787af7552051260bdd8c22df812dbd9a80186fe62f827a60f158547c94028faf

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
Size 749KB
Sample260904-3d4yaabl7s
SHA256 787af7552051260bdd8c22df812dbd9a80186fe62f827a60f158547c94028faf
MD5 b8c6bee3e6f8b4fc4632804974527281
SHA1 95747c1bed44c66a09833bb5079816b4808e0080
SHA512 708d40b0b81be043313106f050076b0f4f78c0f10fb68356c02d0a04d1c83935429fe12e09d34bf77d04962b4acba72671a30f2a530f917e55fdbace8557b130
SSDEEP 12288:mgUFgEsnojAAgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oIVrYn5vW:m9+EM0v9+EM0JafDd70iTWCVrYn5+
TLSH
T1ECF46C2877C25131FA7354B589AFD3B96D3479300B2487DFE644B7295E22AE0E83D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
1980	svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
2600	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABACBBBBBBABABAACCBACBBCAACACABACAAABCCBAACCACABCCABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe"	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCACBBCBCACBACBCCBCCCCCAAABAACCBBBCBBBACAABCCAACCABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe"	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2228	sc.exe
5300	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5856	cmd.exe
3960	cmd.exe
1524	cmd.exe
4308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe
1396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
1980	svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
1980	svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
2600	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
2600	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
Token: SeDebugPrivilege	3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
Token: SeDebugPrivilege	1980	svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
Token: SeDebugPrivilege	2600	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 3960	2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe	92
PID 3960 wrote to memory of 4116	3960	cmd.exe	94
PID 3360 wrote to memory of 5524	3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe	95
PID 2440 wrote to memory of 1524	2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe	98
PID 1524 wrote to memory of 2228	1524	cmd.exe	100
PID 2440 wrote to memory of 4308	2440	2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe	101
PID 4308 wrote to memory of 5300	4308	cmd.exe	103
PID 3360 wrote to memory of 5856	3360	svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe	106
PID 5856 wrote to memory of 1396	5856	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_b8c6bee3e6f8b4fc4632804974527281_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBBBACBBCBBCCAACCAAABBBABBACAACAABACABCBBCACCCABCCBCAABCCAABACAABABCCACCBCCAABBCBABBBAABBAAAABCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBBBACBBCBBCCAACCAAABBBABBACAACAABACABCBBCACCCABCCBCAABCCAABACAABABCCACCBCCAABBCBABBBAABBAAAABCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe" start= auto displayName= "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe" start= auto displayName= "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCBBABAABCAACBACABCBAAABACCCBCABAAABCBBBBCBABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCCCAABCABBACBBBBCCABACCBBABCABCBBBAABCBABBABBAACCCACCACBCBCBCBCBBBAABAACBCCBCACBBAAACABACCCBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACACCCCAABCABBACBBBBCCABACCBBABCABCBBBAABCBABBABBAACCCACCACBCBCBCBCBBBAABAACBCCBCACBBAAACABACCCBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBBBACACBBBAAAABBABAACACBCAABBACCCAABABCCACCAAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a9a024e4d159a9b2468fe928545c7f0a4292c6923dadd3c051e5eb6cda46ec0f
