5dd5b1723f3b1dbabcf0ab0aa1008c3805e08eb43f419af9c7f9afbe0242721d

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Size 26.1MB
Sample260819-erwxtsysa1
SHA256 5dd5b1723f3b1dbabcf0ab0aa1008c3805e08eb43f419af9c7f9afbe0242721d
MD5 d88ba3195cab2c0cf634229a988ecbfb
SHA1 e33e1dc155ab47414010775e68e7154c6ef6ac8a
SHA512 6b9884948736c71955e3143548050819dace7184e0712aab5faec9a000e1307ce0a223263b9e92a9261f53f5ad61ee28724ca7c8f0aaa9b92fbfde4cd93df91a
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:NLZ1onLZ1oLp7t
TLSH
T199575B09F94340B1D92B10B04DCBD2BF8A70BB2587128DF7FA8DDB1B7932BA16439655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
1084	svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe
7164	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCCCBCABBACACCCAABCCAABAAAACCBCCCAAACBABBABBCCACBACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe"	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCABACBABCAACAABCCACBBBAACCACABBCBABBCBBCABACBCAAAAACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe"	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5536	sc.exe
5808	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6460	cmd.exe
3536	cmd.exe
1112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
7164	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
7164	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
1084	svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe
1084	svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Token: SeDebugPrivilege	4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
Token: SeDebugPrivilege	7164	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
Token: SeDebugPrivilege	1084	svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 6460	1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	93
PID 6460 wrote to memory of 1880	6460	cmd.exe	95
PID 4200 wrote to memory of 3056	4200	svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe	96
PID 1692 wrote to memory of 3536	1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	99
PID 3536 wrote to memory of 5536	3536	cmd.exe	101
PID 1692 wrote to memory of 1112	1692	2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	102
PID 1112 wrote to memory of 5808	1112	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d88ba3195cab2c0cf634229a988ecbfb_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACBCABABAABCCBBCBBAACBBACCAACCACCCCCBBCABAACACBCCACBAABCCAACACACBCBAAAABABCBCCBCBAACAACACABBABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAAACBCABABAABCCBBCBBAACBBACCAACCACCCCCBBCABAACACBCCACBAABCCAACACACBCBAAAABABCBCCBCBAACAACACABBABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe" start= auto displayName= "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe" start= auto displayName= "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBCBCABAABACACCCCAACCCCBCACBCBACCBCAABACBABACACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCABBBCAABCCBAABBACBABAAACBBBBCCABAACBBABCCACBBCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2c42d5c5f6d1e14fdf4a01b11cdc947f90bfcccae14454ad2dd82b5b97d80476
MD5 2068132fdee006f3306b1a8041f1d6dc
SHA1 e8a516b35bf462a835d3c11fa34ab7d180d77353
SHA512 c37615860444c38181eab7249666483c384859ded39f3b5d594fcf0c8de6da360bcadb1c9fdd9d5fe11847355722fda6b4d10803c76d880ac186643f1d69f29b
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 26.7MB
SHA256 09d549c9ca0b2566342f0d66bdc69460571da589dcf9a7d3cdccdcfefb39ee53
MD5 4465a47e39b1d2fcf98915c7cc022ee2
SHA1 fdb6072090b9a43c4f2d7d5551529b83a80a86f6
SHA512 c16fb89555d9267acaa3a754e1716fdf07423bfc08a5a61abed7873b01800616257761b8bb04779d620d89eefa4bf24903e0199c8e939df176a1aaf350690f0f
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+E5:NLZ1onLZ1oLp7cgZ2Hb9t+2xx
TLSH
T11C576C09F94340B1D92B10B04DCBD2BF8A74BB2587128DF7FA8DDB1B7932BA16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 3b853717a9a5816e69f5a1eb30305c3e59864037e805a77a095366f72eeef716
MD5 668dee3805b22e30970f59876347dcce
SHA1 8dd164e3d4d36ca6c446f45f0e86bf350beb5a46
SHA512 7dc45f4843de55c0abea83dd218db3650a9da214391aa12904d9f022d9e030ffa49ad707b6692b6fb6657a0235810f177b8e6f4f438dca39783f7a56d97ca516
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.34\Sigma\qap`g`v~dtlq
Size 10B
SHA256 5d09eb0c0651444aae3f8e9d46110bd3e5848a3c629ea9d125cabcb9a0d7e94c
MD5 2d8d25db6bd3702faf6e5a3d8ff530fa
SHA1 a928ebc21b622b7e0f89755602bbc681f5ad7751
SHA512 0b2230733dcd82f40cdb0503e6df9d01a3291b94c58508fa4d500cd79263832c48debb85a60d29fe35bd4bd63fd2ead3514c6bb5a7b183243686e6691e86787b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 1c789aa1e5d57b4af93acf270db114a601a0d200113a06db88291e6dc4c12c7a
MD5 3021206af83b4d7c40846f15a11912a3
SHA1 2b7c6a3f44ed0791cacbcea971dc612366c0b4d6
SHA512 f2e8cf5a9fcae16a0dd8cbbfab9ba8d76eefedaa797566cb1df6ee6acffdd3a1a1a2bada1cd3a5a269d29ce7c0b282a88951889818080ad623e2bb06816f4c39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edfc75fd2fbfdd48dccebda7bf81045b40756dd4eebe9ce506d0f01aecc6766c
MD5 1e781646e4bbba808ef374edcce95c9e
SHA1 dcd9b8f3382fcb077973402a01775ff874301cec
SHA512 e2762ec19942e1d6c78805abd286757feb70810768212fb8dc6c860be0c3041336091cdddbde885de9067675bef4506f77dc7c22c2002fccd1603110a41d708b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c14d2af09e1a8e3c690975338f049c964852a612c4f9320d3f34b6f8af1e51d8
MD5 5ab4132510cbc08ac5164cfc8a6b0e41
SHA1 cd597c193c81f959dfdeb7f7335dc984b7c3dc6e
SHA512 b40b6863d3ed53fc82bb37c97de1e291fbe19a393aabb8c93cd4cc83de3ea30dff4301b86bec92f5faec3f3e6e449f110cb64a3f3d91087563a0dc865529c811
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f45da6225beb7df26c8409ba90c12baa3c850b3cdfb23cddb3ae261407e3f0fd
MD5 ce6af075c3e89c14b05bb02f2a364867
SHA1 cbd992fb002cecb404667c5d51a429b122ef1ab4
SHA512 dd6de2a703ecd9fa238ba86739e1a38a7d07eb12bfc5abb65934ac5c12a065dbf6ae7d42358d968f84f8d5559b8d509418a26c469549d2b595855eedc58dd233
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20b28321d593ceacf317350a4fae277f537148ab24281d90aedaa73691728f89
MD5 af1730a1f59c704e85065459440a610d
SHA1 ecf55cc87dab87b1edc8e3430b74a7b49af91ab0
SHA512 1cd664e5b854972d71cd149f962315a7fe660455bf033e5501afc043312afe8435ec9010cc947c2aaf084fd3e1c52b4494c34db9c1abf5a23b6ee2c249c1bdf5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3cf14383ed68eea8480b4d703f0c316fae04bc3a8bbff8e79c558cfd867c5849
MD5 d9decef83c63eeed6b75ebccf5370eb4
SHA1 4373bcff2f5509d6ddc9647cb44baf4d538e7d77
SHA512 1ece530efcf4c50d84ba6df79ed1f6c2c82833f26ccfde2e6e59352a2193a754ce37a5ff9e98c3b67af3d9c4968b98629a4a58e917331a6d5decf19d5d9c188a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e870c50d1f390eaf93efd6e230738b51dfd62d228a153f769c030237dbc7825e
MD5 d324232d68c24e74394a37521cb02b9e
SHA1 d06a75c177b8e2d3dbb258637d879b62ef619c11
SHA512 54c98c6ae8125a91c666d7695d3a51d3975e8c84950d53a6ed9f3273f2300bae1116bd5193d79c91171960a95e8b33a90b2f20454af800630507953303b02790
MD5 SHA1 SHA512

