a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Size 3.5MB
Sample260814-e2fzcsvvaw
SHA256 a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47
MD5 54db336dc6aebd69755890b537470948
SHA1 9e7044c8d27fe5efb07075b0f9a7e39920f0c20a
SHA512 343252246e2b31a4c741d26e82f7d5c5290a03790827f39690bf6efded78680468587b93ac7cdb1434b22c936cd5ef754814db047fe0f83b81c2c10c7e0b1875
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaO:uzKzNp7d
TLSH
T1F1F58C1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
124	svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
2596	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCCBACCABBBABACAABACACAAAACBCCBAABCBABBCBBCBAAABABBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe"	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCAABCAABAABACBBBBCBAACBCABAABCCCBCCAABBCCBCBCABCBAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe"	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6516	sc.exe
1580	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5284	cmd.exe
2852	cmd.exe
1296	cmd.exe
1756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5548	schtasks.exe
3528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
124	svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
124	svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
2596	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
2596	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
Token: SeDebugPrivilege	4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
Token: SeDebugPrivilege	124	svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
Token: SeDebugPrivilege	2596	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5284	2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	95
PID 5284 wrote to memory of 5548	5284	cmd.exe	97
PID 4412 wrote to memory of 2676	4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe	99
PID 2752 wrote to memory of 2852	2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	103
PID 2852 wrote to memory of 6516	2852	cmd.exe	105
PID 2752 wrote to memory of 1296	2752	2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe	106
PID 1296 wrote to memory of 1580	1296	cmd.exe	108
PID 4412 wrote to memory of 1756	4412	svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe	111
PID 1756 wrote to memory of 3528	1756	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_54db336dc6aebd69755890b537470948_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBBACCCABCBBBACAACACCBBBBCABAABAABCBABBCAABCAAABABABBCAABABBCACCACAABACABCAAAAACBBCBBAACACAABBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCBBACCCABCBBBACAACACCBBBBCABAABAABCBABBCAABCAAABABABBCAABABBCACCACAABACABCAAAAACBBCBBAACACAABBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe" start= auto displayName= "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe" start= auto displayName= "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACCBBBACBCBCACACBBBACABBABBCACCCBCCCCCBACACABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACACAAABCACBCBABACCBCACAAAACCBBABAABAABCBCCCABABBCACCAAACACCCAAACACBACCCCCBACBBCCBBBAAABCCABAACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAACACAAABCACBCBABACCBCACAAAACCBBABAABAABCBCCCABABBCACCAAACACCCAAACACBACCCCCBACBBCCBBBAAABCCABAACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCBAABAABAACABABCACBBBBCBCAAACCCBACCBAAACABACCAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 82f7a248f634e0ed7580899f95c7ea9c51b32720dfc716e3b840753e1f0f1648
MD5 cb025a606730219b30a2356779fd872b
SHA1 16b68d6c38efaef59d063e206537f488f844222c
