5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Size 1.5MB
Sample260814-c6ekzsshrc
SHA256 5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a
MD5 fe3372bcd8495b78f0a19270aa111c76
SHA1 e8a0ec298b4a229f3d32b503649ccb37e0582c6a
SHA512 c67eb97e679bce56b62e2c1c7ec6e3a898773ee74821c3a5730955e141740e1a92e9353a9b1c31ad0d0023a7fe0c23975094176edcce5aad3fa0c73c70e22ca1
SSDEEP 24576:m9+EM0q9+EM0q9+EMxIh7CJ69+EM0q9+EM0q9+EMxIh7CJKafDd70iTWCA:U+ES+ES+EFhO6+ES+ES+EFhOrDd79WCA
TLSH
T10A656D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
3472	svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
4344	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCAACBCBBBCBBCCCBBACBAAACACACABABAAABAACCBCBACCBABCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe"	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCCBCBBBABBABCAACBCCBCBACBBBACACBCBBAACBCBCBCBBBACAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe"	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2004	sc.exe
4752	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
3492	cmd.exe
1460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
3472	svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
3472	svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
4344	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
4344	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Token: SeDebugPrivilege	4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
Token: SeDebugPrivilege	3472	svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
Token: SeDebugPrivilege	4344	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 3828	2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	102
PID 3828 wrote to memory of 3576	3828	cmd.exe	104
PID 4524 wrote to memory of 5116	4524	svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe	107
PID 5116 wrote to memory of 2528	5116	notepad.exe	108
PID 2564 wrote to memory of 3492	2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	112
PID 3492 wrote to memory of 2004	3492	cmd.exe	115
PID 2564 wrote to memory of 1460	2564	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	116
PID 1460 wrote to memory of 4752	1460	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBCACCACAABABACAABBBAABCACCCBAACBCCCABBCCAABACCCBBBCBBBCCBCCCCBBCCBBBACAACBCCBAABABCBCAAACBBCBBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBCACCACAABABACAABBBAABCACCCBAACBCCCABBCCAABACCCBBBCBBBCCBCCCCBBCCBBBACAACBCCBAABABCBCAAACBBCBBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe" start= auto displayName= "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe" start= auto displayName= "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBCCCBBCCBBAAAAAACBABBCABCBCBBBBCCCBACAAACCBCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2528

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBAACACABCBBBCCBABACBCAABCBBCAABBABAABCCBCCAABCBCCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a5eb5f55ae37158f21c16713b44ca244278ca4a8d6b64de562e8c2bdf9fb2de0
MD5 a1c4f2d0e0451eefdb3d671372aa18e9
SHA1 ec9ad49a6515535c5cb3ba86e47a658638ae7e11
SHA512 f64405d28e8bf8ef808a48b641508c5a1db890bce7cc58dc5d94dc44050e41fa9465c4a686728d5f9ba8df5c02750f3f188e5b1d6827170d251b96344b4b1aa3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\MapData\qap`g`v~dtlq
Size 10B
SHA256 59f0ebc6591896dd3eea2ecf69f7a39161a054a24168692acd9722ce1236658a
MD5 9ec4ae7e7ed7e00eeacfe342a6f547f2
SHA1 f563873d6a72ef02d03510697de9ac8969ed8357
SHA512 84f2f40348b8626674b43474620445bde50be3858b22d9e2b3a081981153ab54a8ced30bd1c2be4ff3f9c17470f90adc5543886acedd54ac2b66b9ff53976b6f
MD5 SHA1 SHA512

