887daf0b4eab4b571412e3c4300b44ac9dc06d033185d2140fc874fe1cf62968

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
Size 2.9MB
Sample260828-klbmlavybt
SHA256 887daf0b4eab4b571412e3c4300b44ac9dc06d033185d2140fc874fe1cf62968
MD5 cbbe3a228ef552dd71bd258c05dd1ca7
SHA1 cbc132a2cd72315968e8d30b5907443f05430867
SHA512 a4338c0a38fd0089bac3fad20c66b25f2272b19f2fc4d05b854f847f8a85ac63ee09da3de594c69371dda741a7fe8f7fb43053f11dc4f87111bab25dfadd40df
SSDEEP 49152:U+ES+Ej+ES+ES+Ej+ES+ES+Ej+ES+ES+EYC5E+ES+Ej+ES+ES+Ej+ES+ES+Ej+E7:75r5Jp75
TLSH
T1EDD53A09FA834071E97755B04CDFD3BF8D347A2187218EEFE609971B6932AE1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
2016	svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
6128	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAACBBAAACCCCCBCBBAABAABBCCBBCBCBCBABBBAACCCCAACBCCBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe"	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABCABABABABBABAABCAABBCACCCBAABACABAAABBBBACACACBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe"	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5600	sc.exe
1284	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1848	cmd.exe
5756	cmd.exe
6060	cmd.exe
5012	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3612	schtasks.exe
4992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
2016	svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
2016	svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
6128	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
6128	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
Token: SeDebugPrivilege	3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
Token: SeDebugPrivilege	2016	svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
Token: SeDebugPrivilege	6128	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 6060	2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe	92
PID 6060 wrote to memory of 3612	6060	cmd.exe	94
PID 3544 wrote to memory of 6076	3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe	95
PID 2812 wrote to memory of 5012	2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe	98
PID 5012 wrote to memory of 5600	5012	cmd.exe	100
PID 2812 wrote to memory of 1848	2812	2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe	101
PID 1848 wrote to memory of 1284	1848	cmd.exe	103
PID 3544 wrote to memory of 5756	3544	svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe	106
PID 5756 wrote to memory of 4992	5756	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_cbbe3a228ef552dd71bd258c05dd1ca7_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCCCBBBABACACCCABCBACCAAABACBAAACACAAAABCCACCCBCAABABACABCABBCABABBCBABCCAAACACBCBBBCACBABBBBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCCCBBBABACACCCABCBACCAAABACBAAACACAAAABCCACCCBCAABABACABCABBCABABBCBABCCAAACACBCBBBCACBABBBBACABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe" start= auto displayName= "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe" start= auto displayName= "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABCBCCAABBBAAACBCBCBABCCCCACABCBCACAABACCACABABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBBACCCABAACBCBABBACBBCACABCBCBBCBCABCBCCCBACCCBCBABACACCBBBCACCABBCABCAACCBCACBCABBCBAABCBCBACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCBBACCCABAACBCBABBACBBCACABCBCBBCBCABCBCCCBACCCBCBABACACCBBBCACCABBCABCAACCBCACBCABBCBAABCBCBACACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABACCCBCAABCCCBCCCAAAABBCBBACABAACCCCBACBCCACACBBACBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ca15540491cb35ede3e9b7eefa8a47c973895d28178a11b12c6296b78983af41
MD5 052d3d1c25cec21957b13843af625e5c
SHA1 61017cdc474ffd8533fa6ace3e29c8ce6aa6ed07
SHA512 e6b393c95bdd606d7fe296ebe81a1165dc25f49ea7cb603bbd26e007e1f7a169b6db861de215be33e04f18cc9fc000b2fd52346c97bb031e94c9ec0c9ccadb98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft OneDrive\qap`g`v~dtlq