SHA512 8b03bd13e90c49c3ac4aefe4fe73e17f7ce082b008837bc24bbee1d712f225ffa05fbc26473e8c36361fb6409f4938d257a4ac265dfeaad1eb3656f8b8160258
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\Channels\qap`g`v~dtlq
Size 10B
SHA256 ec5390c6514398b76868dea5637df212987460a47c271025f0b9d604bd3255ed
MD5 c559bd72daa19424fd7c5c1d03ac09be
SHA1 9813ffe9236a2a0c5a8121e6fe9d8af2c3f7f9ce
SHA512 3084f3d73a296e8f83d7ee65fcb07bc9d000415f20592a4ba3713a51ef051b2b3262b80fed3112e332a4e5de45d0f0a2c3020334f6c31bfe85795800f3ee6ced
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber\qap`g`v~dtlq
Size 10B
SHA256 c2ec44b17ef6f69b138f2a50179c4d9b7688c89775f1cd39f408e9e2c4059e59
MD5 1f561b32bd41e5fabca678a47552ece8
SHA1 f525193ec1a714784b1a1ab66abf2083d61a4a58
SHA512 b83a6f4568191c3039623a33ec77b9e9c3175853aa5aaf5c592af971a9f524554b96f699a3f7657eb438933e61be1219c8ebe043fb2e667abe0ab884ad1c9b86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.XboxGameCallableUI_1000.25128.1000.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 d67fbe9f3a2bfd149dbeef3653e660fbbd95748970eed0445e11a9b5aeebad4b
MD5 12c56afa16469a25699d1e11724a1e4e
SHA1 428bf2fd98ef415eb1ea1f5b125929105da57888
SHA512 dbf28944719a10a5f28ec46ae45f4d7490be78ab80880e4a3907395be385f589218d60cbd3d6a004bbb27e203d7535194fa75dea937f88b0e1a2952940382b43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.PrintDialog_6.2.3.0_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 060be458a0b3c1bf3e2b22e20049094cccf5d9d3f601a64e6f78ddfbb8dbb158
MD5 72727f926516104438e4d69cba63f5cd
SHA1 ade8386e57de8e69a6b5d26ab508bdf8ff7ab7a6
SHA512 04b47e6fad7849b9b66719e9bd5074133c6a006b83c80ce9c8f06f105e4ebc399af829901a41ac1c7f71f5c72d544c4314e2e1491fc2b28066b82be65bc02efb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 8a30e254c065457280ac6ea7f940d6e35dabdf557619015b7a0a929f6271d64c
MD5 dcdb48d659513939e910677de1dd460d
SHA1 6f6a6fb3e09d70f9b1f2737f530062b5c7d6e379
SHA512 00509805d492e41e72b3388f49dd206508407396e2774f4e387f2364818a72d8dc25748c4f1315733f2c4ffd6e599b8aba4787999e18dfabb37b833b14babada
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\sw\qap`g`v~dtlq
Size 10B
SHA256 931006cd4d6b6aa787ee5cb97ca669a26a473a023c3673b3b52083cdc40614a3
MD5 6a575fcd475fb21daa5cbaecf16f0ec4
SHA1 e7c5ba6dc4a825bf58125096095aa41f4636992a
SHA512 e840b529e2098e71d9d4ae1fe8811960314e3f0b1738880dd3884bd8081173762792879758fc204dd35198d0c48ad416fe28f16e93e1830207596e6b27439d01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\storage\permanent\qap`g`v~dtlq
Size 10B
SHA256 e88db88f8174c7440c2ac9202429b41400264431117d20a1e238ced0088dcc8b
MD5 6e2bb4aa3e80c7938d2eee3e5752d742
SHA1 657d10050d3d8f6307fd48206c231ee1ca02c7fe
SHA512 2a1673ca6c93d3e0cb930a17d0c82df94365d5c47ce2633bd51d8d812fc85b2564f7862e8de113589ea378f637af4f40f56f835fedec8b2c3f730f4379327cb2
MD5 SHA1 SHA512

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 1.1MB
SHA256 0983078eaf11b8168931fe6747815b367df139107b4b6c3cac808dfb2e275c7b
MD5 ae0701c4c3650187ca498dc9e9de4742
SHA1 600e63af1a2a4b33895c8b10864d3e6194aa70a1
SHA512 36676545311f946474ede94273a89e69ed424393a1d8bdc0674264991b2ce6794316eb4b82001daff09d98ecec5a6ea6853bb4c45ad2e72f24b4bc700c9f057a
SSDEEP 24576:m9+EM0q9+EM0q9+EM0cbKly6i1zuxw7ljsarakU9+EM0q9+EM0q9+EM0cbKlo:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EW1
TLSH
T13F456C1DF54600B1C82B90B0CA8BD2BFD670B53553225AEBF758C67E6B27AE1643DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 10.5MB
SHA256 7cb88465ef8e859f2ced1320c48f6017f3582f3aee6bd783112fc6dba10022d0