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 13.8MB
SHA256 a5ab41d204fe436609fbff37b0f7fce4654326f0fb17d2299f7d535356ecfd1a
MD5 d9349981c9bf5e2204a41d0f77ea7e77
SHA1 282a65eae446af3851fe48dd0456b93d8d0882f4
SHA512 c3f7b77b84fe2814672a2f8a626187990d94af4f35f101382e17516f8ab097da8369d3a1c3a248f4f0e90dd95418ff8c645261b2de78a1238eb0d5085cec413d
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp75c8Ti:f444444445c9
TLSH
T1F2E67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 18.2MB
SHA256 69df69412b29c71a6dc9f1f65a104ba4a4821effb5f4371a399b0aa779c50b64
MD5 2ea8fc724d10304b3fd26117c997bc1f
SHA1 7cb2bd7ef2e3dd0980808d8685dc8aeb73f42639
SHA512 e433769b89241b4bc9eb44d602612faca94f18aa974b2677413d6e81e3ffef4288eb84f4889b3df152c10d1046cdd3f06b654813168573e3483b9900e91dd4fa
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp75c8B:f444444444445cO
TLSH
T1B1177D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 9.4MB
SHA256 aec3a6ba1108e4a874fd80fb64f38bd79cf10c4ffb081994fc6a705b5989bddf
MD5 5ed2926a298c6441e88484be78d06645
SHA1 ac4902fcff7ea502915e8834a765957e805a3d12
SHA512 41e6de2bcfe9b0bd4cadf8026416a99cb4cdd153b553e28fe41c49553fe43150e3f6446fbe3e84cbe2ee11a6156928c7f4871a6e07f33a780255d2598d0631be
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp75c8Tv:f444445cO
TLSH
T164A67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 10.9MB
SHA256 9ea274db3c70af97c6ff4b57f73ac705cb609b80ef5edbf78b42dac1cbdb6001
MD5 dba01567129000fac00e0545251c2327
SHA1 8af87b3cb6b2c539608a4c05ca9134475017ab1d
SHA512 44eb5af2c40a0dadee94526a6201f9c25c443d373f87624e5a45fc7ad67fb54525b81b02a682c1dd28c15b0096c9e3fd3b77caa379e50248cfbd557cc6d0cfdd
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp75c8Tb:f4444445cQ
TLSH
T11AB67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 12.3MB
SHA256 76b92960cdfb6f7f7dc4b129bb4f2dd3ad6f216ce5ed49ab5a0f326243a66ccd
MD5 b01f379b02009fbe8d6c13ea68f08e6f
SHA1 70447d445d8a816da62e3ad42f32c28e8d40b4ea
SHA512 aacb3c2303900c7d5205e1b4c3f104ed17bb934d3eb921ed7b21c0b700855051ccd0988ea62e8339a24c7fc0d7f3f9d8f49628552235c98b634aa4ee9d8a724d
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp75c8TS:f44444445c5
TLSH
T1D8D67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 3.5MB
SHA256 e8f01a369e05b50de1aba8414e26f972b24eee9f3f3ed96fae0547f1da13bca8
MD5 61c13a8efa4c6ef3b4bee3228abc3004
SHA1 e71a43ecf1eb9810d596e5a7414995425e97ed8d
SHA512 c2e2dbe579a87814e6c1f3828fdb50aae0acb490d6eba59dd6a2fa9cb37970b63b2c0c434ca0d468995063418aed06c58318c4da7e203d343a8ebe7e9596f12d
SSDEEP 49152:U+ES+ES+EFhO6+ES+ES+EFhOrDd79WC3+ES+ES+EFhO6+ES+ES+EFhOrDd79WCCE:IJmp7dJmp75c8Tn
TLSH
T17F068E08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyBlock.exe

Path C:\Users\Admin\Desktop\CopyBlock.exe
Size 13.9MB
SHA256 68acdd05ffa9c5650f5d9faed56a1b9540d86ac3e936f7b4d5162f82d34cc4e3
MD5 b3469dd9ffb767f27ecee1e445c6c445
SHA1 34f033c1f8ba4ba3139106475d64ea785c2b37b9
SHA512 8415cacb4c4ea8c6e37fdad28dd19bd068c9e2bb5927e27d00ee1f3c2c7424163b513f757c56bd2ab554ba2939f143a5f60b2194154d3a5d8d6a15c21262ab1d
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7JkExr2KLlL:f444444442222
TLSH
T10BE67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyBlock.exe

