53704a871e8ccef9c155a773ad3d9cad0b9ce80d90c05aedfccc8e0d9cdcb48d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
Size 1.1MB
Sample260814-e592lscq3z
SHA256 53704a871e8ccef9c155a773ad3d9cad0b9ce80d90c05aedfccc8e0d9cdcb48d
MD5 4af25cd7dac8c819219000c5953af2ec
SHA1 bc8c9f14e5b3da25bc842302f464297260a04ab2
SHA512 999eab6b21455592e04ed0e9ddeee0d318cfa557cb5ac6ecb01a25819fb4b7f99fee1569095d46fc234769c61c485895226bb2f9e773b9a411834bf4030bd277
SSDEEP 24576:m9+EM0yslZOZn9+EM0yslZOZBenbtkJxdmvJ:U+E/q+E/+enbYdmh
TLSH
T14A356B06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 7 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001bd5c-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4d4-25.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001bd5c-33.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001bd5c-44.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001bd5c-88.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001bd5c-1573.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000f00000001bd5c-4093.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
2408	svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe
4104	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBBCCACBCBBAACCCCABACABBAACCABCBBACBCCACBABBBBBACBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe"	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAACCABBBCABBCAAAACCCCBAABCCBCAACBBCBBBABBBACBCBACABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe"	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2292	sc.exe
2988	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe
1204	cmd.exe
4620	cmd.exe
3840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2372	schtasks.exe
3012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
4104	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
4104	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
2408	svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe
2408	svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
Token: SeDebugPrivilege	4104	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
Token: SeDebugPrivilege	2408	svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 1204	4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe	92
PID 1204 wrote to memory of 2372	1204	cmd.exe	94
PID 2600 wrote to memory of 2880	2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe	95
PID 4980 wrote to memory of 4620	4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe	98
PID 4620 wrote to memory of 2292	4620	cmd.exe	100
PID 4980 wrote to memory of 3840	4980	2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe	101
PID 3840 wrote to memory of 2988	3840	cmd.exe	103
PID 2600 wrote to memory of 4828	2600	svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe	106
