335ec93ebc47063ba0a422d7366bac1f8aae310289cff58f0609dc9ca744dbc1

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
Size 42.2MB
Sample260810-d9ynpszhja
SHA256 335ec93ebc47063ba0a422d7366bac1f8aae310289cff58f0609dc9ca744dbc1
MD5 f76668774461d9083fd9bd8432b4d23b
SHA1 c2522436b82d5a80955884d38bfd7b113e376826
SHA512 4acb9ffdcae1e9a6b20e9d55de8e400ac9dbb140506698f840efd8130c06800e09b78d719bcfcc9908ebee5192e21dcfb082bc94358a2c52d3afef7c969b4fdb
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlcFlfFlVFlfFlEFlfFlVFlfFlEFlU:i3Z3E3Z3E3Z3w3Z3E3Z3E3Z3o
TLSH
T163A7F106FD8640B1DD3A61704CE7E27B49317E3AC031CA5BF9C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5ea-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x00080000000182dd-386.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5ea-18.dat	UPX
behavioral2/files/0x00080000000182dd-386.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
5832	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
3236	svchost_CCBCCBBBACACCABBCAACABBBCBAACABCBCBACABBBCBAACBCCCCCCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABACABABAABCACAAAACABBBBCBBCBBAAACBCBAAACBCCCCAAABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe"	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBBBABCCCCBACCBACBABBACCAABBAAACAACBAACBCABCACABACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCBBBACACCABBCAACABBBCBAACABCBCBACABBBCBAACBCCCCCCCA.exe"	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1992	sc.exe
5412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3748	cmd.exe
5096	cmd.exe
1328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCBBBACACCABBCAACABBBCBAACABCBCBACABBBCBAACBCCCCCCCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
5832	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
5832	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
Token: SeDebugPrivilege	1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
Token: SeDebugPrivilege	5832	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 3748	4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe	92
PID 3748 wrote to memory of 1828	3748	cmd.exe	94
PID 1948 wrote to memory of 2344	1948	svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe	95
PID 4184 wrote to memory of 5096	4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe	96
PID 5096 wrote to memory of 1992	5096	cmd.exe	98
PID 4184 wrote to memory of 1328	4184	2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe	99
PID 1328 wrote to memory of 5412	1328	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f76668774461d9083fd9bd8432b4d23b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCAACCCACCBBCAAABBACBBABAABAAACABBBBBBCCCBCBAAAACCAACACBBABCCBBCBCABBAACCACCACCABAABBABCBBBCCBCAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACCAACCCACCBBCAAABBACBBABAABAAACABBBBBBCCCBCBAAAACCAACACBBABCCBBCBCABBAACCACCACCABAABBABCBBBCCBCAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe" start= auto displayName= "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe" start= auto displayName= "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABBCCCABABCCABCABACBCBBABACAABABCABCBABACCBBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBBACACCABBCAACABBBCBAACABCBCBACABBBCBAACBCCCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBBBACACCABBCAACABBBCBAACABCBCBACABBBCBAACBCCCCCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6e5ba7dc1b37ae68292d52c5b01859188c48411a01efde148ef8f3462c16cc89
MD5 df0998ea57616c06f8d79f56b90d8c43
SHA1 79d15c950af7b209429470e8b94201bf46b71934
SHA512 32c0947158880c391b1c84d6e040bf8f61d96079f86111c8188d0b4ee228b6eb8e555acbb76d26671131ced371302d22981acf0e6dfc10aad476dcac6a5c796e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 8a426f6bf51ed29cb72f286dc8991650b86dae8719d5b8e7081293e6104d5a7e
MD5 acd744eb3f4fda46c1c12800746c2c7a
SHA1 48832357139e496960d29fa3754ae2a7561b84b1
SHA512 5aacf9a468a0fa90c511caf05894d49d898d155ec1f7d21d8ae3b9ee006b53ebd26ee61ba06cf849647dd424fa17b877ea564958c122f7bd823404c378e68790
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 42.7MB
SHA256 42b901b0258ff503dc75b025ba67b8a9ad1dd5243a67eea581b4ddce45f118e2
MD5 49ff90ef331361cf1c786434c8b78f2e
SHA1 c9fdc36f0833adc3c438c353746e80e1270e91a3
SHA512 cab16546ff4c0123f8115257da6edddb20b26e84f5b0d2160780c0e1d112df3b8d05b942b4043be8e4a8096c09afbabc74ab142be657c3625aeab56a6b89eba0
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlcFlfFlVFlfFlEFlfFlVFlfFlEFlc:i3Z3E3Z3E3Z3w3Z3E3Z3E3Z3m2w
TLSH
T19CA7F106FD8640B1DD3A61704CE7E27B49317E3AC031CA5BF5C9BA0A7F37A61586A316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 3106fd6b77ff2d966b9275e4187c465039486d61364b3370ee240e8c02b64e63
MD5 c779e059a100ae204171a8dd7529eb78
SHA1 99502eadc3bdf97c8c732de86e1261cc72cb275a
SHA512 8afefa5256567f114735066fa7b5a82d98955ec516fb227f74debcdf2369e899f0a80d0c273d4555efdfe1fd864de6b643a3f53d8e689fb4f32276681f001b56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\qap`g`v~dtlq
Size 10B
SHA256 2055feb1cc2d21e9f325bd2f69e678fda082381929a7bccee3c8af09be7a5661
MD5 5da255fabc538fbc850170576bf66fc7
SHA1 662ac785523943f1effa2af89d0d4a8cc5f33f2d
SHA512 fab8b53b54279ea06971b5bb0072a46e9001d535cb7e943210f146a217c8907c886955a229e6fca17e1c97755a49751c022575a98522945ca7f0f290d79ae080
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 9d7e192bd6d4fb3155781f5d053fc58d51050bd71f548fa67c5e412d3b73018f
MD5 9df4fbe407c38143dab2d0b11711c1d1
SHA1 560f9f58187fbc749b6ba026605315fbaba17cb9
SHA512 e82872df52cf69a4fd419638645ca0c3f72b08a0baf007189995e4378d24dbab31e273e317acfcb73387b9b5fdd5569d7d6e7db6128e19bf72ab676cb2d6712b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 5c03ff5628b956dd68f218eed06b3af32eec177c8193ff65dfd3e163f33673d5
MD5 c5f482a32909891f13adba559d65f416
SHA1 f33977108f0caafcee07fcb3912305cb46418393
SHA512 5e6c1471632179ce083cd9350259d1a35494ab0d6dc657c54d92d56f57a6ac3076d57327d894724587a4b79814b7ecf231a76e6c6125715b20fa198c5112e6d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\qap`g`v~dtlq
Size 10B
SHA256 0777559272f1375163bc83c907a38b4a13e2cbe60cdccc167c0f801ea0f7ce98
MD5 d67a4ec0b2d808d837b166526b56684a
SHA1 e1bca392f404d021ffbb46097aa480f52ad3a1cd
SHA512 88ef69d4a9f419702b5857aff1672586c096b8a2dc4e53420ce3f1f62ace7dbecc597d2b04031f75e6cf770b97266f6d2a66a4772097eca03ee4fd96c0772041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89a6c552926e2b450111916586b0d34c2fe81a2520b69120e6974e156ab7e0b1
MD5 e5a0dcafbc3b6a4b8e321f50c1cc2689
SHA1 92fd44506ad703b7e0977f113405d860081039c7
SHA512 2b0138daaeb1be2018dd0604d5136031e3e803d8451c2d3e8f845b11acc1d3578fce8620698951e01f64055c3a69380146575768203b9e31b232ad7691ebeaed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d26d20393eacb19694aae9e1c18f1d7597aed86d7e1e47061332a53867a7597e
MD5 5710bde5143365b7b3a6073e071d47cb
SHA1 f3a9c0aefb720d3e122c4d6dcfce424979b2689e
SHA512 584ceeca6aa9b50046f119ed377add7dbd3dcd14766620ab5f0914d864764284e15a6bd5add9d70fe90a3c1c8b7631e3b100d9352e40edf6a2768cbedef9d88c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b689cf8601d838cd99b2952defc3f7204c27a1937f68bbf0d8fad2cd7c7b0ad5
MD5 d792816eb0d380fcd300a87ca63e572f
SHA1 88b316116a58d86db935aaf58cedea0ffd20b3e9
SHA512 fa0dea564c935fbb14ca91126a55794e28b4ba307042ead601933353792ab4dcb4ff642673964fcd7cfe2d86245f4625cfe3e973a84c7f2c36ffd1271ec3ae7b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de9be8145882622375661854ee2155dfc9b59e1f9bd4e779542eeba17602cff4
MD5 535793f6aab907d48cf55523f0053ee8
SHA1 98c878ec47f5c61db09d2b9da272f2195add3fa3
SHA512 73c3e3fc12e2ee48307087a06bf0a0b95b8ae6219d8103fdc5d14ab66b9ee919ec1c28dd4f3a9e3ca3619266aba0c6b50095e91d3fabc52c26957bd33e0b0570
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a4f863706e2b4f036c932efcfc925a3cca1d0f85ae011e61e44bce6cca10b62
MD5 01b56f70349cf8fce374f121f0c712e4
SHA1 d43882438411a6923f629c489f3eb4ddbc7cf1b9
SHA512 30d9875e76d1eb23f2fa45a0864439873b91262c57773e5850a853f3d7a4694e9d0b5e894ceb37ac4d5be02bd14c8a598caa2ec763b687fb8b07921f69a19e7e
MD5 SHA1 SHA512