MD5 8f79c70c612e58a7f8fa18a575b43b22
SHA1 fd0219f59372f0e2882df6b1f76980ce3c8e353a
SHA512 b5de3aec2c3588547e06c1c6792aeb3901def16e2618aed8e2b22c6c70536d0e79c62d94b9f686c8b72e27b4661fe6c0155dfe4a2adbe863c144f12e031164d0
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 69bffc6183df38d52aa2a20e376165b96ef4967b7b99109c85d66e718416c0f8
MD5 36f38959c9140dd667bf181399eedc2c
SHA1 3ff0615b3c340ed3562dcaa057251491e63007e6
SHA512 f0b61f1229e9f47599a983adc3c9d91dde6915e48d67666bb80401c1bcf3f4c9fc150c99439cb7357fbf40855adba372c556ad607a1628245d572b1cac169d4f
SSDEEP 24576:m9+EM0v9+EM0JafDd70iTWCVrYn5Bm39PZfePv3r7fm6t+jqp+3l+zCM0Z:U+En+EYDd79WC1Y5BgZ2HbbZt+jqpQ0U
TLSH
T1C3559E35B7914032F6B305B2896ED3757D38B6200B248AEFE7C4BA1D2E355D1A63B316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\qap`g`v~dtlq
Size 10B
SHA256 81132544e69880233d3bd2d95ccf38cddb9aec86b261ed6c69a2768f5a225699
MD5 095a694d275c21c7bfe36dc6fc58f71f
SHA1 f2e828be6163be58fccb353d2322d1ad00849546
SHA512 1d9027fc1a8052ea0cc9d9cdee2a831b0b35bae9932bd9e43762bd038becd892f5b020e16c60175692dd3e52fc97f98d8a9bc36073c81460bddbd90db00a7285
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 8e0f7ca8a858e3cf102c3013ea3f72a68d78bb99b6e35ac0728fbf75b37ed72f
MD5 4b89f16efd76ebdc831e5523cd34d764
SHA1 4272eed0fa6b362dfbe75f0b5b4c8277f27373d3
SHA512 c4cd847ad5bd0f8395f320d6472c16354353d364d817ad9d60fbca93ad053e8e4ab3cab3804c2acd6826e07e7a9c8ff2cc351179cad8c63f4515924be7cd6ea2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 29c4f7ff02019b30a101c4de1dbc2a2da5b21da8c63ba4fe29f413cf34612f93
MD5 fa173abb4ae25906eb9ad012a6a7bddc
SHA1 3591c7a879446b198b5c9ae8697ace25b62531f9
SHA512 a9e9ade64f2b187741c8d2c8808e71aa0ae558392333c82accc9f41cf033efcd3b745f6f22dfd54b397bdad65855bea4e4daa676cfd2c2466a404ce55d877395
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\UnprotectMount\qap`g`v~dtlq
Size 10B
SHA256 c1a2ca631ad04e9f532012d366c468f93989f34f3024f5e1680bfb369b8d6187
MD5 fbbf328ec4a0f2db5a19f851d1402f10
SHA1 2bc73dde0b39f0e91b262fc64d3b6db38b3a73af
SHA512 ad57cb92a6fc64dc9035db95f049481872c83cec0411fe0bf5d382e6c00bdeff3090949b72e96c518b554de6402983161b72b35335b05cdc88ce03c7e47528f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52f3713d096e61e2259a53a53a58cd52b1454d118fadbfa511e0310ed31d48b2
MD5 2fd7896df377fa19aa3eea21d56be6f7
SHA1 fcd87360f8bf1ce099e1aed439e68ba22569c993
SHA512 896ee4c0d2e82dfbb8a338cc2fde32e5ffe56e2bcd0002defcc49bb3689fc3ca78f9d0687be67e194f3203504416a48269bb8813c958ba6a3177e4fc13a64678
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a889e4e1d2f6d3fdf7a040af78c077c2dd4012432bed384604cd8b4691c91ad8
MD5 24b4d0b8a8a8c6fafc9116e944e5892f
SHA1 959fef95d55e563310e5ebfe73672ba5e3485cc4
SHA512 383e4a1ecdb8470706304a5cac413028effc48b2ae4e7bfb3ea60269bb106aad4fb655caaddcb1234217130ed00d0c91ec1e4418a39de58d22d0991a41aefce2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c177962b1e3214eb4d23aebc91b744d3e42a1c451a4aa8a4a47e6c8c1c49a71
MD5 dc678da077514efb998dcd9b613b7bea
SHA1 91e10e639993fe5e8e5a91b0493a6020de7c212c