PID 4828 wrote to memory of 3012	4828	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4af25cd7dac8c819219000c5953af2ec_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCAACBABAACCABCACBACCCACBBAAAAABCACCBBABBCACABCCAAAACAAAABBBCBCABABABCAACBBBACCACBCCCAACCACBBAABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCAACBABAACCABCACBACCCACBBAAAAABCACCBBABBCACABCCAAAACAAAABBBCBCABABABCAACBBBACCACBCCCAACCACBBAABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe" start= auto displayName= "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe" start= auto displayName= "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACBBBBBAACCAABABABBACCAABBAAACACBBCBBABBCBBCCBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2988

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCABABBABCBBBABCCACCABBBCACCCCBCBABCCCBCCACBBCCCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACBCACBBBCACBAABCABCBAAABACCBCABBCBCCABAACABAACACBCABABBABCBBBABCCACCABBBCACCCCBCBABCCCBCCACBBCCCACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCACABBAABAAACABABBBAAABCCCBABCACABBBCBCCCCBBBAAABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dd94257e3bdef19ee6fc65aecfe4ea47667e9eec3dcf5b88556ff1a992d6f7f3
MD5 dd8140f629c7e0eb678eee9e73896fab
SHA1 7539ed5b2cfbc25a4617042a2eb55c1ef57d72ef
SHA512 70a41066705e4970b03b211786b800eb115844a2ab6ae2881dfa8fc473e1d96a57f5390bf9d7216c4cd4d0407845f13c2e231e48cfb0f531bb06ae4f8b061d24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\UserData\qap`g`v~dtlq
Size 10B
SHA256 92ab8427389610725e24c3bc9479107d46fd7f98ceeff3ce885baba8503a0677
MD5 18bcbcc3ff61e5b85084fb68aad5ad3f
SHA1 5a0eedb023bed0203ccc9f36e6be3a9f89b25297
SHA512 380031f8de54aca3fb416f49be6318345956a413ad107cccb4b89c91134bd47fd069726e1141aeffcd43e90e53e580bee7b583b8bf253e77dc1b27765fa3a320
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\AggregatorStorage\qap`g`v~dtlq
Size 10B
SHA256 8deea6924d7798abd13f0e1e28df0476df1621386abe6f4ea3d94c7998fc6f69
MD5 00e9cebf3908a7732c54ae14ca9942f7
SHA1 926c9f064cbc7c8e4fa03e5b02a0c2243670b29b
SHA512 2d93e383835fe7e591c6ca1a333a01d9bcda8230607fb91241018fb42082ea0257ca6e58eee5482c41a08ce0bfc527511909c5a15ea85925f48f92e58598efa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 8a441baf594f18556ad6389c4ba2426235d32ae054b64d9a9b10f48a59face5a
MD5 f15c158152aea7aa52b1347964dfb105
SHA1 e1c2ca0586e7b4a4484d2b75c5a9177e94d3c3d8
SHA512 17b06c60285fbaa29ec885ca4a206329c054ee7fd5919772e2f56d4c5c57d5da73783c466b0cc16e649b6d33afba5648d2bd30ffd17a73fc08e0a826ef22a5c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\PlayReady\Internet Explorer\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07b9fe2bcee50e79ea5d107da46e67a43a61864a8c2ce2731161f41926e71745
MD5 e2988240765631f12278f5256b3668f8
SHA1 a359ebd5f549bf2e9ca04accbd02c9637bd3ec09
SHA512 1636335c8302c3639b6bde1e49fb44714dabd16fd2a35cedce2ee6cfa300a9d1de78f75655271c90f48815a7e4049fda0e63f53cd2a60de109e195bb6a0733d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\qap`g`v~dtlq
Size 10B
SHA256 238e6c0f91f651950d0027df8dd73617310ce13a19bb039a99b3d64b056b8625
MD5 5fb42ba3413e33066d309c44dc77c619
SHA1 cf6c5089a509ec9825d2f3fb9ba9b1f91b81c4f1
SHA512 40a9e557aed7a13e312dc53116466f2c8283b93ada63e6ebd7cfa62728be06450f0d348bbd26c472f3373e0f472e22e669aa7c2ecc26773d84f7ff6dd402d9d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7df15e42e1a8cd87c2b654df04c9adad08e40720744d1a65f2021db2ec4e2037
