d1b04db715663825ebbaaef1cd9ae639382205e1f7296e6ec9905831b95f324f

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
Size 13.4MB
Sample260826-fmhp3ssdkc
SHA256 d1b04db715663825ebbaaef1cd9ae639382205e1f7296e6ec9905831b95f324f
MD5 e45fdc7746c91116b60548a0e6c7056a
SHA1 0e60553bf6287eb9b351a8fc82e40ead7fd5d91d
SHA512 3b6998a04acbb65e1b7c0e4cc84be866193ed09f9be5619ebf86e04b87171db12f40360aa291e7af6118a55d914bb5d5deedd3631cf306dcb91b57a736106dfd
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESz:tp7o
TLSH
T106E63C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
2152	svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
4520	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCBABBBCCBBCACABABCCBBBBCCCABBACCABBBBAACBAACCCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe"	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABABCBAAABBBBBCBABACBCBCCCACBCACBCBCAAAAABBBBBAACCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe"	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5976	sc.exe
464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
2648	cmd.exe
4256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
2152	svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
2152	svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
4520	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
4520	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
Token: SeDebugPrivilege	6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
Token: SeDebugPrivilege	2152	svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
Token: SeDebugPrivilege	4520	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4256	3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe	91
PID 4256 wrote to memory of 420	4256	cmd.exe	93
PID 6044 wrote to memory of 2076	6044	svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe	94
PID 3960 wrote to memory of 4120	3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe	97
PID 4120 wrote to memory of 464	4120	cmd.exe	99
PID 3960 wrote to memory of 2648	3960	2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe	100
PID 2648 wrote to memory of 5976	2648	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e45fdc7746c91116b60548a0e6c7056a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCABCCACBABCAAACACBABBCBAABBACBBABBBCACABACBBCBBCBACACCBBABCCACBBAABBCCABBAACBBCCBBCCACCACABCABAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCABCCACBABCAAACACBABBCBAABBACBBABBBCACABACBBCBBCBACACCBBABCCACBBAABBCCABBAACBBCCBBCCACCACABCABAABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe" start= auto displayName= "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe" start= auto displayName= "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBABCBBBCABBACCABABBCBACCBBCABACCCCCBAAAACCCCBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACABCCAAABACCBAABBBBCCAACAAACACBCAAAAAACAABBAAABCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 80446ffc915148a7efa1ec0e4e894478bea5269ad185f3e4d34400c4bfba55b3
MD5 b4f980628ec8b31a4a4f3bdffc9e075c
SHA1 578569357adae0d93643e53e06ed5e0ca688f05d
SHA512 12d7f859dbb68ccc833c03b74821546f3323edebb2b7c73862bb1cd9f0f5f83e2c55c12644a1d143e83c44ba6240ae33c2e286f2decf90954ea81c65370c629b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\AggregatorStorage\AggregateData\qap`g`v~dtlq
Size 10B
SHA256 ecae9778d6493685b1975da8c394a6fe0c9826204bba69eea61be5723240aa22
MD5 9c9438bc87281aa5e373d2bab44ef425
SHA1 465c3d835ebc431736df3edd28b051157436023c
SHA512 399b0e6c4393f3438b80a8ed692f8c6f2cea205a03a0bceeef93bccc24f11f8c5ccf4c41a36b07231e381d90737471dedb6eccf0454ec4086f10af78cad74c34
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 14.0MB
SHA256 680a646f0f8c0a2de52688817134612e01ed79ec72a0960aee1099e6734371c1
MD5 8c3bbb521ede3c01867554abcd71e79f
SHA1 f841a9f9e527737eec7b2dd41d125e2e64e2808d
SHA512 e777e91e5fdfe83a2be3b038485862ab2bc35a02760ee4508af102f66ce0fc4c6043c74dc0e0cfca72efdc0e5f4cabdfcafb0ae15b0e1df3b08ff87769e8c1ba
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESD:tp7ngZ2Hb9t+2xE
TLSH
T111E63C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DCB5B6933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 abd85be0dc0e5d5b56e860e3412f8e16cc440149c2f1db9e82a211a018528822
MD5 3799d6b88c36d0a9cf0a22168f2ff67d
SHA1 42ec07d82cbba4277e2eb55db0ffb38b55c8d039
SHA512 44417e33af41e9b3cfa376451ba0b01245b0b8f5c797a3c762dec653a0f7b49340c67b50fff59ce585a68c68be630c1ee654c7c3749dd2ab233171b5913ca4ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 57bdc6e5d9f13145540bb1e3f1beb6835a5f51ec161fb33388cf04da0aab7cb0
MD5 62c889fa9d4c2ed4b60c2c87c141b12f
SHA1 271b4577f882712189dbabcb33d4060d83eb00e0
SHA512 c5e5d8832ca8b760d30441a55d2b442674dfb669405c92b80bb6a254a6f89af7e5b6b19312ffff26aab7b33f8bb9120d2efbd24838068c4bbb9b187e05022910
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 f95dffd2f28171b0ecbbaf6699ffdcce508ddbd26a846de30c2209bb6f3de5d6
MD5 345a686054fdf0a229d7d02f55a52e5e
SHA1 b444faca4084c62300e96bdbb0dd2e0891a565a6
SHA512 d9f101164d3128f38077e902c4536ee4852bd2b71e04d4e9b53df5ee43609a799fce3e83cac1240817a22c4ac583fbd2bd3bbbc2c422240a2ebc12d4ece6b7fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 a17809d58342859aeacdfb7f67370aae0c11b4c320046112719ef9d399627de1
MD5 185d5860dc0cdd7f0d4ba9a67c187264
SHA1 ffbb2cb2ab3dc529ac05ebb3777b6c48128cf211
SHA512 2326715f71ce432dc7f6ed39e03ecbc4e1b3d97a8f92661d77eaf8f590d2b9d9ddbc4134e9f3a180c0b2a2027ad13a63344e7e6c786c6640306062613b5fc376
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 3f73af1bf6fabb19f7edd97b6fb9512ec002d828d39f4f0b00f439e9fb42e6f0
MD5 97a7340e822c4f40497ff1f1f82ab12a
SHA1 153445d6b4621c6470e1238743164411b135fba4
SHA512 6322d6193dad3fea3bb82e48501779d2d29034062eae7a0c6016f490fc0bf219a6e8b3728750828152050c102446794755bd8e9924fb0d5000dbc3e0b1f1a089
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 a3537dcc5596de3bd217cbf952de5e97b1be7edc1268a304f186e92dd30cdd08
MD5 3ce12bc4f3c1e64dc0e9428fa1dc997b
SHA1 af944b20382122db03e51c8d8c6f3142a866556a
SHA512 0f3de8ab8b3ff71f68030e4ec650dee881811adf607afd86eeb5000cfc48aaf8a69769599ec0431e6f3914085c3635a68d62ef10adc8af8acba90e1b9a9e0d55
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73fe8b55eb57dc4d14313eb624c89acc27977a3dae7153bcd5cc3bb4a8baab2c
MD5 aa5403a6a080658761c632aee74e497a
SHA1 dbddf633770be1eb035042bd94a91cf238137f83
SHA512 2187ea6a513aeb0038ced7aa76b7e3f08802906f5b8969e314ac7555f58f58eced6286bd3f5d281b43778dbd39483fa9d13c4fb197fcc6d10e125094a832714d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec9e793c9cee84834b1b536a8c01c397480c0e566ae93d20e00d59693a5ec433
MD5 abdab20637b53392fc0900e9df62419b
SHA1 c24adb0a446731d2a30e3a9be65f1d905e560f07
SHA512 7148869cbcfe93fd14ef1773436443131c5533ba4c025df1f036ec3e1607fe72a5184699f015f1a8218b0cd3a7dc39ca0c48248705f4700b3310b01c75d14dd2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1462877f380ec2eddb168e028e0a1c033ee79c12cd70a093c46d62f8d77cee07
MD5 20a9fbbedca9971bf03c1d421b8f933f
SHA1 feb8b79154647ead49ac962cdc075c9ef556398a
SHA512 8f90f415b2934fcc9d1fe9a4c13ea7cee0c150d559c3106c0de81974ee05084beee67a75b10b90775ec00a9aada0bd2d67533b55bd35b718bb6daa49379e5ffc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 75478afd09502019fee21ba6612547c02cf7e284497bef63b15aee5adf6559b9
MD5 a7ce123f895d387bed2f7496deca0fb0
SHA1 b267c7958a547caf480b47acc28017c6309c7925
SHA512 55e0d6ae00757432cb6abc706041b05588af46dcf07c16e7deecea5e9baf3a489bfd1c15ddc4e56a42c81b6916572da7c81b782c9df92e87c2479be92eef32a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a4cf886aa405b97fff4f6d861c8952493855cda0077803d369008bd095f307c2
MD5 e238ee76f740943d3d3734e96cc10a8f
SHA1 e6392c35ab71ebc809e7cd2cec8133ea16d6db32
SHA512 c4272e6532879ed5d51c765778b436ea4ec3a43dde69f0e2e302505665b158a27e90cb7844141429566802ac725de1a4e198203855139385bf2c4a91edaeb491
MD5 SHA1 SHA512

