9d2e0dc62131f2009d5eb9f411a8811a323277f647562a94a53c7af6011abf10

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
Size 1.1MB
Sample260814-dn49cstcra
SHA256 9d2e0dc62131f2009d5eb9f411a8811a323277f647562a94a53c7af6011abf10
MD5 d0f583bdb4a1bf5fe841eb6e217695f2
SHA1 02d7108b28ed0992dcb47b29077018568f9e38a6
SHA512 d7389efdc3cd1dca5be664c0c4f325fe6b02ffa373c6c51f2eb5bf62f5466baeb326698b8f2580b47525a6777e76aaba067dc46acf11bb6f424b673f69ca8bc2
SSDEEP 24576:m9+EM0q9+EM0HdEp9+EM0q9+EM0HdE3afDd70iTWC9:U+ES+E9C+ES+E9jDd79WC9
TLSH
T110354A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
928	svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
1180	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABACCAAAABCCABAAAAACACBCABBBCCABBCAACBCCBACAAACCBCBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe"	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCCABCBAABCABACBABCCCBCAACCCBCCBBCBBCBAAAABBAABCCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe"	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5184	sc.exe
4668	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe
4984	cmd.exe
5892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
928	svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
928	svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
1180	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
1180	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
Token: SeDebugPrivilege	2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
Token: SeDebugPrivilege	928	svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
Token: SeDebugPrivilege	1180	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1152	3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe	92
PID 1152 wrote to memory of 5048	1152	cmd.exe	94
PID 2484 wrote to memory of 992	2484	svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe	95
PID 3556 wrote to memory of 4984	3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe	98
PID 4984 wrote to memory of 5184	4984	cmd.exe	100
PID 3556 wrote to memory of 5892	3556	2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe	101
PID 5892 wrote to memory of 4668	5892	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_d0f583bdb4a1bf5fe841eb6e217695f2_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCBABACBCBCACBCCBCAAACACABCCABCCABACAAACCBACCCCBACABACABACBBCCCABBBAACACACACCCBCCBAABACCACABCCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBCBABACBCBCACBCCBCAAACACABCCABCCABACAAACCBACCCCBACABACABACBBCCCABBBAACACACACCCBCCBAABACCACABCCCCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe" start= auto displayName= "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe" start= auto displayName= "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCACCCCABBAAABABCCCCABCCCCABBAACCBCAACBBABAACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCCCCBAACCCBABBCCBCBBAABBBCCCBAABCBAACACABACABBBBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6f52dfa5750129fa877e386ba9828afbf1a97e3ff7490abe93ce00de6460bc93
MD5 78d20f37a23568949c1860c40d04634a
SHA1 d18a71d29fd2880232a875e0d215c22f1b8d987c
SHA512 507a9abeb1a0b40c39a35f5f09cda6d2c1f7c779c8250cd56614efa863358c6ef2fc9ca34d571b5abc9e2c5772c5a20fa05e5d379da0b49fdcd1fd68e1fdc3b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 35efe2bdfb267e2bd60945f8e96479aa399c48af46dd2abcce8831f834854a65
MD5 afb8f3be68f5f932105c545082b3b41b
SHA1 d5e793f811a5b787a75275def248636b27d0ff1e