MD5 761ed33f740b9c43361d0aa98a21c50d
SHA1 cb1fecbb0b89a9f2d76af9249fd63ec99264b99e
SHA512 a7691cc19795f78d8b6db66c48722c126e6c5fea9716b9d5a62c770c57b3932048acce94af7c4458de24c949468678d7db3c133485063c0756989e9e70a978ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f9f0f69567e7923c78d43fe3b6df1bc9e55e1a788d9c610c4e993dc9f9848fb
MD5 900d0da511a7e0baa548898ffee2d70b
SHA1 2c85cba759e053edad0f55888b8105bc11a77df3
SHA512 e1fe6bd084136f2dee04b2b1aa003df5aafb97c6d73cbc94197bc77f0d263595e786e4e3967c925fbbc30e178c3073db8e891323f729a3476c09817f2cf808b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0a4d667bc222baf2811a7c29cbb1ee5f0a94dc77964cf6878a61bcf1c9471ac
MD5 45fbe84c4a6ec87f9caa50bd9aeb2c68
SHA1 92e031628b30124c0cc7c2daddb4679ff332a92a
SHA512 5f24f4307ab8668cf267824eca61e3b8e0e83b791a4b8c33b0c081f8f68794f1d898ab15c848018184816d3f1d38ce5c58ba712059cfb02782530606ff38993f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 834f7e2fa65db491f21bbd9fce34e2ac246f1ae6540c79c4051b7fe3f1e9ef22
MD5 14f5c3585845099f1ebca0ec1540c550
SHA1 cdb44ed8bc65a4a20a3519b47d9e5ad53d805716
SHA512 7f34a943c5d4d937ccda2db341e6ec681b66b6a9dc85538e1a34eed5cb0487b1f26206372ca0e11f861b1b15480b04972f9a6e9f730dd7910a42e6626b640662
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0bfe5b9b130488789047cf7665ac2e41a4e2b072e2cdc4e430ef89e26a440232
MD5 c6cce3ea086fcc11b8a219e465336160
SHA1 cc5e65410ae5a9c10a5e0f749a17cb1e98d7cb45
SHA512 07724f91089f7d3d27c0e59a92c0684855084a50efad64a0dccd10b8bc78d8414a06557a177f19e6fefbe5e8fc8caa4b95a03b5eff11ff23e2f38fcb0145f101
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69f5ce20b83101cb03029f286c00ee46005299db240ff65fd06e286fa273ec67
MD5 cfde5a13e8192de16adb4fa9a396b10f
SHA1 dc1961787b225558e8d7c951e2d76f955b6637d9
SHA512 d42ccf1364001b6769cab27e103b94575b4e58df1c5e915531367f8a257b76693751bf6a1b6e28206517a7ad8e0a32c0165791cda988bc899ce86326986a3b0f
MD5 SHA1 SHA512

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 4.3MB
SHA256 8e17d3e6c6a4f5edc161dc92b871104e3e6bbf3f16a80b994e44610dd41aa206
MD5 770f805ac266f344b94fb31601cc9811
SHA1 df7d7f5a2ee09d5c4c0c5a4f5efb4dcfec085a93
SHA512 73794cb008e5d1946ae49d0b6a5f9f3def01910255790ac7c5d2716e184d930f5eca776a77565a805878be60f3968faac8fbe918b11ce803c1706c69c11e901b
SSDEEP 49152:U+E/q+E/+enbYdm2+E/q+E/+enbYdm2+E/q+E/+enbYdmLa0gTmRK9k8dy1nderv:aUsUsU/5qq0k8dy1nd4X
TLSH
T1B2269D06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 13.1MB
SHA256 e8de3f4dfa8ebcfef44268666c68559a1208116447f5e24438936a3d79598514
MD5 4a3c9c2361ae8c0159bb81c2324d0e97
SHA1 8ab1f182b61ce1a2db5256baaf3e37c21e7dfedf
SHA512 5aa2999943afc5a689e85ecf57beb2d68cfd1f979e7ddd4c2442a0f3fdaacb7a475d936c242e91ebaa7ba415621a5ae914f1676ecae3bee4c2b09b32b08270a6
SSDEEP 98304:aUsUsUsUsUsUsUsUsUsUsU/5qq0k8dy1nd4z:aUsUsUsUsUsUsUsUsUsUsU/5qIl1ndK
TLSH
T123D67C06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 6.5MB
SHA256 e824faa4d839ff67270a374c530aef05a407381a9c7815e71a06a9f67419132f
