6ca92edd692e3aad03fec7f4a5b565a0e912696d0795a54cffd98543de7c9510

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
Size 3.1MB
Sample260811-db677atgkh
SHA256 6ca92edd692e3aad03fec7f4a5b565a0e912696d0795a54cffd98543de7c9510
MD5 8574671b9fc44c47a64542ef3c33365e
SHA1 9a533dcef9ea1d19c94ddab4bc188fc6f5dc0f3b
SHA512 c4c28d513e9f0991b6d802601e68466926ff9d274516c4a78eb1793fd20cce4a89afb948b8e800e80858d5f221a9d03c0c6369566c63e5c07ebedf9735a1daa4
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphONDdA:SthtIp7s
TLSH
T1DBE55B08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1420	svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe
2080	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBAACBCBBBAACCBACACBCCACBAACCCBCBABBAACABBCAACAABAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe"	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBAAACBCACCABCBACABBCABAAAABBCCCABBCACACAACBBBCCCAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe"	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5012	sc.exe
5892	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4612	cmd.exe
4324	cmd.exe
4384	cmd.exe
2040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4640	schtasks.exe
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1420	svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe
1420	svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
Token: SeDebugPrivilege	1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
Token: SeDebugPrivilege	1420	svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4324	1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe	95
PID 4324 wrote to memory of 4640	4324	cmd.exe	97
PID 1412 wrote to memory of 5708	1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe	99
PID 1524 wrote to memory of 4384	1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe	103
PID 4384 wrote to memory of 5012	4384	cmd.exe	105
PID 1524 wrote to memory of 2040	1524	2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe	106
PID 2040 wrote to memory of 5892	2040	cmd.exe	108
PID 1412 wrote to memory of 4612	1412	svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe	110
PID 4612 wrote to memory of 4056	4612	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8574671b9fc44c47a64542ef3c33365e_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBBAACAAACCAAABBBBACBCABBCCACCBBBBBAACCBABBACABCAACCABACABBCAACBAACABAAACACCACCAACABBABABACBBAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBBAACAAACCAAABBBBACBCABBCCACCBBBBBAACCBABBACABCAACCABACABBCAACBAACABAAACACCACCAACABBABABACBBAAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe" start= auto displayName= "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe" start= auto displayName= "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBBCCAABAACCCCCABCCCAACACBCBBBCAACACACCCACBCCCCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCACACCBCBCCABBCABCCACBABAABBACBBBACCBACCBABCCBBBCCACAABBBBBCACBBCCBCAABBBBCCABBCCBCBCBAAAABACCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCACACCBCBCCABBCABCCACBABAABBACBBBACCBACCBABCCBBBCCACAABBBBBCACBBCCBCAABBBBCCABBCCBCBCBAAAABACCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCABBCABCACBAAACCBACCABACACBABBBCCCACBAABACBBCCABBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
1⤵
- Executes dropped EXE
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 9.6MB
SHA256 2efee80b4dc938a628409acb6fd4e5bad304f41a6cae64d59404dbe02b5f452b
MD5 7533046e43aa40aea9895db50c3c4a39
SHA1 cfe102072eb065af24e4526d038157bb6c620566
SHA512 1828e26db0a9cc1428027bbfcb8985a2bae1044f6233dff1282ffadf92f282ada1ebc5f53adc67969c900d2b7095b7014804b12d9550b23f5ec6bbcabb0afe37
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphONDdf:SthtIp7tthtIp7tthtIp78A/
TLSH
T11AA66C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 15.9MB
SHA256 73ed7a342e89b8c53b31767fa372df499ea5b31f471311f8b6e8dc737b336b42
MD5 9480931f1d46e38b972564e763a53c7f
SHA1 3ea1d7949525c87fb298d87136aebab50d469c67
SHA512 7e8eedd3991c70b458b39934756cdfc5c6009c8020a5388580af0f76d69cd5c237c3be3c3b00bfef5f963dbaf12e7cde7ce308c31b679fd84f9a011152af923b
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp78AB:fqqqq8k
TLSH
T188F65C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 19.0MB
SHA256 4e36f55f3b8c4339c9c8b45e45fa04d8f8e11f8c313d6bbf21de8b3c96b6057e
MD5 7572627254d12ba37100d51fe181c6e4
SHA1 2aae7a87325b87683d7600fa5f1d12f2bbbb1ae2
SHA512 d129c70b6c3c9dc5e84e3fe4bf3916a9e480381090ce282a66dbb2547753922953beabafcc7f1418b774cf81c69719abaea85ea50a7d9c0fa1fe1d651e33ff37
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp78AI:fqqqqq89
TLSH
T1CE175C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 22.2MB
SHA256 73193b05775a8c28129cf5e6cf2a065d70d185d912d8c167ce3a59d9a26f2807
MD5 a1df937c081b6aee54abdcc150dfa52b
SHA1 503e0811a05cfca7d2517481c62214fcce1eacbf
SHA512 34a19e02af7484e6f2ac88dd6685b584d81247c8c0d8ea5c60f70c8fd53134bffcf85e20029c01b1fe5c532cdef8f2ef24f93ea5b18821a66739a2f58d7285d1
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp78Am:fqqqqqq8r
TLSH
T11D375C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 25.3MB
SHA256 fd257ce6e6b1ca7866d38894f931e4e8eba807f279804999d4239a4badc808ac
MD5 ae9cf3b2e7b124c7c36b433d3869ff8c
SHA1 4241eec3ba3487b793d522877a51ea3bcf5027e8
SHA512 9c86f7654fd320d8f260516c5e7130483c83c1492f0c9cbbd7c60f5b39a98721811d3dd68f74609b156d1c65f082fb9184e4e871d386622ba9c60a4b075acbc9
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp78A+:fqqqqqqq8v
TLSH
T12E475C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 28.4MB
SHA256 3ccbed95cce25651cf61d940e4637315bd30220c06b9cd9ca1fdb6e2dac39c2a
MD5 e54dabbe5de0ae207bf2ade87fb7036a
SHA1 840939a0a2fac47f7db8bd55fd8c904f5e83a1e8
SHA512 d72c28fb8d81603dfb28f7d782e181bbabc9da47bbac267d5e926fb3cedf1fefa0c8ffba393cfc7468e376824d54b5a96a863507a08b90a2d505bad947925f63
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7e:fqqqqqqqq8V
TLSH
T174675C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 31.6MB
SHA256 fa33c8e80e1ff722cb3c19b309d24ed5449f25ef4b2426a7e849b11f23abf6be
MD5 56dee348e22dd6182765911c46ea0221
SHA1 6ee60293e5891a1f9cf460fb17382543b4492f1b
SHA512 cb9823fb0d01ce8efdebc35917025936693fc7fcb17509abb9ec3feb55dedf6a884951d5d6ff4869862abec982c30f5d17de8df2ac5bd2d4bda7c69bc869d64d
SSDEEP 98304:SthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7tthtIp7/:fqqqqqqqqq8p
TLSH
T14A775C08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedoRename.exe

