b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Size 7.6MB
Sample260815-ecckmsdf86
SHA256 b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d
MD5 62f1e6112aed596a20b90fd3da65a1f8
SHA1 d1d7e3975feccda16369c3a4972037e0269b6f9f
SHA512 7819343b7cb580b70861563a3a5c0b7d5bf3a4283759d1efeadc6865119efd91d06d26bf387e35cb84e73561a6f87f37c76fa5ef00f41a0a990cfed57878bb38
SSDEEP 98304:rW1PsiW1PsAW1PsiW1PsZ5aW1PsiW1PsAW1PsiW1PsZ5op7S:6xsnxsJxsnxsZ5fxsnxsJxsnxsZ5eS
TLSH
T19F866E05FA8304B1E97725B04DEBD3BF4D747B2187218EEFE749861B6932B919838316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
356	svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
4908	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABACABBCBBBCBBABBCCBCBCCABBCCBABCCAABACACBCABBBABAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe"	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAAABCACCCBCBBBABCCCBCCCAACABBAAABCAABABABBBBCBBBBCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe"	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2480	sc.exe
5744	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe
2476	cmd.exe
2656	cmd.exe
3396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1468	schtasks.exe
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
356	svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
356	svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
4908	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
4908	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Token: SeDebugPrivilege	3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
Token: SeDebugPrivilege	356	svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
Token: SeDebugPrivilege	4908	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2656	2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	95
PID 2656 wrote to memory of 1468	2656	cmd.exe	97
PID 3420 wrote to memory of 3596	3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe	99
PID 2552 wrote to memory of 3396	2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	102
PID 3396 wrote to memory of 5744	3396	cmd.exe	104
PID 2552 wrote to memory of 4620	2552	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	105
PID 4620 wrote to memory of 2480	4620	cmd.exe	107
PID 3420 wrote to memory of 2476	3420	svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe	111
PID 2476 wrote to memory of 2596	2476	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACCBBCCBCABBABBCCCACCAABAABCABCAACBABBABAACCABBCCCAAABBBAAAABBBBCBBACCBCBCACCABBBBACCCABACBCAACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACCBBCCBCABBABBCCCACCAABAABCABCAACBABBABAACCABBCCCAAABBBAAAABBBBCBBACCBCBCACCABBBBACCCABACBCAACBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe" start= auto displayName= "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe" start= auto displayName= "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCAABBCCAACBBAABBBABCABABBBABACCAAACBCBAABBBCBCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCCBBABCCACCBACBBBABCAAACBACAAAABAABCCCBCABAACCBCBBAAACCAAABAAACCACCBBAAACCBCBCBACACABBACAACBACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCCCCBBABCCACCBACBBBABCAAACBACAAAABAABCCCBCABAACCBCBBAAACCAAABAAACCACCBBAAACCBCBCBACACABBACAACBACBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABACCCCBBCAAACAAACCBCBBABACAAACCCCAAACACACBBCABCACCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 67fe4947bdfe035d816454b5465f55efd4d1fc031da42503bf9b9bcec15c3a09