Submit Download

svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCCCBBCAACBBCBCBBCCACACABACCCACACCBCCCBCBBCBAABBAB.exe
Size 42.2MB
SHA256 335ec93ebc47063ba0a422d7366bac1f8aae310289cff58f0609dc9ca744dbc1
MD5 f76668774461d9083fd9bd8432b4d23b
SHA1 c2522436b82d5a80955884d38bfd7b113e376826
SHA512 4acb9ffdcae1e9a6b20e9d55de8e400ac9dbb140506698f840efd8130c06800e09b78d719bcfcc9908ebee5192e21dcfb082bc94358a2c52d3afef7c969b4fdb
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlcFlfFlVFlfFlEFlfFlVFlfFlEFlU:i3Z3E3Z3E3Z3w3Z3E3Z3E3Z3o
TLSH
T163A7F106FD8640B1DD3A61704CE7E27B49317E3AC031CA5BF9C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 983ed7d4a8b28397a2b556edde45413d2754a64e13e860e639a727facc636f61
MD5 421e29f80fb600238e636e028c3f6572
SHA1 740751d19170734bcfdca94456be7f64989b977c
SHA512 0c1120133b8d16a171adb00f19f2f257eda2cf1f20ef5c07b4f624b0577766200b44291271de44a882c7759a6fa2582d7d354ef2f178babcd5f2e337c54d8423
TLSH
T14811CB80E4E9D823F93268DF552ADFD608E83B4FAC585A24330C45187B9DC73DD594E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1948-35-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/1948-22-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/3236-71-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4184-6-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/5832-65-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/5832-608-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download