Size 10B
SHA256 a5766d2a721edf63743a9595038519f40b79c362d0061147382bdc321f21f891
MD5 ab4e44efee0080cad0b28249716649de
SHA1 c0e215c9a7bd802e299661e2cd3ab71579f37b3d
SHA512 feb5b19af0f9c8b2c67385693ab95243ab78fef0035cf04894acfb797b03badd8a648222b22ba4e43329f0e416be58d67e271f1053c92542095f8329ac7e12bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 61c389b81cda539304629a5690028fe8e7b7adf640d63f24c287a8655b95796a
MD5 6c2d3bdba9cc285be8667ec52bd0414b
SHA1 f4067aa4cd93d7d2900b9551c27c7294d30a7ede
SHA512 7ba19099634bc381350a9f27219d0632b98d2edcf1b1f8de781fb6032bc66da8769feb0cf6fc780a6c5459c8ebe9341ebe3c6722308cdd49b56a8bf90a75ce49
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.5MB
SHA256 00a51a69e2e68ee0b86b8b1046ad0cfc71646f14828376e8355ebde9725e270f
MD5 9802490a291134a70a39a61e396610fb
SHA1 5a2cc2b43eae5b00a4b9d40efdf6dc070b7525d5
SHA512 84a64b70cfde2a1028e2a2c5ecd932e2a42a645998a54c012d74e21e0b872030cf4037cc25ffe6dcee2c58fa2695fad66db94cbc7bf61e417f4f0c1d108a7231
SSDEEP 49152:U+ES+Ej+ES+ES+Ej+ES+ES+Ej+ES+ES+EYC5E+ES+Ej+ES+ES+Ej+ES+ES+Ej+ED:75r5Jp7YgZ2Hb9t+2xS
TLSH
T1F0F56D18FA830071E97755B14CDFD3BE4D347A2087218EEFE749DA1B6932AE1A439316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 e1ccfe91d9878208715a482b278ee8d3c93e24a6bc2a5ac2ff354b0eeed96991
MD5 4fe9f5b2aed432a2af005847610a8b2e
SHA1 0a4ce03ce8503829c5316c3954e62ad52723b3fe
SHA512 c29f142d2a1cd5a273e5146207d889967437ff701b9d59b55de1253896e4428238aa66a5909ecc299a7bd68c78811fde4233fabdabcbf68bb64e3c704f38b9cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\qap`g`v~dtlq
Size 10B
SHA256 a55ccbb686d96666f46204473103d07d8dd6f8d3ebe7a9a08005e5a9e33e3467
MD5 5e296f3e974c53b6b49cf4c969b8e168
SHA1 f8ec05d7aa594aca4fce1635c8a4e26ebe7dbb13
SHA512 6b3e4893e352a0266e06ddc6ebde1a18044801d15d2ab673be7924554155753aab67b6b7c71457ae77af1399d58066ce01d7aa949e50d4aeef6d584d8385137a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\qap`g`v~dtlq
Size 10B
SHA256 d1fb2f3c8eac997be902bce6553412a3ad13492b6fbcff323c83614c32274a07
MD5 7b1d6390c5be5e8880b0b0f789d3996c
SHA1 cc909fc78df1c57bc42d58bc378a9acd7f44b136
SHA512 879f850d9a20629e0c627fcb301c00e01eef6f1cf510e4687ed6671b9596ee53caf5803a4e47c96f5a2f675bc58ca63ceeee82e0ea82a43d2539391a808e9002
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b70ba76212a5af3e7efe91df6807274da65a87fa29dc6f9dc8fd9fceaebcd09
MD5 7d6fae3d8f2a43f043f5bcca21857c61
SHA1 a402bd3c3010f1ae8404c7dcd7a51885a6c8d956
SHA512 2ecc67e895d3bc996b74451be1003f8fb3ab9b192168d7c47becc495282d01a6029bbe5f435eb4a3fe43cc4f8388b24ab89db46bccced03faa25e2c8efb19f3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff8f1ffa34105d88d2145b8492abac2fbf2a6b5b7621c3d0f528824025418ddd
MD5 a46075bd51a967a5d65b113601c64bb2
SHA1 5cd0518d768569fdb1400a1ba196c39547c1eaf3
SHA512 e021a79b0db0f2203950d0aaee1e0c3b540a9fa3f590e49830059dc83953f8f4f38b710388d3e03e0ed2c55276dbe30c22455d55e3f6db1e39df19a480b9fc03
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c822550baf940e40c622bdaaadbcc7d3ba2f857809ad59773fa59e7dc715c3f1
MD5 42fba3c16c1629b24c6fe3698f8c7ebb
SHA1 c1713a511bf98f84f807697b5d5dff57080ba993
SHA512 911ae9bfcc7841ee67c039159e9781efc83a161fa5a6655d5970aee09538011b22ad02a5e9e058dbe1927cd4970ebd78b4c8f7a2cf51e1b4005bf2290fafb12c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6793095d34206a4cab01a4fb148469a2f05b8f3fcc94317e7d45bf3445872128
MD5 2521bae63b74f9632fe2916888a41e9a
SHA1 232744e99db1f665063950603500c75f3cae47f6
SHA512 b45176ea58100375aeedc14bcc6fe5b507e5ba7e790f74d48727f7446715b18befb08c6ee40a1d0d0abc453ca20d42a01933b95975d4173bff8dee5d6dbbbd0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 611e3564c6b54d0cb6e0f6bdf434b6fb4953e2b967d8580e4e6a1fa5b8c97a79
MD5 a746fbf227b26ebef9a7716ad8fdd428
SHA1 68ebece35d539cd08079a6974c3f04a108408557
SHA512 258dcd005f8c33d73b530ed52454c678456407680ac4b6336bb4d63f423bae06c6127a942f86df77316c9f9e5c8e5d8150d916aa54b7638b0d4f158e70374ddb
MD5 SHA1 SHA512