MD5 6392b564e6fa90f23db148681a395eb5
SHA1 a44c4fe0dcfd3414853f211af91cc6eb7ac408ab
SHA512 44e1641b9c269bf10f6c4fb62f71cb5d8cd66f7101bf85196c6e10cace6b3573095e7b4d57271ca5de1de0d6e14a58485039027fbc2342ded679c5251ab51142
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 b055b14e0b6e67a50ee877394b70462238ca4d44b68619b78a3fa0b382bc326d
MD5 f5da8fdea4a1841faea0ccf7e386c80e
SHA1 3d1b3a1d04fed42e9c104375be62cef53bc0ad98
SHA512 1791e76e4c3f755378a1d54b5b6282315f93ca58c37de36e807486bef0008c15b9083f21c0647e95263578d2fb5165623ac4983b0e60c7b7066c2de93710c7c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ja-JP\qap`g`v~dtlq
Size 10B
SHA256 15f13771465520e1f165b496fc2dda295e5e4e326f7ca47e57fd7efca16ebe0a
MD5 b80491364d9d846d63d2c2a431d16030
SHA1 0f0be665dc4802c95e129a98d68b0be4e92365c7
SHA512 4bb5a8a703ed656d939dd1f1feb093767efce4787a66ff1070351db7ee237694c08c6818666660426e32bc7ae2d9de6f5a03c523b4949df600ff2783d1484bfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 cb7facda70b3e25fb4442804f5654748f714374e7f229e9c07645b140d9290ca
MD5 939fc727e0cc1d50f4ba7af02413ddaf
SHA1 797610534dd48413bb5755e0a32cd47440a97014
SHA512 5f03412cef7ea8cf980061251634e15735c864ddd47bccf776e6b276f3b24ab23337542e841020029b4501d5d68729ba31c7933e30a7071cd67cd65ea6d7c0fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 0c54b0c384e7a9a85e1e6c609672bc565abb1bbc0314de64a20d5f72afe04649
MD5 e5330bf736c9db0e67417ac2a9a441b2
SHA1 c3dccadec58d5b7956a99a04aa255f267c636646
SHA512 1b6d4a82ddd20f649f576c3495594c9c82b51a2bf1d80eb82346255d9ba59ccdd5712e5c9589c7bc29b197428a0d2b9c0abfad7b2bec16fefd18bc91f90a0663
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\qap`g`v~dtlq
Size 10B
SHA256 e4a8ef454f710db028d49f7bbe1f1052d5c2cdc729aef99872130d95402a72e1
MD5 917901d6edb412bb071f74b04ec0014c
SHA1 a3a27ff0f860cbe95cbacdafa4c380edc77c9586
SHA512 33233e5db5cfe9d153527acc3c3fe759a9a50aad37f82043590fc69bcf1b73f2076ffab8b567eae10890513ac43a88afc0a3ffb241ddeea42e3bb48b7c458359
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OpenCookieDatabase\qap`g`v~dtlq
Size 10B
SHA256 25cfec5ed054cc4782fb4533fb395ca0923b6777df42366d4c272e2a22d2f2b8
MD5 bd36f004f4d1148e926223c6bcb73c49
SHA1 adf4930bbf2f1a5569c7823e17af8fb9b509fe7a
SHA512 024e41ba584b145e362bf83c53a7712ac05a6a565329bc26a0fd2dc35a3a8f29800815a1d73c7d672db17cb2b7e698a591535ded86cb0af480c219a908d6e33f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 d6dfc0ab0819a3c01df36db2b6275464fa3bd96d943fbef6fae71821ecb3861a
MD5 0d89a7412a2f10d7f86bdd929b37fc83
SHA1 cd29e0d118650211ae96dd3a549f1fac8071de52
SHA512 f85b9300e0872da5995904922d5b24e20725602895388e3e5d28dc7861fe920697e8ee56bc7282fd29d9fab6d39808335189c17f86be9f21fd56e284605f4ebb
MD5 SHA1 SHA512

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 23.0MB
SHA256 2e0a76efa0e640dab908817a8e82fd7e3208866a9243c84112921dd0be01f29c
MD5 9a779ccc8c1495d46f8efebdd9698148
