fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Size 5.3MB
Sample260815-ea5teaybkb
SHA256 fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac
MD5 65d529ae0093de9f42d0cdc0c7720342
SHA1 dbdd46da82a5f8a33628334ae28604d09b8472ba
SHA512 8f2e9fd27864a8b107f8dc729f94fec7f7516aaff94fd6372b531428bde8fa433c55f79418df907ae5a310279fc9093ca018878f733f75f3f5e285ecf9227823
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2A:Bp71
TLSH
T1C4463B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3308	svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
3984	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AAABBAABCACCABACABACABBBCCBABBCBCBCAABAACBBABCCBAACBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe"	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCCCCACBAACACABCCAAAAABABAABCBABCBABCACAACAACBABCABBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe"	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
416	sc.exe
4788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2372	cmd.exe
3452	cmd.exe
3928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3308	svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
3308	svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
3984	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
3984	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Token: SeDebugPrivilege	3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
Token: SeDebugPrivilege	3308	svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
Token: SeDebugPrivilege	3984	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4152	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2372	1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe	101
PID 2372 wrote to memory of 3748	2372	cmd.exe	103
PID 3504 wrote to memory of 180	3504	svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe	114
PID 180 wrote to memory of 1656	180	notepad.exe	115
PID 1732 wrote to memory of 3452	1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe	119
PID 3452 wrote to memory of 4788	3452	cmd.exe	121
PID 1732 wrote to memory of 3928	1732	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe	122
PID 3928 wrote to memory of 416	3928	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABCCBBAACBCBAACCBBABABAAABBACBCAACAABCBCACABACCACCABCBCCBCCABBABABCCBCBCBBCCAABAABBAAACBBCCABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABCCBBAACBCBAACCBBABABAAABBACBCAACAABCBCACABACCACCABCBCCBCCABBABABCCBCBCBBCCAABAABBAAACBBCCABBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe" start= auto displayName= "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe" start= auto displayName= "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABBBABCABACBAABACCABBBCBCBBCCABACBACABACBBCCCAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:180
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABAAACCCCBABCABCCAABCCBCCCBCBCAACABCBBCBCCBAABAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a1f369246aff19d980d3549032c8bc18073d41fd4dd57bb0c3ca6404d9d3a9f7
MD5 380fa09760878788c9616da7808e9f17
SHA1 5eba4182c7177788b9908fbc7b8340d3e63ad762
SHA512 f0f91751721fb3d2eab0785126c78810cf877c2fcea6a131f5f7659425724d68fb8d7c4b759e4df2a83b1e6ec456400656c94273cf578105c2fd5ca3cd8e4ebf
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.7MB
SHA256 395c0172a77dc4dfbbfd3bb300eb34fd6d3c4022526ef0a5335bcc0cfc0fb632
MD5 6bc2e68c734310a2a76470069860dd08
SHA1 1c71d7d94578596d55ad0136ef4830e76608da7c
SHA512 3428fc8e84819993246fa2a7e8eedbe8ee5cffd1fe93efe19e7c40d9c440d34257f735183a8dedc4532159abe79c814096cab52fe0b1960f0c6ac0d5fa2992a9
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2I:Bp7ypil
TLSH
T184563B0977ED4824F5F7723489B68669DAB2BC915B31C7CF5280863D0E73AD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\qap`g`v~dtlq
Size 10B
SHA256 57ffe986b2e86cbe53dc9762c433cd3dff1fc2d832c00baa6bab77395a5e9902
MD5 fa2600c11008fc69c721dcb25d13d92b
SHA1 d55874691ead2ca8314088edfef063fcd36f7db6
SHA512 ad6623eaab8cacd47b58506573ebbc95ea127288dc42a36b0813eecd0bb22d008da29e3fdf24eeaa070cf50fcf8e3289e31cecd046541d5e44580e89208f0fc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 bb7006d64bc6bdfda7586608794cce256fedfb2c37c41a1784c73b464f4ad4be
MD5 38f0c09f50d062536441bde015a448dd
SHA1 986e7c0a810b73edbb3a4086c3b195dce49c9c39
