e9240ae7c25990475e4d9af61547b530d73693d7fa86f9f8fa071ef7bd94eee0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
Size 20.3MB
Sample260826-d74ryayvey
SHA256 e9240ae7c25990475e4d9af61547b530d73693d7fa86f9f8fa071ef7bd94eee0
MD5 ec48f47422a7f283c0b400fc2bc0a8b5
SHA1 3280af4846c405e2df6c32f950b7963d64c00642
SHA512 e153b39a77d67f40c9dec8d22cc45ef3f8a1bb01b178a9e270a640bd7bb8d853da572ccfc4acc1ad3a0eb3bfca87efd5ec1844b05c477db16af7b1da2815e77a
SSDEEP 49152:U+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+E6:Xp7+
TLSH
T17B272A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
4852	svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
2636	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBBCBCABAACBBCBAABABBBAAABCACACBACABCAAACBCACCBAAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe"	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCABAAABCABBACACBBBBBACBAAABBACBABBABCACCBCACBCACBACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe"	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5984	sc.exe
5836	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4276	cmd.exe
848	cmd.exe
4896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
4852	svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
4852	svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
2636	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
2636	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
Token: SeDebugPrivilege	4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
Token: SeDebugPrivilege	4852	svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
Token: SeDebugPrivilege	2636	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5692 wrote to memory of 4896	5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe	92
PID 4896 wrote to memory of 3648	4896	cmd.exe	94
PID 4140 wrote to memory of 3152	4140	svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe	95
PID 5692 wrote to memory of 4276	5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe	98
PID 4276 wrote to memory of 5984	4276	cmd.exe	100
PID 5692 wrote to memory of 848	5692	2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe	101
PID 848 wrote to memory of 5836	848	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ec48f47422a7f283c0b400fc2bc0a8b5_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBAABBCBBBCBCBCACAAAAABABBBBCBCBBABACBBCCABAABACACBCCCBCCACBBBCBABACAACBACBCAAAAAABAACBABABBCAAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCBAABBCBBBCBCBCACAAAAABABBBBCBCBBABACBBCCABAABACACBCCCBCCACBBBCBABACAACBACBCAAAAAABAACBABABBCAAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe" start= auto displayName= "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe" start= auto displayName= "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBAABCBAACACAABCABACABCBCCCCACCCAACCCCBCCAABBBAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCABCCABCCCCBCCCBBCCAAABABCBCCACBCACAAAACBACCCAACAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\UserData\qap`g`v~dtlq
Size 10B
SHA256 8b74ce4ff3ffe7e9891cafd80972f43bcc7c21cec23a3638ba0a29c82d1caa00
MD5 b6c93bfa6b17a393883e89d3b4447f6c
SHA1 74be7716cd07347baffd0a2bf81e825ea080f4be
SHA512 f6bf6906cb06dae1adfcc91cdc9cc550a74eeb10ffa1c7a435fde15e879d21c4a8b949e04bd33c02d5d4bdcddba4eb4edd4897f2e209cf374e7ed0c1f3b33d88
