0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Size 9.8MB
Sample260910-ac3plsscre
SHA256 0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05
MD5 12e7eca4f1734d559a6d6e702a0218ea
SHA1 0f6ce7369b789b5c9a868650b5e7e1d639963d62
SHA512 043624f2e8dbc625354e930abac6cd4da68cd697cde678351234173f423202db4d82330fe8ae1f198404bce8de27563aae5a12f7f2598c1e568d81676d862afe
SSDEEP 49152:U+ES+E0+ES+E0+ES+ET+ES+E0+ES+E0+ES+EEDd79WCj+ES+E0+ES+E0+ES+ET+b:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabg/
TLSH
T108A66C18F9834076E86B40B04DDFE2BE9620BA229B014EDFF7CD475B5D23B916534B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
4052	svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
3800	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBAAACCBACBCBCBCBBABBBABCCCBAACCBACBCBAABCABCBBAACAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe"	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCBCBBABACBCABCBBBBBCCCABBCACBABBBBAAACBBBBBBACCACABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe"	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3000	sc.exe
3024	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2200	cmd.exe
4612	cmd.exe
1828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
4052	svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
4052	svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
3800	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
3800	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Token: SeDebugPrivilege	2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
Token: SeDebugPrivilege	4052	svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
Token: SeDebugPrivilege	3800	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2200	4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	103
PID 2200 wrote to memory of 2724	2200	cmd.exe	105
PID 2964 wrote to memory of 1428	2964	svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe	107
PID 1428 wrote to memory of 2760	1428	notepad.exe	108
PID 4724 wrote to memory of 4612	4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	112
PID 4612 wrote to memory of 3000	4612	cmd.exe	114
PID 4724 wrote to memory of 1828	4724	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	115
PID 1828 wrote to memory of 3024	1828	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCABBAABBBABBCBBACCABABCCAABCBCABAABCBBCACABBBCCAAAABABBCBABCAACACBBAACBBBBAAABBCBAABBBCACCACBCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCABBAABBBABBCBBACCABABCCAABCBCABAABCBBCACABBBCCAAAABABBCBABCAACACBBAACBBBBAAABBCBAABBBCACCACBCAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe" start= auto displayName= "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe" start= auto displayName= "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCBBBCCCABBACCABABBABCCBCBAACABBBACBABBAACAABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBABAAAAABBCBBCBCABBCBABBCCCCCCACCAAAAABBCBBACCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4466e60e81f1ee4da4b8c97c213b422632d874404fc8cc758c6a01767be222b7
MD5 7b5bceddf326ed00269da93d67f5fbc4
SHA1 2a2bd241645e64abc5aeec845bb3736ff243fe0a
SHA512 8a1aa100c9a593bfa1b3991eea879b2cbbb2822d075ca8cb2f79d0b154db68e317382ad736dc0d90c846715ffa6480bdffe454cef728e6226f76057b42cac05a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 10.2MB
SHA256 e1eb493b79197d1a5b2fa5f9e15b9334e87caa40fc3949269ca0dd711b9f98ef
MD5 da67fd0823ce37bd04d2d5cabc7d6289
SHA1 da5c2673f5a68f538da3102922f91ef0831e4aab
SHA512 6f60f5fd1a8e7f5607ff53a69e957bc91cb0ec3918f2057d9a83241efd75336e24bb722c8028875fe48c2c6cac28af67ffb3fcac9830179a07d66c1acf2356a8
SSDEEP 49152:U+ES+E0+ES+E0+ES+ET+ES+E0+ES+E0+ES+EEDd79WCj+ES+E0+ES+E0+ES+ET+d:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabgEpiX
TLSH
T185B66C18F9824076E87741B04DDBE2BE9620BE228B118EDFF7C9471B5D33B916534B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows NT\MSFax\ActivityLog\qap`g`v~dtlq
Size 10B
SHA256 bd63d744f3a4905c30c9b8a3b605f6fb41c6830c0a202ddeadcf42727a6af51a
MD5 d3f435c4ed99fee981e5437f451c6894
SHA1 625d1bfce08063a7af0c69ec0e1a516659dbfffb
SHA512 605ac2a3e72f3893fd967f8ee562a75cc136ac656f6b94d59d51368ac03bce36bcf4a8ec98951a06e7d0c3ffb02e61fadc6a06625462dc8049c20eeb8a622e4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 575d8458eebb822c333e1e371d846478e3275af3e75227a3101a1d2a902a1980
MD5 edcb3f14612134a58ebe3a95ce61aeb3
SHA1 7c85f07ec34b6c4d54312c69ebcf7e92d95ea087
SHA512 de890edf9de6792115c53e7b981e81c88e4a04d888568fef6823019f0b600fc75ad1cb880da2d17939a4b183d0708a24d2751e764579eb39bf996b84cb22c6c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ms\qap`g`v~dtlq
Size 10B
SHA256 a7d08b32f0475d98dbede5cee29b9167e12cb894ffbf498330d69e6c515a99b6
MD5 baa6237379e655f752bc6700cf723715
SHA1 ad955d4eebe45e48f683e706fec4daf32456cb47
SHA512 db180aab528be6bd50a3625891b8e51dd605bf11c2e10392e1e871c4b712a8c3787beaf1459d939911dda4bcd85d32cef47065416b3d33686b5748a4970ba7f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 b78f0f4257c9e18c71b005ceb06d984e3656381766948d9905777628ace65d19
MD5 c39cffc0f9d84f5fdb8914eef5fe0031
SHA1 dbb7eed2c63ac0f4357874a6b27bbe1d5c8d1098
SHA512 7ae8af9312717707c03403b1650a7f048f590bb71952c8f1da0ca19403373c4d7a35d2bfd9d5ecb9d6030b00a0e96f52fd6b741f5be1f24fa3f257859afd1945
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 178c586d2b6da1038936325d1ccb427e62b5a87a8d70364331c1c68000c6f145
MD5 43f5b56e39d8d36dd6e3868a471ed019
SHA1 51bee2516a18455a7d1842808a1efee152bedb62
SHA512 045423d989345af1eab71d105ce7216cb353ef7e3087a4a8921f1c641fa0d562776a5b5cb6b64675818a77cd1732d9807cd1d8da1ec3d059cab328fb717c40fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 effb73d385c67fb46acf0d1977c1eba06a67ff6d69aa25b646140a6f78c4542a
MD5 58845adc21a700a3db9a4a638dd965c0
SHA1 1de88d675550f0b5f7a6e052e43a837e57941778
SHA512 ed66ab9286cb2b707bc8c33fb13ba0786a987174043a2906708eed4979125b76d370339fdfcb40ff52d5a371e12527e8c501ef847d99bce832e7a49a9c4eec4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e420a42d2fab864b3a89fdbde8fc913534e0c7789b160249e6dce55083385313
MD5 ffe63dc7d0022c1cb40a49d4d182ad5b
SHA1 44de534739331de55b9aebcd3295e77c7265bfa5
SHA512 fa5a1c94b87395cdb9fc207bd04587a93d4e6695ac09b765398b095eb0ee3a0780288a5f88c7d7a99774c9fc6906da664d598b16548910c7c306d67d410c1e83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47526bf4f9f13c6e2c27785a65bd4689603fa91740d5d3a7ac738537589502f1
MD5 931fb7b93ea02526724d5cd56b830f48
SHA1 a492f5ef0195c168c9252abf83985a876a11a9a2
SHA512 767ce1bd661f8fb561471d57a6d2d502754cd3bb8bb6238a7e6fbd18e64d5a52700cd3ca569424bd5940bb9dc810ed272145e654f067b992c7bf488b1416d652
MD5 SHA1 SHA512