SHA512 dc139edb71c59bb667dc6a8b3eca3439108acc8a8274524be942a2e5ead14e4dfcc96b7213a38a6cf93c1aba4e715184db1d379431d1d80ac1e9c0fc6e7da6de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d42942e3180d8586320cd9d05ef873e859c9a4141ed92b11085e65206b525dc1
MD5 18f455a15ab851409827f31add635bbb
SHA1 455b2e42f1dafe9960061a10a964713311f138bd
SHA512 71923e9401660146b84dcc7eecf62df6633c47d6f610f6664954d28cbbe60a86cda245b2a32fe2884cce4736f20dceae70fd668a1a7ae055aede113f315302e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd5510c9336444fdb84b5772ffd0eb11bc2b1c20e228853be2be025d3729a04e
MD5 b282a8cd5a4f941b7967dddd35d42c23
SHA1 5eb39e90332ca90314033b0830390626d9332292
SHA512 2f193f4c79fdc9151a1522303eeb18a4d87b29a47f1ba1dbef56eb3d04e8f3f035e4a3fbdb03617d1167f92bd5b7aced80ed6b7ee2f6102223ee8e19cd4a4e33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b915bbe648de623399fed9cccbac850f4cad061eec1fc9ca213ee3443d6e5c8c
MD5 b708d89f9aaae9ff59537b9a21b1ab08
SHA1 391fad09bf0a70fa51c1a39814b0cf39fd8d7b57
SHA512 21518a6069703f978d5e9398008aad7badae47739e3bca081918500edd4910f65b7d8ce19a3a40b94b0bf7b3738e422bf5dd0e9232ba644157d7c98ac868c552
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 13.6MB
SHA256 72a4b6a4cf9dd4c0d351d86e34de84dec4d123e7a0215c5283b1229314785e0e
MD5 cf3ca8acdeb7c03363ba509ea7a6c930
SHA1 ac1321fcbaa2fd04796bbb95816aa22c435f391f
SHA512 e8a5e521ad3d14e6a6b8d7088caa2dbf789082e760bfa9ae4bc48107710b3c275ba5767a15aa2ee964f874f62b78a543e3572eae1accd4401ad2fe70f349b5b6
SSDEEP 98304:xp7tp7tp7tp7tp7tp7tp7tp7tp7tp7tp7tp7D2cyo4:3DDDDDDDDDDDicy7
TLSH
T118E64A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 3.8MB
SHA256 534dc339c5e7b511a7dd9a945d4a416d734494b002850ec8148de3c103b364c6
MD5 78fcc9e1a0a3956e2a2587e2fd2bb842
SHA1 5b4f8b6ff910ebca3fc1b6f6f16a391f2c2d0cf3
SHA512 2bd87bd9bb8c496b71eedbf60418bd6c394c262765394e788f9919e532cab1cbbb178bed908bb587e90e0cc923c5c0c28a2c1c0b6c9ef27284ba304fe229d6d9
SSDEEP 49152:U+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WC4:xp7tp7tp7D2cyow
TLSH
T12B166B01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 7.1MB
SHA256 9e4803d10a7509e9bb89fec4a4cb60d0178ca056015a0555ec4e013aff538db9
MD5 a2d19684a092199d4f8b757d8125f537
SHA1 926bcf44a7485418d82730b3636640d3ade7f0f2
SHA512 7eecf903ec11632f5d6a81e69642c04a18e5abb1e948d68d875babfd224c2a5fa359652f233ad596087ba07e5cf051832eeb3acc112b6099879726a2da26de33
SSDEEP 49152:U+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCO:xp7tp7tp7tp7tp7tp7D2cyoa
TLSH
T14D765A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 8.2MB
SHA256 88ef1cd73b39782276175b499bee187aa16e68b3a128d886788ed5bd6c26deb1
MD5 42d305d77a7d8c3108058430b25f0978
SHA1 7aa6cdea1706a62e18bebea0625df25b2948f99e
SHA512 62773d4d48a80e48f594f5b1111bf7a8288d7f4cc68b8c0c70ad1019fe2a8f2f17546feb6666a9163ad18af556d16edde549a542215936dfedab22afa527a0a7
SSDEEP 49152:U+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCd:xp7tp7tp7tp7tp7tp7tp7D2cyo1
TLSH
T1AF865A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 9.3MB
SHA256 ef4705d371c30e97ef6f823abedc47400a793fa6521c4b510d281e5aa2faf387
MD5 6a3cee383d30ee325d4a198de6d8af45
SHA1 e5c62ad95ea3349d7a92f65b13ed5b1514fecdd2
SHA512 9afa9506084a24172d958087e875fc2b18bceebc11dc994b8ade450b6b4aec128e692a16d0fc2b6468cb3d95cf9668c91abb925d21dadcb88b66cafd1afb3a81
SSDEEP 49152:U+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCS+ES+E9C+ES+E9jDd79WCZ:xp7tp7tp7tp7tp7tp7tp7tp7D2cyoF
TLSH
T1B0A65A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 10.4MB