MD5 aefbc7ed18255da8524825d7f881785a
SHA1 e57af225fd0871c8b516e5968e67600ce43f7b2b
SHA512 2dacf861ceffbffcdaa63ec96722843266fafb438defdf9f9e5b446799eeabe7a459b25ff9dd22d05d6409674b34652d330ce2e42d82900f5f27ee633eb1a1a4
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsax:uzKzNp7kzKzNp7kzKzNp76
TLSH
T1A3B68D1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 20.9MB
SHA256 113772819715f761979ad93f9ea5801dabc06b27d3752a066ca8bc86d93531c8
MD5 84e140598ba9cdd69e1a2f33ad72ef10
SHA1 0e91e3af2fc1a3a2316d41e989d238365511287d
SHA512 783dd58d1d45f0f6704e03b31f0cb61ab98c28667fa376828fc47b8b74c1f45be692a1317e65ca75882c35a2629b2684c4de90b95df1b0bc8b52092af7be9933
SSDEEP 98304:uzKzNp7kzKzNp7kzKzNp7kzKzNp7kzKzNp7kzKzNp7N:uzKzjkzKzjkzKzjkzKzjkzKzjkzKzjN
TLSH
T1AD278D1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 27.9MB
SHA256 fe01ae55cc69d9699b46018ca0404885c8620023fa4a7923370f32460a08c381
MD5 2bce52ac0a41236aec1e61b826e9d8c7
SHA1 8a1bfe0e584f6f118ade7a741562f9b45465e07b
SHA512 f5a9e4c4495d8405579d24410354b79d10eb9cb8c9c9b53f7cc5d7135a87f1267942f1d8b19e67e4afdde1011d40e8bbac58ccb877409d802fb55680293fd849
SSDEEP 196608:uzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjY:C
TLSH
T175578D1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 2.8MB
SHA256 b3e0609084f01cb3eaacac873697952ccac061a25116ac474a873464ecca38f8
MD5 fd0232262ce00decee208e3afa6b0137
SHA1 3b840a43e57dfb2ca842c9d0f2648c8c3ae46cf8
SHA512 8c04f78eaa9e2bdd431aa9682c9d732525517721bba6e6e7d60f21da8c685c6607feb53471ad65b0f49f7bc571db223507c4791195989e1a7c12a24dd1dcb5b2
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaB:uzKzY
TLSH
T1A4D57D1DF59900B1C82B90B0CA8BD2BFD670B53153225AEBB754C67E6B27EE1643DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockCheckpoint.exe

Path C:\Users\Admin\Desktop\BlockCheckpoint.exe
Size 41.7MB
SHA256 3386a84caa42140764cd1306699f024643506607d02f50984601e129dafd1e59
MD5 3ac6b6c3e02da03daefc3ff3a9be5849
SHA1 665357bbcb1355a13620b8ca480d1d343cfdba24
SHA512 352944679aecee58e4d245d14254ed434370acb380e122894f01ebc17acda31d1768872fb66bc6def85c924142a07c60151e30bf7b237c3fae20945cb774338a
SSDEEP 196608:uzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzjkzKzj+:w
TLSH
T115A78C1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 05a4ed7cedeadaee46c246e69ad71a9b560cef5c0d34edcac371094810bf2668
MD5 9377f90aa3be6bae7aa418b5e2bfbeb3
SHA1 21e58a54df26b2290184c22a6305928bc32afb1a
SHA512 85fd67360dc32627b9af58bb567268ea28bb4a8bd7a0e3314e0d3dcbeccb85c60409c019ef96cc65a4cce175229e5bce306b0bfcfd8f840cb0e980fe155df00a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a4e00bc4809688a4be8fef7b252c72f78b578545ba8c09b1147e74f8465d4b4
MD5 6e2a61bae2144c1d87e2f43104967a29
SHA1 fe833a2bfc92e242772e84a5a67b562eed6b506c
SHA512 be9e5efa98c56b2a6623487298428d9617e4b9b65663838de6b3e57f1d66b2c011dbaf2c0640f3f996fe11c051324b3d2997ff7ec17c60cb67da0d0627707b12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3c5e4707642849f9f028fa892d370164c51e921ed8e1623289818a700beaa0e
MD5 e33194fa65040a20ce023c0e109a5e73
SHA1 e820a6584a007c98f5216377436c88d69ced1f4e
SHA512 27b82c05db11559b20b8ccf464ae234b98cb77f3a744cfa88b69e046fdadbec66dce7c171feb58f4d96424adc3ec205473d50c7afb77fe0785e22d7ab68c8d95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c309a581c7c7c6313ca275f1c6ffe13286c01eb7c4702931dfb9aba7821db009
MD5 42203f5595ea9aca252f69d79cf73e19
SHA1 4acdcbb7b21232aeec25df79a8ec5bf945292944
SHA512 011f368c31ff3e665ac472a56fbc5268794f6cf4726cdea3b57db83640a01894771ba30ba01d8df31649121fc6b2411fdcee9c2db1817e066a98fdd1a8fc6e6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ca5baf0ce5a817321554930e97ba09e2a7cf22c56980b4d67422be88e469cd7f