SHA512 421b84c29298a86b463f81d32ebae724b7535b85cc3600964000fc6294426c0da0ebeeeed9af0c9c618cece9d457fab2f2db5e466ba9d48cd56eeb201ae18b28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\qap`g`v~dtlq
Size 10B
SHA256 e5dc2d7c63ddedf08c5e28ce11386a79f1e2c58a9a8146991915bb513d82833a
MD5 3918e06d06a276d4746d5d5ebe7f3125
SHA1 15a8f03ce3d450d6600f1fe0c75224cf9130528f
SHA512 8c6e009790c0a1ce455ba77b334b66dc81bdb1e584740e41e86b9fe38efa55061dc4209f277daa572310935dccc4208e9396dff9ddadc83e6318641ebb627eb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f181aa3a2437b949ebfb90d4e6e58d0aad0a650ff35703f57a41c89ae19585e4
MD5 4101f2ae7909c7b9bbff5f7d96768b45
SHA1 e836c683e2c9a960ecc53f427103cef440e32041
SHA512 49900093956d244909df1b106fc6719691ab10e175ddc66a5d779208f8057c71b1f8dce9ad03f76b4ca148cc4495099edd2ebba323401b7a0b5de974df7f847e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9c361847adafae5655b69abe80bd6cfa39693c60f4e9f515105d96b2df5cb2e
MD5 a8a99831058dd6584a6146681ecc3962
SHA1 a471d15feac9d853a3e4a84c98192f4ca2cdc03c
SHA512 c2d5119d5151a4d04bb39ddbabcc0bd0bc4575516c6667d6be004ae2d2f17e51c5297ff3e1b2d515415a2cdaa828151d6a497de11a0e469c9944ba7fae5ae67f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b5a05bef8013e1ba4e9d8357011642c5949e52d7529e557305a0ff0f2f9af37f
MD5 b1dcacd5f8160b13065d2f387a435e5a
SHA1 3bb182638994b8fcc4009a028f10e8c44a4cead2
SHA512 857d89cc33acdc50f132742f9e3b015d9cb909a1d1580eea181987478f25d1fdc89f9cf9fa556e20eda8ff2e29299b23cfd23a35e5d3937d905ad4d594fa74ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 acf5210e0be586c9478d122f828cf88aca7ed08e09cd41a46b81b2af862cfcb2
MD5 69e2868f5074b6ddf3c9eac9577677ba
SHA1 9df75cca5d177fc3fd9862b1a649fe8d0c7a8847
SHA512 f25f9e82a4dcf2f1fd573b960f9984ec8fc38f78d1d70bfe95a2f2af5d4b8bd5a0984cb83666062800968790bbd11863eefaec376ad123ef3810b82c8bd9ff6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 70f6c9c23c22a1f8c99af44b2a1e1fa81a38c86f0d3f376c81c85acd506f3fdf
MD5 96d0c4ca8d88fd557f0d136b63f7aa48
SHA1 b15da148fdfbb7b04c746805bcc9fb02d02bcaa6
SHA512 a889902d6af3a1da7759f3b6f658ba6f6f2dfd79f4e58a53849d2ee87ccc992c3bee80964a15ca18d1c981af6a7cc2e90aa5f977041ff20e0a9bd00eea7d6add
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 23b100ae96c61f5537d848c13d6c94800e3b3cf54e48b5287c0e53fb91b6a4ec
MD5 2c9e9253eda1b5b2fcbe4f89adb00b0d
SHA1 d1cbec39dc9741636c50a412f700a5ea660e48e5
SHA512 ae9feac6cfdc5c38e8b5a81df2e225c3778fbeee61e64cbc7d2dc5a25aa84156232d7eb76e192573d95fc00608c1c6a4fda7e00c0a048f83511898cf36474bd8
MD5 SHA1 SHA512

Submit Download

svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCACABCBACAAAABCCCCCAAAAAACBAABBCCACABCBABCABBBCBACC.exe
Size 5.3MB
SHA256 fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac
MD5 65d529ae0093de9f42d0cdc0c7720342
SHA1 dbdd46da82a5f8a33628334ae28604d09b8472ba
SHA512 8f2e9fd27864a8b107f8dc729f94fec7f7516aaff94fd6372b531428bde8fa433c55f79418df907ae5a310279fc9093ca018878f733f75f3f5e285ecf9227823
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2A:Bp71
TLSH
T1C4463B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 8ea33fb9f01e4b6a000ae41128c0982e1a9943b009187e3b511e981509ed06cc
MD5 06edf5b9b7a480e928abbb088bf00763
SHA1 931c27c4d9531660f933c536c2b2416a62d4607c
SHA512 9cc24a505e55a5825342704cb2edc3e4148327ab3ebaeb7b551f33270fc052ca3e376600a161203af52295231461d8792240b6f5b9524ea654ed768095203fed
TLSH
T156114F61B4A5D857FA3368DE961ADAD30CB43F97689C6E64230D85187746C328E118F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c85eb4f91752efdb8cf8bd6960fc1e1e2441a88d54923816c0a3d410bdbf6d11
MD5 713bbf2bc7bf79a7ec5d8fc5699cd08b
SHA1 3d34fe36b94498375cf766a3a918f6fb0bd76fc2
SHA512 7fdae643d16ee7ac160b7b2494691ae0e0c8601a8e8c81022a6f7ecffecf05eb98d6a3043f80eedd7472812e9573cb835c87b506ba44e397098b0d7cd21d87a4
TLSH
T1D421A461B4A5D857FA3368DE561ADBD30CB43F97AC9C6E64230D85187786C328F118F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/180-58-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/1732-0-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/1732-7-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3308-77-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3308-1522-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3504-36-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3504-26-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3984-123-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download