e5c5c1e98ff120766519c8faa6644b5d3e618dbee3b65a7fae30b46d88f8ccd3

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
Size 4.0MB
Sample260814-e311xsfb98
SHA256 e5c5c1e98ff120766519c8faa6644b5d3e618dbee3b65a7fae30b46d88f8ccd3
MD5 50be843d1520f51f3b23b900d46fb7b0
SHA1 1cb3108a7a0dac145620347cc4d2bf7644805152
SHA512 144515f5a1aa0a3103493c60cc5b201bb9229b2418ee3a11b34202ba0726e679e39581b57a7ff62f15b4f85a67b6861e426eab01289cf66ffe508ac0b872f7a3
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJ/iw2C+ES+ES+ES+EyJC+E1:Jp7J
TLSH
T194165C05F6D644F1E47761704DEBC27A8A71B96187318AEFE688872E5E33BD0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
3920	svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
4796	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACAACAACCABCBCAABBACABAABACBAAACCBBCACACACBACCACAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe"	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCAAACBBBACBCCCAABCCCCAAABBCBBBACACCACCCACCBBBBBCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe"	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2756	sc.exe
5520	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1100	cmd.exe
996	cmd.exe
1880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
3920	svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
3920	svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
4796	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
4796	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
Token: SeDebugPrivilege	2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
Token: SeDebugPrivilege	3920	svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
Token: SeDebugPrivilege	4796	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 1100	5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe	92
PID 1100 wrote to memory of 3448	1100	cmd.exe	94
PID 2064 wrote to memory of 2004	2064	svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe	95
PID 5836 wrote to memory of 996	5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe	98
PID 996 wrote to memory of 2756	996	cmd.exe	100
PID 5836 wrote to memory of 1880	5836	2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe	101
PID 1880 wrote to memory of 5520	1880	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_50be843d1520f51f3b23b900d46fb7b0_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCAAABBCCCACABCCBACBBBCCCCCCCAACCABAABAACBAAAACBBBCCCBAABCBABCBCCBBBACACAABBBABCABCCCBBBAAAABBBBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCAAABBCCCACABCCBACBBBCCCCCCCAACCABAABAACBAAAACBBBCCCBAABCBABCBCCBBBACACAABBBABCABCCCBBBAAAABBBBAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe" start= auto displayName= "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe" start= auto displayName= "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCBCBBBCACBCCBCCBABCBBACBBBBBABCCCABBABBBABCBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBACBBCCBCABABAAABABAAAACCCAACBCAABCBBCCAAACCCAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bcedf860f0eb19aabcb3ac99468236ac9bdc3874c793813147eb273859a76bcd
MD5 657949006d0006c0b126b003187f9f83
SHA1 ceacef6f2ba9100ff0559be9b10abace60684a96
SHA512 a747f3e748bc75fe5438a5cd0021915b7147deae6c0f1fe331b8077f66b23f1973f44b510ec5ec1f112f94ef4839a0e5a6fc06e3efbb4fb167de464825bc187e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.6MB
SHA256 44935f9f9a232fccadf93edf695ffb13e512f4305f1cd25f7a8d0bebca70d4b3
MD5 5bdc113d508068a37b6138351dc8100d
SHA1 30b70d7fe848ba760fe552f78a0bcffe451a2c1e
SHA512 0a0b0e99f8a1f4add298daf5c5e0b4d8d3d8a3fc6e59e41310da39736c3b54529c77a86082fed05c4f1a2b451509df872e3c052d7b5f48e368594f1814b71517
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJ/iw2C+ES+ES+ES+EyJC+Es:Jp7ogZ2Hb9t+2xD
TLSH
T108266D05F69640F1E57711704DEBC27A8A75B92187318EEFE688C62E6E33BD0AC35712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\qap`g`v~dtlq
Size 10B
SHA256 79441508d5a0f5b5dbb97eea1a615f60d979e7d6c15fba7b65ce5f674766b787
MD5 f6ee71999f91da1a93e574f468fb66eb
SHA1 2f4ccb9c2122f472d59f37fb901e260ab593cafc
SHA512 7786d494b7d20afaaa8582894d3a1b1f0be6ace719a53633e9e1848885a09b7fbbb198411d82cd3bafd61cc85717357b25a3863110250ad235a3d47fbdd2f7f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 c4b9a39047bae1e2ecd7af0ffc053727def293605f80260132e3300b97ae9b95
MD5 26975c63e16e6bdf3d6fb8f891fb48a1
SHA1 646334e103314bcf6a8cccc444f5da5bbec9b964
SHA512 b7cfe612fa5a779e949f8865c6134abe24516bb189654e839b2cb7493dc16ec8fb5755ab8c58005c5336d9cdd66e93415d9377911e5a1010b4b6c1bb25f14e57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\WaitWatch\qap`g`v~dtlq
Size 10B
SHA256 0829b58b0dd9ab5c4e6068fcc5431b60506cff5be3cc509819104ff42862f843
MD5 4f6e5d1c600d94a8e0c8a2471f19ad79
SHA1 4a9cf2f19e9e7d5f14241f9267dcbc4a63c7f154
SHA512 b6b47c1eebb0d5018a8b988d115675ededb3c5a8cf3499b416ee1169ff62bd2fe213c62b9ed91d07bb6cb8ba33856c632ecc982edc43b2a555aeff837769ebb2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71805163aa5d643185e8a06ea3b16dc691824a20c44936642faeadf0b5c5f427
MD5 af6dcd19cb737408488d75f2a389e4f9
SHA1 ea42306578a11452bd469248696888ec196e4688
SHA512 248888afd9c38d543565d2515f557b18c6046cda845ec5b036c3dbfd39ebc58983e12212a9ba25a1f644bd68b58b3dee9846a075f21f84d729d8ddfcd89f36d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b6326fcbd614e07d9bf2c4a5f7354e7b85f3249dd590eee91261cc201130d4e
MD5 a72c462cf93b41cbf2db2ae6318f453d
SHA1 00cb851c2563ef8b1b51f21961b9043c882b13a4
SHA512 9f5696cc03aa8e2165f03ab656e29e4ff127fe9485ee665f68ecb1e3caf34fad43413280122f9936f81d8e65cdbee46f59ebf4e8dc49e6fd0a09a82b6eface1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6012d027038fdac9b8f44ee2c7994800caaec06e05f2625d21b8d3ae7d90d15d
MD5 50c99fd2e2b0471b2d2aa432f3bcbfcd
SHA1 804a8e75dedeea91300f6c3033f31ff91ce0dde3
SHA512 74773f5b4fad324e315ee07a80642a64b7dcc87d099c1b14750a7c5809c31ad3e9aab600772590addd0c3c0d53549e444bd3a40e50bfe0ccd2644684a825de62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c2843e845cd87739ec50adb046166fe1969448c1b2406dd0ebf5468454657f89
MD5 2cd77b4eaff392f5867646f61c7c1f75
SHA1 e4f8bf629a5f93d3c7ae88776d5c001e77ca0280
SHA512 01ba33814a9a906931a8cc5c8dec9612efdd24e2a4eab7010a302cc77c38a6856d6acbeada2f51674d70e4187005928661dd6f345b3826d93484092c2a22789a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8fb33f48f32e118369257dd5d0c95da60c81027c838033f494c30ce5fc773388
MD5 4982bce5a5bbfce376768d39e436c2d1
SHA1 f670fc8be551afdd5ce677e88b83522a3ca6ad1b
SHA512 a6b577c8339fac9dfe547fd15b91e372b68aebe54317ab2227ae5144481fdc32403ef86d1182156f7d521a7c9b75b53d05ed5ac5897e7a925214ae9b3ff6321a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\qap`g`v~dtlq
Size 10B
SHA256 9ff5e157b96a086950d4e7d7235a85e0ab32e60cee79061d4dc163b482becdfb
MD5 9c404a8379d968269783b4c68b2eb00e
SHA1 721c633f9b1594128e593dab4803d850fa8168b9
SHA512 a2f7c6d83607c1d84258a372cc08c1cac4d1bc478d13905f8c4fa094b5a6bd13e7fece671013cff8fb61e3ce38749bb0b848ff1e3101739896b5415a8c77aae4
MD5 SHA1 SHA512