MD5 6bc7a7057baa245717b7b86a89c075f3
SHA1 f889bbe03d29420b5c25fab6246ba32b53735447
SHA512 e2f150cc6572b817b6c7ab1fd70f47ed4c0b9d2f8ec7a9c5924d58c1ad1208aa1d1dc1ff20d5e792e0383792457fc2db61e0495b0095eb0b08b41d6536fae62f
SSDEEP 49152:U+E/q+E/+enbYdm2+E/q+E/+enbYdm2+E/q+E/+enbYdm2+E/q+E/+enbYdm2+EB:aUsUsUsUsU/5qq0k8dy1nd4V
TLSH
T1A0668D06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 16.5MB
SHA256 deaba95b130ef1c51a034ba60d4d3587de95d1044b8da4b8114781fe356013b4
MD5 52f6567069f080d7df1034e461254eea
SHA1 73f525d43b4ff9ea529ab8ee5740123410dab554
SHA512 487cf7e604207de37c54967e0467d996a4506f1a0780e27876793fe4ccbd706fc4aa830670270bd85c48bf843c0ab15e83626b5c59f312d22e9699a1085302e7
SSDEEP 196608:aUsUsUsUsUsUsUsUsUsUsUsUsUsU/5qIl1ndZ:95zdZ
TLSH
T112077C06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 7.6MB
SHA256 f46bb0e369bcc6ec6503b076b7581136d2d85c64c6512ba5cd2c6c05fb92dbd8
MD5 168cc5a11df5c7179b375e0740595bb6
SHA1 3aabfb19b4b78a3968a871507451d1a06ccc3d3d
SHA512 0ed37ab1b25a9dba29d9b9674ff213f45b26910290be4773d8c2d70ccd3cf0268770ed22572ada0aac114adf9e2bd41cc839e4431f97b3711d1864c753c6c251
SSDEEP 49152:U+E/q+E/+enbYdm2+E/q+E/+enbYdm2+E/q+E/+enbYdm2+E/q+E/+enbYdm2+Ec:aUsUsUsUsUsU/5qq0k8dy1nd4u
TLSH
T137868C06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 64KB
SHA256 d3569602a5b82e19383832f4093a7f1a5b93a42445233522973dd41bdaba802e
MD5 32eec5ccde5a6ff6cdc0626daa589f6c
SHA1 2fd2c166b52f03e4a174d37caf382953970dce71
SHA512 4041c7b64cb6be577b2e5ad2ee43fcee5a8abe98fd781d527e35c697374f4021cc81e21f5c869af0f9d17616b9722b463557708734a7c370f84c717349a2cbc5
SSDEEP 1536:+sdt7O2Ut9G9vVRTLoy2jpmEY13kQ9GKd:PdtpUtI9vTTLoFpmEY13Xoi
TLSH
T11653E819F98350F1DD2B11F10DCBE3FF8A60AB26C4128EB5EB4EC75BB932B215418665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 256KB
SHA256 9fef0fb7562e935ddf14e95a86329a730bf96a17c872d6ed209ffda57bdeb326
MD5 9f81fb09ea0cc06f25043a60937617ec
SHA1 dfff65d752950224d1d0a8e012b2cae830b3d8af
SHA512 bc90e65c5e1b30e0ae2d43adfb8ec534708637d82e1d3dc81be8710899af0ab17507cf4003ab0f08d4add2888d821d56741a5c9f60ab721c4187c03c9838df50
SSDEEP 6144:m+dTTUFgEs3XojAdFkMIRIwo1igg1NBice1sTAQOehTlv:mgUFgEsnojA8rCB1igsNBfcsc+Zv
TLSH
T187448E49F2A000F4D6AB8170CA8BD17BD7F1BA5666119B8FA764C7572B37762B43E300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CheckpointCompare.exe

Path C:\Users\Admin\Downloads\CheckpointCompare.exe
Size 12.0MB
SHA256 ee7eb88fc2ddab767d4f7291794008ba3ab5e1dcbb9ed0efa075bd0f4ba76176
MD5 1a0fd61ea24c4bfeccb2b39fd1be8813
SHA1 2fefea7aebbe6c83851960eb9699f7b81d9e15bf
SHA512 12862f38f63f5e4d7aefb77380384df1e1acbd6c0b8449bb62a8fcd0b9310075104110ff75a1683a0fe4bba98bf57513c334d3ba671183a9708212211331d8e5
SSDEEP 98304:aUsUsUsUsUsUsUsUsUsU/5qq0k8dy1nd4k:aUsUsUsUsUsUsUsUsUsU/5qIl1ndH
TLSH
T1E1D67C06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4bb928781dd27d4038f0b6850f9bf5423b4e761f6f066dc1b65744bb2d9f831b
MD5 5ce3938e0634fffe2f8321eb4a9b65ca
SHA1 e20418657c3b796c5679cc50ef87612d40713154