SHA512 612dd970ca5d99ab6b65f5d64a103468d017e23425f6442ef6454876ea88dbf316a41558a2bcb55fd1858a6a35336309e33a985601e2bd032560aaf56446939a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c81f42808ae5e484679f84c4401b61e9886e78f15071fdc4c1c27dbb1d326125
MD5 3396f065d7c10a112c7ab0880d1183e3
SHA1 458a036d3aea5dc338af9636cc2000df7a9a1814
SHA512 22e552e6ea9e912917fcb611bd74f7e9927e83c0ae8ce5f9ad34aa35c2633d98a87a3410a10fee48ddc8cce88dabf401b5bff4483139589863a03e8f12605165
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26b23a0f11222a34990f98f7bf93da4f84cbf26b6e67a76d0f9ff054a36150d5
MD5 6e8e60c7f5da332c223be111f0a3f4ac
SHA1 08e582e91bf58cbfb9a1beeefc0453e6587d1a9f
SHA512 71ca5175a33b4af87b32d8e9fcb30bb3441c61c80ff40de3f6675a0d79d62ebbbeec0a15bc41519f7ecbcbbcfc49dae7d41a6a42ff957fc37b58d74576ff641a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2866aa5e79cd9fd7eb96186644156f589d1674812606a720430bac75eb4ceb15
MD5 d24ae313bb8f42f02df4d45635b15746
SHA1 2d0822c6e4bb939277ccbf1e7a27382a71bf499e
SHA512 78fa0e6ab0614fbe1e1d97baa78aeb4f8775efe150830912b038eb4d05f4f958f611799b1fbb9e54650fd134ab74153109d6af85c9c9d1b94035cc6be002f836
MD5 SHA1 SHA512

Submit Download

svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCACAABCACCBBCCCCBACCBCAABBBBCCAACACABBCACBCAAAABBCBAB.exe
Size 749KB
SHA256 787af7552051260bdd8c22df812dbd9a80186fe62f827a60f158547c94028faf
MD5 b8c6bee3e6f8b4fc4632804974527281
SHA1 95747c1bed44c66a09833bb5079816b4808e0080
SHA512 708d40b0b81be043313106f050076b0f4f78c0f10fb68356c02d0a04d1c83935429fe12e09d34bf77d04962b4acba72671a30f2a530f917e55fdbace8557b130
SSDEEP 12288:mgUFgEsnojAAgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oIVrYn5vW:m9+EM0v9+EM0JafDd70iTWCVrYn5+
TLSH
T1ECF46C2877C25131FA7354B589AFD3B96D3479300B2487DFE644B7295E22AE0E83D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e739c4956c95e2da7ac7afbc797f0be07dd7ce23143e64085139b796031a3cbf
MD5 92ecfbf8fc88c0f9abcf7db61dfd5904
SHA1 189c5da453408a38895cd71b2f66277723beed4d
SHA512 eab24ab5d45284cf6a9b3dbee317dd0e31bfd09c096158738deba159121502b0d7993843ec861e4f7f8613bf3a0730398ca4a224b6a837ce5bb9514c7e60658e
TLSH
T1FC21D831E0F5D8A3F13154DB7A1DEB870CA43B8B985C9B4053095218EB99C3ADD198F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2dd58d6dc105e6937744edc200a4f10d80b8b3c4dffe16029b1583abb21f04b7
MD5 03a71efc7e4c5dbf2423b0f0dd6cf8af
SHA1 7df9923b98a516ed93420045c40498f62b8a1c73
SHA512 8b1949f694ce4f4a5d58a8a838be69faef3d38f0079a958e921720627147aa3bb08e903b9049a34e26b69498fb33516143a8a41b061f2767a52cc93ba9ea51b9
TLSH
T11B110832E0F5E853F131649BB91DEB870CA43B8B585CAB4423054218FB99C39DD198F3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 553eb73e89a78650ab2024be73cbdf3e24cb5bd7d4424c447a03f245425d6f72
MD5 67455f79f551aabd99d2b05590cb60fa
SHA1 044a53074a8e4ebcc7e7fef14b3c483c5d287d12
SHA512 bed0ab20cfb598a8c82f578c6a6ae85e98235a7e276f58b68494b28cb50375421fad77e48c0bb48a4f56245a564062d67f6f36aaff7f791fbe42a0d55ad79508
TLSH
T10F21D772E0F5E853F031649B791DEB870CA43B8B585CAB5423095218EB89C3ADE198F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1980-80-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2440-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2600-977-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3360-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download