efca5e453669d4e2ba96f784f8813f4bd2a28a94a3eddb9c014ca8c9df59d90e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
Size 2.9MB
Sample260827-ld8ssssdpg
SHA256 efca5e453669d4e2ba96f784f8813f4bd2a28a94a3eddb9c014ca8c9df59d90e
MD5 becfd05ccd2c5992207794d5c7020ab1
SHA1 0b363af1458a3cee035f7b6c88dd08f13ded9fff
SHA512 dfaba2b99789894758fb3ebee2fe7bdb355fed3737cbe6148004d1db0f4607ca859dc06280d84ccaf2ae55a614929ed7309eb66f6e668e82d4f833b2fbc27342
SSDEEP 49152:U+ES+EYD+ES+ES+ES+EI+ER+ES+ES+ES+ES+EYAM+ES+EYD+ES+ES+ES+EI+ER+c:Hp7X
TLSH
T170E53C09FA8750B1E87751B04DDBD3BF8A30BE2187118EFFE649D72BA932B905834615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
1176	svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
1124	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BABACCABAABACBABAACBBCCABBBACCABAACCBCCBCCBACCBAAACCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe"	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCCCBACBBCACABABBBACCABBACCBCACBBAACCABCBCBACACCAABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe"	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1984	sc.exe
2928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3676	cmd.exe
3956	cmd.exe
4680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
1176	svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
1176	svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
1124	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
1124	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
Token: SeDebugPrivilege	836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
Token: SeDebugPrivilege	1176	svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
Token: SeDebugPrivilege	1124	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3676	2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe	106
PID 3676 wrote to memory of 4780	3676	cmd.exe	108
PID 836 wrote to memory of 3324	836	svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe	110
PID 3324 wrote to memory of 3856	3324	notepad.exe	111
PID 2784 wrote to memory of 3956	2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe	115
PID 3956 wrote to memory of 1984	3956	cmd.exe	117
PID 2784 wrote to memory of 4680	2784	2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe	118
PID 4680 wrote to memory of 2928	4680	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_becfd05ccd2c5992207794d5c7020ab1_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAABBBCBBABBCCCACCCCBCBBBCCABCCBCBBBAACABABCBBAAABCACAAAACCBCCBCAAABBAABAACAACCCCBACCBCCACCBBCAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAABBBCBBABBCCCACCCCBCBBBCCABCCBCBBBAACABABCBBAAABCACAAAACCBCCBCAAABBAABAACAACCCCBACCBCCACCBBCAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe" start= auto displayName= "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe" start= auto displayName= "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBABABAACCACABAAABACACCBBBAACAAACBCCBACCBCABBACBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACABBABBCACACACCBABBCCAABAACCBABBBBCCBBAACCBBBBCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d7dba12bce2c9deea1695015bb8af63045f5cafa055bcafabcf966f395ab3357
MD5 03e33a55d191b34c0e7ae44899a50878
SHA1 327d2163b8fc2b3ae1b03a1aec8f05b560582dbd
SHA512 fa437944fafd3f071685c70d95bc2681f4f7825569049a293d9e94304bbe0a43b572b713fc3291cbf416871ab35742b91a2f2938695648d484b56dd7ea281928
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 3.4MB
SHA256 8d8d992d2216f784ab74360b5875833f2ce34bb8f3f2b59c755f3ad7ed04bad2
MD5 c3e782d30429176909f73de631a483af
SHA1 1e4662318308df494a0b8539614cc5208ce8bfe2
SHA512 2ab6b966c88732483ba30cdd0181860eb8ae227d8f5e18cf5dca729e231fbb1c76b86d0c484f9bd7011363f277e3d657b09b1bdc3725cb826ecf8962ae16893a
SSDEEP 49152:U+ES+EYD+ES+ES+ES+EI+ER+ES+ES+ES+ES+EYAM+ES+EYD+ES+ES+ES+EI+ER+h:Hp7cpiG
TLSH
T103F54C05FAC650B1E97715704DEBD37E4A30BE218B218EEFE788D62F5932B909834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 7f302521cdf9628646349b3b1107d32da93083d5d9ec0fa8ecf8dec71bf797bc
MD5 1719b0aba286c2ddc98185a7f807f04f
SHA1 c74329f0b3f8e3f84e79a8835676894b29dfdfeb
SHA512 fe5ea9c0fd15c742cf2b7bffb2cdacde22c1c3800eaf11135a15bcc9fc13d6443e1c868c3eb7cb960659ee9249ce21ff673a07be472f97452f33e6508b3952b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Families\qap`g`v~dtlq
Size 10B
SHA256 9220c4b50333dd66cb7a939c3e7e4617796f19020f4a0e5e6055b7dbf24d2c76
MD5 b5397720e8513985afbfc4c65e3cc062
SHA1 271f66db86f61e3975feecca13946d2ad9cb92d2
SHA512 3b5be7bc135b131649d9eb514ce65ebf651a88bcbf5d6d1e9a33361e2618ebcaf81a5e3cef7513eaae827c349b6154bead091875d1cdecb6b2bcd2efdfff173f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\hr-HR\qap`g`v~dtlq
Size 10B
SHA256 6f99fbb62b6d6e3c919187e839c76be3f1ba1ee3cc239180815359be4ecace27
MD5 8fa38c9721c5d2f79e708830007fc153
SHA1 403abd8f82735a9906766c5890fca540d075f250
SHA512 af77ad0fe281f79cfea50a48058814fb5a97654f58e9a41531ea33822f51f460f027ca6c17c83213faa74b4e9559e3f1416b5a41b9be0021bb628c661213a05a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 0cf8d01979566b45773a8fea00902865eca629b3b28ddec4331c3f5771ba7243
MD5 fc932036ff509677f092cff61f7f05e9
SHA1 8da16c3466285a8bcdaa59a39271b6208c9baa19
SHA512 1cd9a03fb83131ce21a0615531880f075e1a76fdaef33aa14bc0ba7387d5036c7c8c69a454d4b2218437179aa5fa24950d514e2a8b4138a328d21e58ea89b2de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7417c89f8cadca881aec135a3efd28dc3019423a4a241ffe3eb0d79df6fde11
MD5 537cec181631351ad5b0a3b16ee0d741
SHA1 a0efaa6f7ee11613fcd91c13596fc26b189c4880
SHA512 7252990a7c0969372ab93587687e01e21bd2fea9deae472602115dc64cd8777588a6c0c001bd27efd1fa0df5313b0e3050456a09431bb444c095a6d685a20eed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ec8e85b8c39c112de6e182d6e883418a6fa1855caeeb175d647cdb0452b9588
MD5 dcabceb5a542783f3b6d681b209ad18e
SHA1 d9b73397e507742b29275a57e9d989ed65d16cf7
SHA512 1d2aefc5cfc4f3dd3b7a08a16a0eb463a8b831719c66358ec24d4b1df7886c2c2532715d4016a38bd5850c8cf13bd045a25d7762f3a0e3e3059f66662a288e98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51f5abb826c32c30fb156e729e7ce34777fe25e13c26e69e63c57841cff59a56
MD5 ed0e4f2f1992fea25ebc7906ed4ec032
SHA1 a89d25eff77069c4ab2247cdac1d0524a4fcc97e
SHA512 6cbf310c0a1784efdc3a3f7410c3f734e636290bf63717b8f1b05c09359a4d93d9b9b1b34cbc67872851dd322124430686f763ff09a0c309f750f6180a29227f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a1f150a6738cbb651eea7ebb4809ba804611ff3ad2b07b8649ad2c2d4558903
MD5 fae8e8286d747a1f15d145ae34e37f44
SHA1 0af48671c20b07b42f0254f4cdf9878e25917b1a
SHA512 8cc88998ff910e5ed08b5d1de591e253f79d0156a7967b8b4d52fcd6ada9b8fdddf3c8c30f94c7ce7cbe305234cee93533b66174fd6d9f86eb3a65b2332c964c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3ae2739fc828ddde103de99288e2dc13a5e1b7635b0a8bb2ec8c4256ab073462
MD5 0e79294b1661392a431eac8c41258153
SHA1 e4a135e3d2f49cd2cc0425f06b3c09bcebed60b7
SHA512 7e8262c3303e69eebafd83db59154eefccc66b93e075180ed363229d77feafcfdacd59cacac6bbbb7d85e5193bccf3d92bc82537ccad10219d383962e36a9560
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ce92481a162b8d94f16a94b94418bef1aa39871171b42f7425469f45974408b9
MD5 fdebcbc15b78fc93bd6958c986e82ad5
SHA1 8f32cde089f22d30b65a670f3cec87a269131119
SHA512 c180351ef74b9f7d685d5bc6b9b1ef702374ac940e2e15a4dcea1eceb0c8db82001bdcba8722addccfec54cad6113b4827596bfb7126dc4eeb1b92c18fc3a344
MD5 SHA1 SHA512