SHA1 e94068b0f94c1b628f075c5a055b1623c6c660e7
SHA512 f8c76ef37bd66b9d8c87fb0a78f1f6a2c34d6ed5f522562212cc5bc211813c9c45c01cc2c946f5d26f3ccc6a952a96c5682b357ade72486563f2b6a2ee348643
SSDEEP 196608:6xsnxsJxsnxsZ5fxsnxsJxsnxsZ5exxsnxsJxsnxsZ5fxsnxsJxsnxsZ5exxsnxF:a5P5y5P5y5P5iD
TLSH
T13D376E05FA8304B1E97725B04DEBD3BF4D747B2187218EEFE749861B6932B919838316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 2.4MB
SHA256 514191d6b75a63633216ac925f1781ad72278ce8d7a943a0a4f4c80e8e1d1716
MD5 a8808d2ee8cf1f2627f460b4c93dd16d
SHA1 38c0f7962541c31b93ac4cc72c24db378f655f1c
SHA512 9e6eba40fd5d27adefd5831e45d866f6df2a859170539aef871e2cdd27d44aad1ffed823c1ab0fbcceede3350d9ad4c902c9fd51d8bc1c489ad241aa5bef5ac3
SSDEEP 49152:U+ES+ES+ES+EdW1Psj+ES+ES+ES+ES+ES+ES+ES+ES+ES+EdW1Psh+ES+ES+ES+N:rW1PsiW1PsAW1Pse
TLSH
T10DB56D05F98304B1D97B20B04DDBE3BF89747B1186228DEBF74DCA5B6932B91583835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchReset.exe

Path C:\Users\Admin\Desktop\SwitchReset.exe
Size 640KB
SHA256 60ec9aea615d8ebe37ec94c7268fc3e42d3ed1e4bf0330b4d272b2fceb450fdb
MD5 d6d26d128472dfab65f88bab1b559786
SHA1 0c8d4558582b26af8413f72ca5827fd193387e4c
SHA512 00af7aa48e394139becd04e5d65a65c51819363a368b7a46faf3bdfc2323601b792f9799713f25fd434261b78ec7dd5790dd049dbc144846ac488dca74d74c08
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnojAy6Bqwb2vWrB1xe1ysOsz:m9+EM0q9+EM0q9+EM0q9+EM0H6BavWrQ
TLSH
T146D47E05F98304B1ED7B24B04DDBE3BF8974771186228DEBE74C8A5B6932B91583C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79321fe7c9d92633f11b671cf4693cb9ebade8b85313d8c29e23e7d23980b844
MD5 65d3693a754c0fc83a63399408c0860d
SHA1 62eef91f6d9e9519f1448d8cedd0ec30bd5c8779
SHA512 beb26d0d304a05db54ebf181b3fe1e719d703f1fafd38188dc6e7ab9f062ee61d316ceb1061388d39d5bd6952e660fd3836f12d8061d1678adedb841fdbeac31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 078bf9d1b577e1e7ecb0dadfb5c2c89de6f7eaf340c92ea3bd6fe7ff442da792
MD5 44b125f1f6e05028b5e0b5b21e78a87a
SHA1 6cca749fa2a970e7faa558b3ce95dcb932a79d7f
SHA512 9ecf3c245fa817f9672ce06fba9edebd497750f0c57e9a5334dc47d762ced18812c3585216fb992e2acfbf28eca38b0e35e31e36b19d2e81423bc9e73c117840
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8242e3c5562005cb3dd5e8fb4e851f893809f4d5e4f2f98d6f0e20c7f2f9b09
MD5 6bb39f56a2d86da6206a220125c922d6
SHA1 8fe377d3bd4586cc20fbd0f508093f2672a7cf8d
SHA512 ba42199c44548641add7237ef2584e1ceb40862c7177be957779ba247627f0cd194b1b631c74f39ea07a4e456a97df916d8ef8d04fc389271c432e05bfb2f31e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a473efee55af4820dc52a6206ad8167bd431c679dc7e8e449c44dec60c03f9c5
MD5 fc4a71a5d751b5015c266220ecde6496
SHA1 0638e25b0e23e3e7dc0e0421d3da207d2624b04e
SHA512 180d45aaa72d5f09ed5082fa3c62ac0e852639e492e5231750d144124b8db404bd189a601fdcdca0af101206b273b99ec1331f93416f0ebef17c0bcae476f66d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 76521cf3827ec08df07045a2d99cb9af7d03e28ad1d4551196d232c16e6cd16e
MD5 074e9ac46d7593cbb7c5e5f45440960d
SHA1 7eaf09cdaa733d10447dc18c88f324baf6b5fbd2
SHA512 b9b6835ef625c47ab32a5a83c1b277f1e8d606ca45cc76d20b8bce2102c310e884a91c987a88d678771768253222129430c4003ca481e73bc67acc1a00223311