Path C:\Users\Admin\Desktop\RedoRename.exe
Size 832KB
SHA256 09da9198b3ac8078d339a2fcef94857587b4f745a2b0cb25530600ff90f8ca67
MD5 cc8cbb7baaa37218dab69a082b5f9904
SHA1 85bb9f2a4ae0d02499871b3a3f29bcba475209fa
SHA512 79a5ace35382fda2496c2c718199fa2f7bf282348de7d780dbec67e5545fbda976c7066f75f58f300393bef82f3389a8179e8194bba0a21845ef9b06e1b0f8f2
SSDEEP 24576:m9+EM0v9+EM0q9+EM0q9+EM0gXIh7CU9+EM0v9+EM9:U+E7+ES+ES+EphOW+E7+Eg
TLSH
T14B054C09F58700B5D97751B049DBD2BE8931BA3187218EEFE788C67FA923BD06438B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b3427e44f2343799e17df3d0397588e3fca527f51b7cea371f681e6b67dca714
MD5 ec9779b51abe77651881b22f65d80f54
SHA1 bf6679f549fd2a426db7c256f154eb04c1f11ab8
SHA512 e9de95ea0d3967ba98fc10f606f1815642f3328f58ab132125e75b074f19c4b8ecb1e712e841f93dae84b096f1b88d7d7726b31990d5d64c4c5b08576af86ea2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b65514390dabc8ef252aafda7558b172415173b5c22ea7654c44b2949094ad47
MD5 32800eb2ab7445c9cb79a5cdc40fba96
SHA1 cae1a6e07b88b009819771ba2c30d67fb5846557
SHA512 510e83d4fc8dbba9f3a3415d7d03e78e17c707e788a8cd2c959a4c84046736a68ba4389f23457d87edd73e5085d96ae3c01204b35b715674bbb545498cb67bba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3b0120fb9121d8e68f2a0ea70d31fca1d23bac90e7eccd4e00e2f443c88d5d9
MD5 959b29b3098ebae8181c6b8729e9b628
SHA1 bb694bd57ea27822a895b60c840c320d10140a1d
SHA512 c4a8c7d2d5c616c9cbf2ee648e617536497403c0ad6cb7039af06d8fca47c2a0f2c61c74f811c17e2286b9837eaeef850eb6ad142de6c663bc08cd55917e7195
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e07850341a0b21d9c603a7653d1f1741ebcebe4561834919982226b26fa7926
MD5 cd938ebdd79896f540bb362469c1758a
SHA1 0c65d7ac796aa589f8c6efd183ac0a2069ffec4d
SHA512 036b1291e50560ad7dcbc3f557ececdd4d57fc3ff783ef09bce8a934f6584a47fe46c4f067fc64354ead2d61fc855d5f971d7be02fba88c1d76ae64bc983fbb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f2d887553c9aa04913bf7c1acb91fed9bb235c9d43f8aeb8dc483616fa26b8b
MD5 1682cbca9afe8b67f816bec784770bf8
SHA1 e68675b5785786fab9ea934a772ae7b830fa0926
SHA512 427e6ea59ca5bae73878629a561e1068d8eb6aeb846d79b32a573d56a7f9556fa815d94775adc07ee528c1414209ad81f9928079958b59726ddffe11d2cdff4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6963552b3e9a396948321b41271c941d7d8c045c1f7c3ec227583f9799db375a
MD5 ab4677d80a50e5ff2e26f6b55e6770ec
SHA1 6754a7209e31ce4ccf44072cae0da5a7b2500610
SHA512 6d5e3e4ae06d240d31e64beddcfea3dac93500a02555b374cbe97ecfd7f6a195f1333c2e088d572b9192199325394310d7ef934b59c86989629f7caa2d1b7c85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cedc4ddb9e68a623880c5f71f5b90c94269100925aae6f31790d818fde6cadd2
MD5 8d1a571fcb07e40a0d6cde0597b87f2e
SHA1 9b27991ef082ac55e737487592eeaae8d9776350
SHA512 847dc61502b75b7b4b2e83dfc73561c499c30ae0b9c0a0b6cd3013f64a714c69909ab1ff9a6c3c3afb487d6c76fa47649a15f1bb1e1c1a526c47496403756368
MD5 SHA1 SHA512