Path C:\Users\Admin\Desktop\CopyBlock.exe
Size 18.4MB
SHA256 78d0ca45476efac8d9d76aa8aa3f811b2fff42671b200c3e824e0f2ee6c1e339
MD5 40eeaa68d8f27ef9b9548739d4adfebf
SHA1 dc5b1f6f948e33828600e5f86e0883e18f56152e
SHA512 f2f3b14245a70fcd36492df5c4e2fc79bfa0d773531da56cbff8c59ac2204c9fec115176f42179b0e7d30ea9ee1203fc4c91e8b371c96c92fc90b9e17de34add
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7JkE0:f44444444444222H
TLSH
T15E177D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyBlock.exe

Path C:\Users\Admin\Desktop\CopyBlock.exe
Size 9.5MB
SHA256 8bf258581b3eb543de232bed95c73c07c096a07253751fe0bdd865c549349884
MD5 fa43afe95dd44491084e118b72e7178e
SHA1 9b5eb5aabf48c2e09743836459f3bcd1cc408fb7
SHA512 8fd7cb554c436f235008452429cfc52193f0d23dc2a5ca7d53253b1a6d939be2f6faa7fe1a41e7db9ea8b42ea7b073a77cac3d64b46bacd131cee84371e1b149
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7JkExr2KLl8:f44444222R
TLSH
T1ABA67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyBlock.exe

Path C:\Users\Admin\Desktop\CopyBlock.exe
Size 11.0MB
SHA256 ccfb2068521c93ecc15f3adb6f6f3e6dbaf1fa102787e510d24610c5ee66d892
MD5 2ec53a1c286278a8385cbe22a1c615ca
SHA1 dbdc95ac8b5b333d183ec2d73f41509dd38943c1
SHA512 38b321367941fa4cc313225da6ca158521a5885bdf5e7472d50ad4fca1fe68ac2ca560f14aeb197c329cf6f7d15088c831d05f4c7eed13a633e8f907b451329f
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7JkExr2KLla:f444444222f
TLSH
T1F5C67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyBlock.exe

Path C:\Users\Admin\Desktop\CopyBlock.exe
Size 12.5MB
SHA256 8d4e213ec47868ea65d4d46e0f1ca52ea1acbb46fe4bd39c07328afd094f917e
MD5 0305052fa0c6c3da48702ec6dea98ec9
SHA1 8e04bdc3cd7dc384d5e28af7c78f1709c53fb99b
SHA512 777d7a2160d7afecda46461534df290c3bc6ee667f9643c1dee06076dfbbe37195462f712eee54445d2a59d84124b430af27d96dec61441f6cc5c56f04bc3b68
SSDEEP 98304:IJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7dJmp7JkExr2KLlM:f4444444222L
TLSH
T195D67D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5cf67279f5352e7413170d9a51a717fc6426703c007f17c69cbf49bfbb472e39
MD5 67cc942c611277b8bf76fe75575a244c
SHA1 225b35ed266fdb1e861f1c194f178dc9ae107933
SHA512 86c0708333f4ea8f2a169427da4214a47fa2c740a067ea4989572a7b4688ec2cfc3f004dc074ab888ce81ece992d68f7761214cc83240946d9bd0af5f949a922
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 65eba4df3442a9bca8c011703ae4a2c11d5e9629c968722056cc40660c4893c5
MD5 bdeab8607e17ef89f008f26cdf02fe3e
SHA1 aa9880d78abfd7265294ab13ce8c63db7ef5d333
SHA512 cfdf8a07e1c56b5cf69f490dfd5efbbd8a42a48e236cd4b4ca964cb851bb3cfc541bc8ef46aacd3a28a71f764897562dac976a9ebceede2c87860cc8404bf07b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a405e93ce140aaf30512aca41e85808ce4f2a8b89ec74120f0597a95e4390eb9
MD5 a2c7f0f256cd22b03f4b50263829c05a
SHA1 37d2063403d204c8200bfe8db8f11d3689f4a5c6
SHA512 f3607f6614da2ef1998ce4fcc8339613e2f6232fc195c61fe1a9422e0a7313454e4b7fba9446c6c9279d6929df27af5246d694beb4de767d7a4e547a2d94b614
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec98daf55b624c2feddadbe505016cf3378f03cbc8dbe1d72df42bce31b7cc36
MD5 8475d01c3bffde5c85d28cc6a8ebad28
SHA1 db505a676121095a64bf8dafaef458fa8c4ab2ad
SHA512 4527693e8f65d1283b427a5358fdba0de2cfd8f69a8b768e22c00d69ba3bf762feed35e6e5980e5a2e88a41248bd1d7c1820a2461e11bbde4fd6ff4422be4cc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67a437642b9de2c73ddb425c7bb579fa3a56c4e5eeea04ed2eabced05508717d
MD5 6180e42b8247ba6279210867c0eea525
SHA1 71c06285d17cd05be485fab1d0e72aa930b10e0d
SHA512 2ff6a288295a3d887073ccbba84128b9a201c4eb75b55847e3f6682f1afbf9da31bd799f32d024c61f447557ac3c74dcae1fc17e94270c8caae2d29d4411d6ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95b66155df0c729457f5af7ae12ba66f9eeb25cd626a2d1ca5a8684b72f57dda
MD5 df219c5b12eaaea66bcca19f92321f4f
SHA1 7f7ffe8a46b4cddbe7ee84fde78435e55d61390e
SHA512 22e318c2f2f85936d1d8f44b2e14edfa443ad8da760e23a926a9e2cd287eb1bf41b6c3fe4f61bce12f1cc4885720c0dc8a7b098bdee9986230e619c61ba581cb
MD5 SHA1 SHA512