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 f400dc8207a40b369e2447034c3166e297d13e1cd8349dfa3fab7724e150867d
MD5 108a719664f1923e82a912e7d55de1cd
SHA1 d38b833d5b4daae18e75461f7576f6bc6dca04c5
SHA512 951ee6eae801bb04b8c3dfbb74f0761090b3b64fcae1ce340a37f5bf8896a6fe16f70749aa0f47b7acc7f4e03e178a79f98d67e1e07572218c4f8177a70465b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e96b5675da1d11ab61b75ba36ce61cc841f5e6f181c3b9a58ff418ebccac24e5
MD5 08dcb0718824d980c40ec3967e50d88d
SHA1 19f06b072eb22fed3e5c7fe144f0e0930c57e03c
SHA512 bdfb816a6cee60a2a6b68e05c57f990953193bbc55db3113a6cda8ec6c4c5e8a3bc83453ed1766f004449be0abe9f2a8f9db236f9ca977b67b335fafcc788adc
MD5 SHA1 SHA512

Submit Download

svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACABCBCABCACCCACBBBABBABBCCABBBCBBACBCCAACBBBAACBACB.exe
Size 7.6MB
SHA256 b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d
MD5 62f1e6112aed596a20b90fd3da65a1f8
SHA1 d1d7e3975feccda16369c3a4972037e0269b6f9f
SHA512 7819343b7cb580b70861563a3a5c0b7d5bf3a4283759d1efeadc6865119efd91d06d26bf387e35cb84e73561a6f87f37c76fa5ef00f41a0a990cfed57878bb38
SSDEEP 98304:rW1PsiW1PsAW1PsiW1PsZ5aW1PsiW1PsAW1PsiW1PsZ5op7S:6xsnxsJxsnxsZ5fxsnxsJxsnxsZ5eS
TLSH
T19F866E05FA8304B1E97725B04DEBD3BF4D747B2187218EEFE749861B6932B919838316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d114a7c916361dda96667e446d07b5243d5bb8ca1bdee78050fec6a2ff6313aa
MD5 6bc612f8d8b3f6147c4211caf3e2a5a5
SHA1 d49b4cf838f2c9f9f61e6c5ff8efd6f6e1a7e126
SHA512 81dd3dbef28c166d254b64526548b6fe65c2aa7721bbeb52ebfe9d85b3a007e774a00d865a35b07277e875074628c1495922589a70b9d57be7587b70edde91ed
TLSH
T1E221A490B4E5C827FD336CDA962ACBD20CF57F9F9C586E7412058218BBC9C338D25892
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d67fe990bde2d8fa18b5138b6a3cc134ea0029184ed32d3f1d88a16f2c8d3dbc
MD5 37b36cb5f65c961809d25098a5105658
SHA1 e5ce659998f0fd1a6c0f25987cf905d76d12ce45
SHA512 ccceb0981657d43c28ed6ee2a2d798246cda84ee9f7b929e249c4cb33f01ec4ca6d0d43b2dff3f05ecdb7ceedb132b3a964953c12d9becd60b3135a1227696e0
TLSH
T170217190F4E5C827F9336CDA952ACBA20CB47F9F9C586E74120982187BD9C33CD158A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 94df9504e2d61e0db4be98be8aaecf0d39be5ce165a8e1edf13bc14373ccc2e1
MD5 5fd315f8a02a32fad45ca6aee1fb573c
SHA1 d638b6d5812a69a770e19101334fd081b4ef1fa7
SHA512 18de2e0885a2d92b264a57b14e9c03b9d4dc1eea0ef74fbd0121d8a368eb474dfa61700e22aa25d51c9bc43fe5ca520c47f431947293cdfb2b2e46aa18f8e65b
TLSH
T150119190B4E5D427FD336CDB952ACB920CF57F9FAC146E74220582187B89C23DD258A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/356-104-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/2552-102-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2552-10-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2552-67-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2552-45-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/2552-21-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download

memory/3420-68-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/3420-46-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/4908-2086-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download