Submit Download

svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABABCABCCAAABAABACAACCBACBACAACBCBAAABBABCCCAABAABA.exe
Size 3.1MB
SHA256 6ca92edd692e3aad03fec7f4a5b565a0e912696d0795a54cffd98543de7c9510
MD5 8574671b9fc44c47a64542ef3c33365e
SHA1 9a533dcef9ea1d19c94ddab4bc188fc6f5dc0f3b
SHA512 c4c28d513e9f0991b6d802601e68466926ff9d274516c4a78eb1793fd20cce4a89afb948b8e800e80858d5f221a9d03c0c6369566c63e5c07ebedf9735a1daa4
SSDEEP 49152:U+E7+ES+ES+EphOW+E7+ES+ES+EphOI+E7+ES+ES+EphOW+E7+ES+ES+EphONDdA:SthtIp7s
TLSH
T1DBE55B08F69640B5E977517089ABC27A8931B9314721CAEFE7C8C67E9D33BD0B934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 440cb20e42b84e166837e07bc09ddc039cafdf3d5955cf11af9ef1b4c4cfafca
MD5 4ea394a5be445e33fbd18bb2767aa071
SHA1 c28ebcdf85a1c6535f90a7a5b8ae759c9964a8b2
SHA512 831b4ea1609a791a7e1e5904e78d966594d4003796dcb7855e414ac00abd0fb4cd993a5eb9692d9a080a7ecb012e76643e1e9ed01c6030efb604eb1f76badc3e
TLSH
T1C711F635D4F4CC57E922EACFF22DEAE308A4326BAC9C5A40179D821CABE1C324D154E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6f63ef8294b5f023ba20a66c92d0076a7e0640e03b9b4141e1949b991ebb8daf
MD5 fc79a81c7aede40b8f42962f44d5f006
SHA1 4e00b672e67820bb720557f7e3fb429bb5c6b350
SHA512 957a284c0a1257604378e16857508a0307d2a4a2a3da63ba72793343592ab143654c609d0e352cc515bd2109c04ecbd0a058720a5b9f60236b8aabeb22a25b66
TLSH
T14E112B21D4F5CC17E832AACFF23DEA9308A4315BAC9C6B541749821CBBA1C324D114E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1412-68-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1412-92-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1412-46-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1420-108-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/1420-83-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/1524-47-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1524-93-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1524-10-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1524-21-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/1524-69-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2080-110-0x0000000000320000-0x0000000000341000-memory.dmp

Download