SHA512 cac43ebb252352dd0159b80b73425fb84d8b87086fbf6c498640ca293134628df66a0f082ff668878f63c938beeab1d3e2dfd6aa822e906a884c4486c5f8c88a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
Size 10B
SHA256 e523b241b149977b5a0f6db0d3796b07dcd2d770013b44d350c5dab6433d4f84
MD5 0f65a12043bb794fc3e85551d6dd8ec4
SHA1 93b0cf6ae78b0bd614c63bcbd4508daae306d1e0
SHA512 07a660a4f5ded89c0fb6efb6ea7f994f3e828242f2ca8a527832b7eca8dedc766f75b68a027e8c44400d79ecfbdc618b8c021275b8ad368688ea4f0ce8eecfbf
MD5 SHA1 SHA512

Submit Download

svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCACCBCBCAABABACBBCCBCCCCBABCABACBCAABAAAACBCACABBCCCC.exe
Size 1.1MB
SHA256 53704a871e8ccef9c155a773ad3d9cad0b9ce80d90c05aedfccc8e0d9cdcb48d
MD5 4af25cd7dac8c819219000c5953af2ec
SHA1 bc8c9f14e5b3da25bc842302f464297260a04ab2
SHA512 999eab6b21455592e04ed0e9ddeee0d318cfa557cb5ac6ecb01a25819fb4b7f99fee1569095d46fc234769c61c485895226bb2f9e773b9a411834bf4030bd277
SSDEEP 24576:m9+EM0yslZOZn9+EM0yslZOZBenbtkJxdmvJ:U+E/q+E/+enbYdmh
TLSH
T14A356B06F7E48AF6E5B34230C9A6C1B5DA727C555A30CB4F3268B61A3F376909CB8711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 360de1de9623b3096260d557de6366a1d014bd9e38596bc8e6ad8281d8582410
MD5 5c479ba7ee4c6f320a1079c20ca23501
SHA1 2bbb3c355c96c5b10c47aab3634cc3c609b91e0f
SHA512 e27e5f309795ae1d0f46a2bf812d8e3bca689fd5f97df6f9fe9692e3e748e1602304967e4e5cf0e54b09cca6c9eac69f133ab14411757a413019cefba4eed050
TLSH
T15121DB726CE5C833ED33688F952BCBA30CB4779B599CAA5453090128ABD9D31CD590F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8905c9fac5b4c143b441bd909223dc8b713a5d6cc1a824b77c0698d5ce38fc61
MD5 cd238487dc7bc633a08c37b17cd65739
SHA1 e78c79e766ec8df91dfc2a9ade48636eb1ed8f2b
SHA512 671f58a3df5845fa81e06f74b58b2d66beeb8bb82e867305226090a1562e28cb5da37687b057205df712b84275b67c4d4b7514f10755af1643b92c5cf9b3a665
TLSH
T1D421FC72ACD4CC33EE33A8CFA52BDBA20CB4779B589C994453090228ABD9D31CD590E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 51fe28852d9b9068ee0a1c0547a2b80fac3b3c3548505dce15bd603771626923
MD5 1956c1efbd6b094df99e534a763513b5
SHA1 f975905c8959183de502ac9d2638a9dce124b820
SHA512 769581bf6fa3d8589fb7b3cdb1d213836a31680966dba240520fc70ef75a5fbeecb9e20e46dd5130e46e0eb77639e64bdc78513d99b15e8c65363c73a5b4d868
TLSH
T10A11E7726CE5D833ED33688F952BDBA30CB0779B199CAA5852090228AB95D31CD590E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2408-83-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/2408-4102-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/2600-46-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2600-92-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/2600-68-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4104-2998-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4104-4104-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4980-10-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4980-21-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4980-93-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4980-47-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4980-69-0x0000000000990000-0x00000000009B1000-memory.dmp

Download