Submit Download

svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABBABAACAACBABABBAABCCCABAACAACBBCCCCBBACAABAACCACCB.exe
Size 2.9MB
SHA256 887daf0b4eab4b571412e3c4300b44ac9dc06d033185d2140fc874fe1cf62968
MD5 cbbe3a228ef552dd71bd258c05dd1ca7
SHA1 cbc132a2cd72315968e8d30b5907443f05430867
SHA512 a4338c0a38fd0089bac3fad20c66b25f2272b19f2fc4d05b854f847f8a85ac63ee09da3de594c69371dda741a7fe8f7fb43053f11dc4f87111bab25dfadd40df
SSDEEP 49152:U+ES+Ej+ES+ES+Ej+ES+ES+Ej+ES+ES+EYC5E+ES+Ej+ES+ES+Ej+ES+ES+Ej+E7:75r5Jp75
TLSH
T1EDD53A09FA834071E97755B04CDFD3BF8D347A2187218EEFE609971B6932AE1A438716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f88bc87e753141801bf383a21e67d9ec4e32abbf7855e4e5e7d13cd982ec3fd1
MD5 08df9881eb46133cacbbc258336d2e91
SHA1 dcd74ca93a568964e87b52d3f23b3894cc20c1f6
SHA512 0f5d5a127e77347624373af054fdf9c602f8dc9199f94e9d07d10a110fd46d155bde610c5775c2dc79446d6baa0653c2754a470e8df48eb436cf215490e88733
TLSH
T1AE113621F0F5DC57EA33288F56259EC26CD037DE989C6E1573064218ABC5832CDA55E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 09f86eb376027980e90d61bae457e50f47a3aacabdb522325955fdcbb1d8e2c1
MD5 ec0271412012bf5f574e412aa110c141
SHA1 c146fa991c5a34081e0053825ca8afe2e43523f9
SHA512 52df9d8899b768673c7c76a352e4210acd858aadb8827e874f779edb21449ceac2200ef78c5e652bf811cdc11dfb419abfaff5f895ae8dac692e4631ef016002
TLSH
T108213571F0F4DC97FA33288F9625AEC368A0379E989C6E15B3064218A7D5832CD955E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2016-78-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/2812-6-0x0000000000A50000-0x0000000000A71000-memory.dmp

Download

memory/3544-31-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/6128-949-0x0000000000190000-0x00000000001B1000-memory.dmp

Download