SHA256 d6cf230a35bfe61289f66d97e64899fa999523ffc1041da67b07c8467c156c55
MD5 322ae603e6dd8f30a42e9019e2a552d5
SHA1 e360446f3d51582b52e86dd8077623c196a9a76d
SHA512 f7b5f7850e46babfc55976382eac27582f26d0b214d06df8a9f0faf456cb59e0c82f98294ed51226dddb7945c1198d9344a112f5f441c19cc93646e7eff5ea68
SSDEEP 98304:xp7tp7tp7tp7tp7tp7tp7tp7tp7D2cyoU:3DDDDDDDDicy3
TLSH
T1F8B65A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 11.5MB
SHA256 9f86a8134096498d28d58cb751d37c3d76ca56f065eb9875ff5c647179a908a2
MD5 ca4e464287af35811b68f0fed2a3592c
SHA1 d149fbcdca633e41064d849c62d59af2ce3d975d
SHA512 d131b4df044084ca773437e8de471b2e59555bd66fda8b3dc01e5d3b6383987f27e38a2401a6bafc35a88f75f57b85a82a4325804ca029639664f9ba0d4618b5
SSDEEP 98304:xp7tp7tp7tp7tp7tp7tp7tp7tp7tp7D2cyom:3DDDDDDDDDicyr
TLSH
T1B2C65A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 15e727f6c0664defa67925e61290173aadbd5f577e06f469f86a3e176761f50c
MD5 13c5b98bc7a5a3e0405b48ee027f0808
SHA1 a277a8d8fdb741ca6513a0cef6c6022fd9d2b67e
SHA512 c93a031c4fc38014380ae3e01d829eccbcff50a71084954c56274c06e337480f9a2546e27a34784b66bcff7753cf878cf21d55a7f489f5aa1dcd09bc1dff9beb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 438143c947f20501b6516ce8a87f593e4eeca36a4082e365110332261c0183ba
MD5 9081f908c7dcd02532b4d423731c00f8
SHA1 7d8fc745c0660512118d7112579f55ef13036678
SHA512 39c4d4f8f48f0924893eb8c4913dc9796736272bc6ef66799e7c7f90e63eb65be9c5a9ba2f2cb93dc3283a8422ae8fbeae21bbd97ef66ba9d87fb3e013fe9455
MD5 SHA1 SHA512

Submit Download

svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCCBBBAAABBCACBABACBBCACCABCACCABACCAAAABBCCBBCBACA.exe
Size 1.1MB
SHA256 9d2e0dc62131f2009d5eb9f411a8811a323277f647562a94a53c7af6011abf10
MD5 d0f583bdb4a1bf5fe841eb6e217695f2
SHA1 02d7108b28ed0992dcb47b29077018568f9e38a6
SHA512 d7389efdc3cd1dca5be664c0c4f325fe6b02ffa373c6c51f2eb5bf62f5466baeb326698b8f2580b47525a6777e76aaba067dc46acf11bb6f424b673f69ca8bc2
SSDEEP 24576:m9+EM0q9+EM0HdEp9+EM0q9+EM0HdE3afDd70iTWC9:U+ES+E9C+ES+E9jDd79WC9
TLSH
T110354A01FAD58075F4B315714DABC2BA9534BD218F12CAEFF288A36E5D32BD09934726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3473257efa0483e187703be620471dd629c596c99f153554809d2cce4f655e73
MD5 865878916fe2c3a77ba312b351834d03
SHA1 b5d9847da7e3e08b2df1c5a1f5286c3146fe38c6
SHA512 b154955e9c8aff651d7e237ebaecc08397170a7947f20063f231acfa0d853d1f1803393ae39d93120d1c0d248f7d73cab85559c2e4866192e45108071f0bab08
TLSH
T15421A765D4E5D853A83368CB563ADF920CB477DB9C28AA25120C4328BB99C229F194E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 687132d63d24bf446258669e5e938df0dcd1e94933149aa9b70ea181f53783ef
MD5 8744232431545ab27fba68ac13554db7
SHA1 d2a88ea8151592158a8cc417d0c96bf59b8e0099
SHA512 795caa411c468c96c9153556ba29a2884171eea440fabca2f8e211abe10ad7590ffd92ce98cc07cab5bd1eb679cb42f1b35599d0eb25836852a602c0360f8dda
TLSH
T18301F955D4E5D817EC3368CB563A9F920CF477DF9C68AE29120C032CBB95C229F154E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/928-102-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/2484-71-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/2484-34-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/2484-49-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/3556-0-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3556-70-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3556-23-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3556-48-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3556-12-0x0000000000290000-0x00000000002B1000-memory.dmp

Download