Submit Download

svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABCACCBABACBACCAABCBBCAAABBCCCCAACBBBAAABBCACAAACBA.exe
Size 9.8MB
SHA256 0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05
MD5 12e7eca4f1734d559a6d6e702a0218ea
SHA1 0f6ce7369b789b5c9a868650b5e7e1d639963d62
SHA512 043624f2e8dbc625354e930abac6cd4da68cd697cde678351234173f423202db4d82330fe8ae1f198404bce8de27563aae5a12f7f2598c1e568d81676d862afe
SSDEEP 49152:U+ES+E0+ES+E0+ES+ET+ES+E0+ES+E0+ES+EEDd79WCj+ES+E0+ES+E0+ES+ET+b:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabg/
TLSH
T108A66C18F9834076E86B40B04DDFE2BE9620BA229B014EDFF7CD475B5D23B916534B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 192c23a223e33d8c720da86498a43393c6fdf9d96eceb03c23f0ed73a5770dc1
MD5 fecf62018c756a20a162616d051aa4c1
SHA1 f4ffe0b49befaee541b542246a67798e2eafc9c8
SHA512 593fb1aca8c742494325cde900f1fa03fb12f33b9302045a9efa17b57fab4077ace99f8512009094dbfbf247d44b8908f5894b0a5c760ec34373318281f36957
TLSH
T18F01C461F12ADC53E032A4DBE6055BD70DD837ABBC589B4423094218EBD8C36CF158E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7408984d550ad8a4060ffaac590960ffa3b5af3b42c05c7ce7e47a6e7a797c97
MD5 1998585e990e132eb5edc24d0459ed2f
SHA1 f1b603056522b60005b63ba1be0926c49392d62f
SHA512 a687d6d48bc32c1b790b87a861cf680c6e9b4f17898c6c687d7bd18f508b399334bac8bd20e93f27481c1c5ff12c632d36956a19adf57f497e30a2ee2dd5171e
TLSH
T1E8219561F15ADC53E032A4DBE6055BD70DE837ABBC589B54220D4218EBD9C36CE198E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-60-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/2964-36-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/3800-1148-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4052-79-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4052-1141-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4724-0-0x0000000000610000-0x0000000000631000-memory.dmp

Download

memory/4724-7-0x0000000000610000-0x0000000000631000-memory.dmp

Download