Submit Download

svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABBAABCCACABBAAAABACABBBABBBCBBBABCCABCACBBCAACCCAA.exe
Size 4.0MB
SHA256 e5c5c1e98ff120766519c8faa6644b5d3e618dbee3b65a7fae30b46d88f8ccd3
MD5 50be843d1520f51f3b23b900d46fb7b0
SHA1 1cb3108a7a0dac145620347cc4d2bf7644805152
SHA512 144515f5a1aa0a3103493c60cc5b201bb9229b2418ee3a11b34202ba0726e679e39581b57a7ff62f15b4f85a67b6861e426eab01289cf66ffe508ac0b872f7a3
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJ/iw2C+ES+ES+ES+EyJC+E1:Jp7J
TLSH
T194165C05F6D644F1E47761704DEBC27A8A71B96187318AEFE688872E5E33BD0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4aaf18afda8242b2c61f2e3aff7b60aac565e631cf3dcac0c0d2a3737172736d
MD5 acb93d54046fac61452d0e38240e2009
SHA1 bb849620c149eebd0d34f42fb5fe6e62dbec0142
SHA512 f635fbcadf7a7cb7f827d962fb51a04b6315c7994df8ca0120509f3d90c0841609ed1bc773ed33231e8c954f8c7dd666d38459584b6bff27db4a914b55de5ff4
TLSH
T13A11AB6098E5D837EB33AC8A911F8BC20CF5B78F6918EA1813054228EBC5D25CD554E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8c6097c418ceefed97db69b4a55c91085b668a25bea0eb78e476a58787f57866
MD5 0349cc246f218deaea4da0a7aeed5962
SHA1 6c224c3ce83fcfe79b56a117052a7c15a5340bb3
SHA512 f4a879e3391e711930bd1e945a75596a283d2a20a853df48fd5a2fa4c9485de229e9a57cccbd1744e53b8e3ba59b0454f663f738cf7f8dcb7291699822393d30
TLSH
T1CC219C6098E5D837EA33AC9A921FCFC20CF5B74F6918AA1813055128EEC9D25CD554E6
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 08645dc350772d1cc7f77fe987e4dcc1b56ba23263d1ec27386129630e1831f3
MD5 d42abe6884ebdf0e148ca3a7fac1326d
SHA1 7295716c549aca82fb627ac5e4f172fa498cf968
SHA512 f680d9d3bd6cf7374d62128caa9fc3829f3fa46215fc1288a34080f1d2482ffad62e44f917f1c169d42af1874817aa16ee43abdc81208f6fc5e3a7ca7f5d975a
MD5 SHA1 SHA512

Submit Download

memory/2064-31-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/3920-78-0x0000000000D40000-0x0000000000D61000-memory.dmp

Download

memory/4796-1880-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/5836-0-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/5836-7-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download