f202817223f84d13997f968395d6e
TLSH
T1FB21FC61ECE9CC73EC3268CFD22A8B831DF4759B687C6A44134A41286AC8D31CF5509A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-36-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/2584-6-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/3968-1464-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/4740-59-0x0000000002700000-0x0000000002701000-memory.dmp

Download

memory/5212-86-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download