95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Size 3.5MB
Sample260810-cydcysdf52
SHA256 95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7
MD5 6aab8f567fdfb3062512bf6849b0ed10
SHA1 0022f3a47464ad7929c39145fb506b7e1405398c
SHA512 f9391fab1898b945f693903626c2c7026fa66b13c8605c10b9d4ccb104d2479983725da8b2699db4b388180042ec31ff6adc48570649bf78926b2fe50b1a0499
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WCb:Bp79
TLSH
T197068E15FB980CE1F873517C8997C629EA72B4251B21CACBB26C832E2F336D5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
5752	svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
5864	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABAACCCAAACBCAACACCBCCACCCBABCCCBBABCCABABCACCCABCCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe"	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBCCABBBBABCAACACABABABBBCCABACCCBABBBBBAAAAACCCBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe"	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1412	sc.exe
4796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe
5788	cmd.exe
2384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
5752	svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
5752	svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
5864	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
5864	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
Token: SeDebugPrivilege	252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
Token: SeDebugPrivilege	5752	svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
Token: SeDebugPrivilege	5864	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 5788	2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	91
PID 5788 wrote to memory of 2072	5788	cmd.exe	93
PID 252 wrote to memory of 4224	252	svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe	94
PID 2464 wrote to memory of 2384	2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	97
PID 2384 wrote to memory of 1412	2384	cmd.exe	99
PID 2464 wrote to memory of 4948	2464	2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe	100
PID 4948 wrote to memory of 4796	4948	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6aab8f567fdfb3062512bf6849b0ed10_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCBBCBBBCABABABBCBAABCACABABCBCBBABCCABCAACCAABCBBCAABBABCBBBABBABCCCBBAACCCBCCAAABACBCCBBACABAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACBCBBCBBBCABABABBCBAABCACABABCBCBBABCCABCAACCAABCBBCAABBABCBBBABBABCCCBBAACCCBCCAAABACBCCBBACABAABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe" start= auto displayName= "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe" start= auto displayName= "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABACBCCBBBBCACBACCBCAACCCBBBABBCBCBCBCBBCCAABBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAABBACACACABABACCBBBCCCBCABACABCAACAACBCCBABBBABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ParentalControls_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 eaf60e839669b90f663f26c6efb8e1cc8d1bbae4c21cea3d36e3a204a60878ff
MD5 67dd796857cf1cff93b53b8589b07493
SHA1 4780662efafe2f6334796792f6ab2e69607c900e
SHA512 24526787e0c504069afe7d7ff6416f1b3b4f2666d44f247e86dc853f03bf8fe496425598e20a13e38d44fdb824f5fe7e1b44f8f6ba9f5dd6b67e695ae2714357
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.1MB
SHA256 068cfb5a0dbfe862939800f8503a9f4e94292aed2530decd0a52d34e948e3188
MD5 4fd7537393118a5e541a4028bfaf7e5c
SHA1 f940fb5b1e5ca297dbb2dc782c48120754d57215
SHA512 b43b1f3066113880533708727c47f16e15dc90ada5a9e69f1ca5980013560410f2814263810c4a173649ddc70690e08e3798ba1e13268f98d595d5bfe0dc36a8
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WC+gZ2Hbj:Bp7sgZ2Hb9t+2xr
TLSH
T1D5169F25FA980CF1F87351798996C625EE71B4251B21CACFB2AC832E2F336D1AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 281cc1894fc3b79d23a7ae2594d955258a977056469c9ca090e4341b434f7e9c
MD5 fd222a5f16b9bd7be4935f5103473b77
SHA1 f67e3c465be5d623ca24c6644a3c58889c0cff87
SHA512 3a4510576839f2c46ac9d00a5909cbef1198795a01c947757eb9fd3fd9cb932529cdf6ef223d430ae6154aab65e5f9d344988545f84c73bae7d732fef23de4f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\bs-Latn-BA\qap`g`v~dtlq
Size 10B
SHA256 633f8ec567726d4e438e7f449858ff68dcc336516c4f1b8f66e7a49e7ccc49e7
MD5 cccd1a3893ca103b4ae21e8333a3b14e
SHA1 7c12e3adf8d4a5c5b535b96337b5392b689b7c58
SHA512 b9461d6003c2967a43330159c6844e08e11f3b2aae7ff5bb9033580ea25033d04f3b9b9ca84a52ce2509c502ef14fa8957c169e3f4272e1468a480b5f6058171
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\qap`g`v~dtlq
Size 10B
SHA256 779dcdfaf465b90d7e862754e319dff6e75fb9dbbcfa33be0764e654c5ba2cee
MD5 0e15d0502d59f35f30a3f83c4af68fb5
SHA1 468235f3cbe75c4f8ff8aaa4ee7eb51545ec867e
SHA512 1e27bb32cc170f3120e4de37ff024de4eb9ef19dbf4f038155669ac2725c598d920be42e92f42ab729c6ea2f6c9ff5d16fed7e417de7da594c593feaa366aa16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae24620249eddef64655ce5e36f03fd0f33965d172fbf55643d3b496746c36c8
MD5 674d5d5271c1ec4ddf11823b023511a0
SHA1 4213f6b1b8212dc756ff84773edff649406dae04
SHA512 48327b8cd9e7cc3747ea3e5d0202423282d158b4cdff616765ae3fdec97e65c5bd351a0b3f2d5fc25dfde5a22e394e9132c2e9b9349c26354e45ed31c041976e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3e7245d65c53279ac7f9cc3ef40040915274d9b0954e8ab9c86afc3903c214f
MD5 1d442127c1a9dd1db7dafc9493a62e89
SHA1 0b48b9c317a0c6be833811f13cdb9211cbdc866f
SHA512 5a33961d9cdf90aff0b867f3f34902b480bbac545050feb4114513b3473e6d7b68c29d0e109b4feedb0cff15350d10c1761c91dc113aa131931f8a237276b86e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41c75201ffb238d6582fa7cb40f390d76f40d4b14db64db6f5fa52b3ed5a85ba
MD5 3d34784f91f14c26e15608c27b600956
SHA1 2f9b30dcb4c1b16450da8c0f5e66b2ce2cd00c3a
SHA512 dc50e97764794e9d059df9ef7f45f1bb142a7ed0a28ed8f39194b942b9df6e2c27a09a41c2261376d5b714c751c0ccb800a647b3abde2e52cd04934596ce91eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78873c481e3ef3183775ad2cf9b89d07e3a557fc9b78792497f2d1d2a5f857f5
MD5 6381c36186fb4771f72ff4ff53eb3748
SHA1 c2b34a67585558cb01d348951e8e9f94bbddaf0a
SHA512 73a9e2281dc1ff89e8138f233f480c4f69474eb5a5c740a1651f961de79de704533d59c046d2537b08ad1a2a8eda0f3ba2eb5f3be26fb901ef571e6c199e7dc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82c7019314589478946d730f914385fc25175f72d143917771f68595548d2b69
MD5 79422ceb4357b0e8772b8da3f7264e8d
SHA1 7e7d828434132c6936571669dbe8723ece0d84c8
SHA512 803dfe57854a05853f1aca0e30d17a3def35d119908c82fa6868e17c51dc3c42f1cf98df2fb5f07a2cc7c8ecace1a03d0683aae4ebef49b92b42f3aba297204e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e43e2ee13ce51cc40a590eab78157a81fb9d1108576dd77d9dd60978be8d8ab9
MD5 f6802eb0468e571fde815ca39e20e937
SHA1 a12392badb66482768268ac0b78979c768d8a17b
SHA512 9c3c8d50bf01cd8474adfea613de0e327322e7d69aa4bad1c982d9ec2d5bcc22599a14a0784112e064846d90625212d85413d48c3f5811939bccbcebd9b57f45
MD5 SHA1 SHA512