Submit Download

svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCAACCCAACBBBCBCAAABABCABCABCCABBACCABABABACCCABAAC.exe
Size 2.9MB
SHA256 efca5e453669d4e2ba96f784f8813f4bd2a28a94a3eddb9c014ca8c9df59d90e
MD5 becfd05ccd2c5992207794d5c7020ab1
SHA1 0b363af1458a3cee035f7b6c88dd08f13ded9fff
SHA512 dfaba2b99789894758fb3ebee2fe7bdb355fed3737cbe6148004d1db0f4607ca859dc06280d84ccaf2ae55a614929ed7309eb66f6e668e82d4f833b2fbc27342
SSDEEP 49152:U+ES+EYD+ES+ES+ES+EI+ER+ES+ES+ES+ES+EYAM+ES+EYD+ES+ES+ES+EI+ER+c:Hp7X
TLSH
T170E53C09FA8750B1E87751B04DDBD3BF8A30BE2187118EFFE649D72BA932B905834615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 061d31b8cf4a5f16e868adbe823d76aa72dc2cf82510372d328835333aad405d
MD5 1f5f87ee92219bcff59ee6195c572936
SHA1 8075a17649e134ed850e2f04bd5ccd94689b2540
SHA512 bf2e01dc8b497986c3b890eb59b78e80e5766f4a889e16730da3be5d87fdc3ed2040f15bb584a5132f3ba6b021c49efa0473342cbf5980b1078f1e858e1b1dbb
TLSH
T1551104A0A0F59813F93268CB6725CA971CAD33CEADDC6A8823054319A762C20CD514F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 75645cd3282dcaf69357eb39097e26990f4c22806f021bca5434287d143091de
MD5 93103b459f7308ac94c944130cc999f9
SHA1 c309fec6e431395ace83533aac153e51bd08bb66
SHA512 7e74ce66d2b92c5c071bcbb5a8966d84b3ec321332efe9adfd4dc4bb0a323c50d07aafa9084f3d349211936741a0a5127f38bc59ffd69ba79e46159ad242ed91
TLSH
T1482126A0B0F4D813F93268CB6625CA931CAC37CFADEC6E8823054318A7A6C20CD514F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/836-35-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/836-25-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/1124-88-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/1124-2731-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/1176-86-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/2784-6-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/3324-58-0x0000000005780000-0x0000000005781000-memory.dmp

Download