MD5 d766cb3a71fa45d2b669d356ceb5f37e
SHA1 da2936954763156a034ea63b1f6ef9186d149a3f
SHA512 59c4f33434e6430b19af8cb793f79b0809d6a7bbcdcfb16771657706bf84ac178f35201371a2759e2e3ceccfeb243eb064c66063bb92cc2fdbe38366c9ee3712
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8adf802401212b9cd2bbd1ba780f086e77854ae8f59fe44430efaa559896a4c9
MD5 7f717b839e37f6e4f544d8fe784fd003
SHA1 5ac8053e162e4bc31664610a9e73fadc75bde09f
SHA512 ad071f2a6549c1d09ed5a3e0fca5e2583128a5e5c3ee4a11c35a04bf6238b0a932c42a3301b87d647b0635bed46911f294564f11e4ec4ee6677ba9e8c3735a19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 222070a74e853b85091d6062f9870fbf57b7dd49b32fb8308c362b64edcc35d7
MD5 5c408de02f2bdefb1445048cccc209e1
SHA1 ccf62c2c27f4f5497483007c6c766ce789bf86af
SHA512 33bd38b9871fb10c4baae47cfed920aae0cefacc4b93cffd718e051c5daf711155e2cdd4171fa226b92d79e2c91156235d7729598d8ada273e6370e7bf623f6b
MD5 SHA1 SHA512

Submit Download

svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABCCABBABCCBABACBCCAACBABBAACACCCCABBBBBBAACABAABCCA.exe
Size 3.5MB
SHA256 a37a6e55bb4c5b2bea2b1e00c19fb00b3b6e6646f45e98b0f63d512f8c29fe47
MD5 54db336dc6aebd69755890b537470948
SHA1 9e7044c8d27fe5efb07075b0f9a7e39920f0c20a
SHA512 343252246e2b31a4c741d26e82f7d5c5290a03790827f39690bf6efded78680468587b93ac7cdb1434b22c936cd5ef754814db047fe0f83b81c2c10c7e0b1875
SSDEEP 49152:U+ES+ES+EWwy6i1zuajsaA+ES+ES+EWwy6i1zuajsar+ES+ES+EWwy6i1zuajsaO:uzKzNp7d
TLSH
T1F1F58C1DB29500B6D83B9070CA8BD27BD670B43123225ADFB754C67E6B27EE1683DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 afc2d274c82cbd1da3b8beea0594b61927d6b3fccd6178ccf9ede98a0144f505
MD5 948f36ee3b62b0c504d67e8363c02384
SHA1 540ead03a6b55a213f9f8b9c0a8acdcea15030ae
SHA512 e4b7997c55bdbf7058726c1ee9fa786ba7de6c32b6b0aada01cac41fa42354e373beb28f63fff6a5ba3246106d98cfa81de99e5653629049a0e5f10512711794
TLSH
T14A21D47098E6E463FE336CCB6229DB821CB8765F689C7A94130543286B95E31CE518B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 592edb89b368157e34a5def4cdd4823a40ae6916e96227b03ab6b34157002cb3
MD5 ebf5aa64eb925c7c7e5d88c8a5febad6
SHA1 d4d47d82d9ee3c20691f352a10a746f1cd4ae5ad
SHA512 f9e4eeeaae3aaffebe635c563d83d41109272065567c36bbe33e716f79932fdfd4f2f1342ccbe5c3a868a42ef277db195aead7e788f8320b86444284882f9769
TLSH
T1D121F93198E6E873FF33ACCB512DDB821CB8769F989C6980530543286BA5D31CD558F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 04a103545b32ac4c16b191dfa701e5c864fddc4eb1308c12167fa5af6a6f6174
MD5 bc0033581844b9c14e32d9b81dc0f166
SHA1 5ae4b92514c16fa1a00bfc5b64d358b782b25a18
SHA512 b198619d6f2147b4a9a16cf910a5007755602e037ebb93d204d029b80a957b77f491bfabe2e2d74559a376ec6ae76db0b30eba8adba309227df63bb51803d6aa
TLSH
T1E311C46198E6E433FA33BCCB6129DB821CB8765F589C6A9412054328AB65E31CD518B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-107-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/2596-1504-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/2752-10-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2752-68-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2752-46-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2752-21-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/2752-105-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/4412-69-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4412-47-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4412-106-0x0000000000990000-0x00000000009B1000-memory.dmp

Download