Submit Download

svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBCCCBAAACCBCCCACCBBBAACBBACCBBBCBAAABCCBBAAABCCABAB.exe
Size 3.5MB
SHA256 95b691312ac4d265351250c5f53a82ecc8336dc6b5f6e5040697c83fab6012c7
MD5 6aab8f567fdfb3062512bf6849b0ed10
SHA1 0022f3a47464ad7929c39145fb506b7e1405398c
SHA512 f9391fab1898b945f693903626c2c7026fa66b13c8605c10b9d4ccb104d2479983725da8b2699db4b388180042ec31ff6adc48570649bf78926b2fe50b1a0499
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMG0+ElwMV+ElwMV+ElwMV+ElwMGZDd79WCb:Bp79
TLSH
T197068E15FB980CE1F873517C8997C629EA72B4251B21CACBB26C832E2F336D5AD35711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 07c3ddec0eb83848647e44b9d5a08fd02499818fae033879222643cf2152475f
MD5 2df4eb52f4e6d8da46cb77e859f6cce7
SHA1 d94676b3051e5d7e1b3546038c92b0a08f59c09f
SHA512 50a77c583da7afa8c17cb2e2bde1d00536b27941523a75ab32d080cb5554477e8b072788860cbbd3440ea089ad2d6d6919bdaf673411ab13897801e83d81af31
TLSH
T1EE119450D4F9D823EE3368CBD129DB6208E577BFB854AE14230A5218BBD9C25CD590E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 58922b5baa00f703d236d701b836eb8b3f4aa8a5f74c1153810399fd00ac5679
MD5 3add8e790a16bb9b74a24cb3ca7994a6
SHA1 f5a0f50aa7f983a2af54f8981cf96ae0b64b15fb
SHA512 64768f69dea75659208a2c5691d4718a4c78d574e2ab6c3b7b90d6cb5d89c040b3332665d274ecc10173ad91a9dba889856979e95ddbb588fa8ae6f2bcd0186b
TLSH
T184219950D4F9D823EE3368CBD129DB7308E577BFB864AE1423095218BBD9C25CE590E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-33-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/252-23-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/2464-0-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/2464-7-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/5752-79-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/5864-81-0x0000000000840000-0x0000000000861000-memory.dmp

Download