Submit Download

svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBACCBCCBBAAAACBAACBBAAAACACABAACBCACACCBAAAAACACCBAC.exe
Size 1.5MB
SHA256 5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a
MD5 fe3372bcd8495b78f0a19270aa111c76
SHA1 e8a0ec298b4a229f3d32b503649ccb37e0582c6a
SHA512 c67eb97e679bce56b62e2c1c7ec6e3a898773ee74821c3a5730955e141740e1a92e9353a9b1c31ad0d0023a7fe0c23975094176edcce5aad3fa0c73c70e22ca1
SSDEEP 24576:m9+EM0q9+EM0q9+EMxIh7CJ69+EM0q9+EM0q9+EMxIh7CJKafDd70iTWCA:U+ES+ES+EFhO6+ES+ES+EFhOrDd79WCA
TLSH
T10A656D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 8e109631128a5a71244df8aa805badac3274fbcb66f29705bcfa9ed8436f55ef
MD5 5f95589988c7dec20aab38e23fe131f3
SHA1 e73f43e2d4e7e5aafabd524d534c09a4fd39117f
SHA512 9f3657d5deab6b55347af033140e6e9f1d6284c0e127ce0d17bec3a8f63f342b38a95eecaa7c02a6791b7a25fc2c5747463775d70e4538739c278bd40efe760a
TLSH
T18311EB74A5F59853ED336CDBA219DBE30CF477CB6C58AA44230D8229ABD4C318E154E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ced6b899950ddbf39514fe71151fcb0f1c205854d15913e15508f6241e7a5405
MD5 c6b919829afefa3ce1088ced9bdccfb0
SHA1 ab8a0cbaa9d71a655c3fa6332fb4cb946551b8a3
SHA512 0d903a54c6263f69bc94ba44c3a4fb87f6f1e31e6f8b5e0235133bac4051f3692123776a1add66878c71aa1df238a73e7fedf1e5191f40950e01e54015711141
TLSH
T1FE21F974A5F59853FD336CDBA219DBA20CF477CB6C58AA44230C8328ABD5C318E194E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2564-14-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2564-114-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2564-46-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2564-79-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2564-30-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3472-142-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4344-144-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4524-45-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4524-143-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4524-93-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4524-65-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5116-96-0x0000000005050000-0x0000000005051000-memory.dmp

Download