Submit Download

svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABBCCCBAABABBCACAABBBCAABCBCCCAABBABCAABCACCBABBCACC.exe
Size 13.4MB
SHA256 d1b04db715663825ebbaaef1cd9ae639382205e1f7296e6ec9905831b95f324f
MD5 e45fdc7746c91116b60548a0e6c7056a
SHA1 0e60553bf6287eb9b351a8fc82e40ead7fd5d91d
SHA512 3b6998a04acbb65e1b7c0e4cc84be866193ed09f9be5619ebf86e04b87171db12f40360aa291e7af6118a55d914bb5d5deedd3631cf306dcb91b57a736106dfd
SSDEEP 49152:U+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESz:tp7o
TLSH
T106E63C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0b850fa2ffd67947136e4972de056309a79ee00bb7526cb5d2a04e2123a52e8f
MD5 b55ec9971e04f0cff931fb9a72918f33
SHA1 3495d64fa4276aa66e57c986a87ead0e05588636
SHA512 9eca5eb3564f5aa77f2533b45bff91088f446f64bb565ab19a9df1118d530480aadb476d7d6bb7ebacb868864d93639ef521319ee7f5100222de249877890ff0
TLSH
T1FF11043150FBE857FA732CCBA219DFC31CE537EF58986A0413049218EAC5C25DD56AE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f769407979e625107e296a7ecf8b4468164378f93de758588c686e0ec79f861b
MD5 0612f33b970f115eec3d13269c04e5e6
SHA1 bc0d5e60a57ef1241416f1578d51e4a6df51c3dc
SHA512 51869dc764c252cecd08ddb0aac6241a98cda560e107ba3c55f2ffafc6bad8176d595600c5ed77c98ec7af7a07c189235651313227d8951ee9ee6ae6058a2e1e
TLSH
T10B21077050FBE453F5736CCB6219CFD31CE637EF58986A0413059218EAC5C25DD46AE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-80-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3960-0-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3960-7-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/4520-1548-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/6044-33-0x0000000000130000-0x0000000000151000-memory.dmp

Download