Submit Download

svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABAAABBCCCBCAAAAAABACCCCABBBACACBBCBAAABBBCBCCBACABB.exe
Size 26.1MB
SHA256 5dd5b1723f3b1dbabcf0ab0aa1008c3805e08eb43f419af9c7f9afbe0242721d
MD5 d88ba3195cab2c0cf634229a988ecbfb
SHA1 e33e1dc155ab47414010775e68e7154c6ef6ac8a
SHA512 6b9884948736c71955e3143548050819dace7184e0712aab5faec9a000e1307ce0a223263b9e92a9261f53f5ad61ee28724ca7c8f0aaa9b92fbfde4cd93df91a
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:NLZ1onLZ1oLp7t
TLSH
T199575B09F94340B1D92B10B04DCBD2BF8A70BB2587128DF7FA8DDB1B7932BA16439655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f2b2e652b3773eed97876d2bf959c5d3e747191490dd40cbc1f064124a33d6ce
MD5 2bc16560e3b76071e5c2d5a4dbc58d55
SHA1 44981e3dc43bd9de90489fa6cdf50a12dc269640
SHA512 cbd1585a0decd70a1f9606d2a48b6b9ce55b15848288f94444d8f6f9b72b2838d54fa6d3c15e5e80ce9d1de011fed0d46e5994f9ae426c24c2d25c68b9559fcf
TLSH
T147215E6598A4D84BEC3365C7A23DEA438DD03B9768BCAA441384C118FFC5D718F490F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c98175e2cbd916b69f3359eb7ae4c8a02704e85a7d558253122118d10cce52e6
MD5 a5469b987b168a7aa68e859e39605e47
SHA1 323ae11df61545f43371ad97256dfa6d1a9341d7
SHA512 d1cabfceebc4812cb489916c06f3216abd7327af90f025468e4a46d2deb6e54e3474b65452df6c5bd50f3a27d5c5e08a69f1d5b697ea7ac9dcaf93480fffe36a
TLSH
T1F1113A6598A5D84BE83365C7A23EEA838DD0379768BCAA481384C118FBC5D71CE590F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-64-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/1692-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1692-7-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4200-33-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/7164-75-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download