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 20.9MB
SHA256 2ea5729e8bb7e6e8e3fdb58c792b76793863e378d32cb34e5fb38f3f3ecb62b1
MD5 fbca4ce5f9b558b27d506d692c670983
SHA1 da20823c4df95ef8fe19de64889af43c83824b8b
SHA512 cb3dd70677428d5efdfd55caeab210b98beaafe5f53efc175f73f5f06204d740255ede3a39d10b24b7f3c9517ac610978b91fe7a21aa014d42a44caee33c16ca
SSDEEP 49152:U+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+EW:Xp7BgZ2Hb9t+2xY
TLSH
T1BC271A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f17b8b25977c0f7e27d837178f8c4032c917f8af15ebfbc5a051bedf55b06e13
MD5 7c524348b028a72a099bd02fef2af914
SHA1 6b397777d4dcfd375e04a8c8fe6cf7d0fde28dbb
SHA512 e6a1995cac2ad45e12a3312742ddb76348673008f00fac913bb3436f76a390012808098cb0413198db8bd5d4c2a78758ca8dff98311e5c8a7f1ec97492638851
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 14e6118825d00be858497caaba000f113edff27e9c87e24baa9b740ed7f4e1e8
MD5 be170fca997b122f0ccfff2216edd6e5
SHA1 640c8d8f304026105ecb5e7426c659b7ab0c37e9
SHA512 99119e1b255d8fc8dd51908dcc1300727039889d98bffee22a3fa8c493e1c0db3490d10454cc0182067684ba47b431fec64e5d4d363061e2b01b2ccf4740bc86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 5378f9fa932e310af841084b1ce6d2e003a3373abe07239020cc84ac4992933a
MD5 23ad766c4a483e86023869498d4fc914
SHA1 a62e95d6f7d42792a1c2b5296ddf5373c84fc188
SHA512 8f6f248302bf454bd5136352054bfd35133e2a7d5f45b2ef53a530444dff584f019234aa51814242f3811d6d9ef0ec64ddda9d5cc742dda37dd6bb7f50035e1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\te\qap`g`v~dtlq
Size 10B
SHA256 75117f59388ee155faa8f0a0e00dd482201682a717d1bcc4976823dc47470f57
MD5 f5b89c8e0cbd5d2cb2afbd66988cc735
SHA1 760aaa6c97963c0a68dd93963487b60ca20b8de6
SHA512 b1c5f4363eb8c7f6e73ab46c33011a1923c45d28dee77056a4bdee8c9dff49d5c21dc4c1542bd7f27cbf14f7db87080dc863d9825dbf1d5774d4766e9f8223a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 4079f667a609c33f02c01fe8c739748014dc7e7709dc2f4aaa8dbbd3af7e620b
MD5 9f857872cdfd74ffb4ed84b2f15aa3ea
SHA1 837abbd1e9f39d2bf6cb76288879d8fe14f19adc
SHA512 7bccc4ddc4a35a3f886798349fd6deeeba7bf7c05ed35bb4cb8cff4b5485db87e6574634df51803a357fef2d76b627b612bc0daa9a424547b8ddc5d8ca9e3375
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4cdec948813c91004811d529061ee19fb7ebb2c7be72b0d08b13bbe95092802
MD5 e64b322da43e0807425be31f183ffd33
SHA1 f75e680005366f964ae18bc1e7bead1dd5ddda08
SHA512 a3cb4f6a603021f01acfb35cb6c7341334a2997d52a73fc7732bc2fe7019e63b80385eedc8e8a6f30e8dd41d5dcc0dfccc819cd81ddc6ae8b04ca18ab22a31df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4241655c4e84bdc5541db1e044856b2a8abb7879d80e7086ca61b18afb67f78
MD5 e5babf1218eaf769eadf71fb4c2af97e
SHA1 7e19f2749b803cd089a116ab846df8eb6194bc01
SHA512 91d400a6b52ca79d6960e060c63c674258ffd149d90832aa2c3fa08d8656e78316954a440714cb1bf139c0bfaa21fc75971e0b536f47bc0a7511e055261cc050
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f9fc19a5ce3544b2cbbb364143d90f6a9b9979cffc7167ebf23d05fb7403ec02
MD5 c2e879ef04767ccdf90a9a2d02ee6ea0
SHA1 155dcccd120c9d9a12dd486c1c496b31a413356a
SHA512 d32bd1637b5a9957c97098798b7e5cfe34c873def9b82818d740cf1b27ea5c2f208d45feff649d9102a4d4abd190a403aab6595c1704d5fa08e279dbdd0adeb7
MD5 SHA1 SHA512

Submit Download

svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBAACBACBABBCCCCAACAABBCAABCAAACCCBBCBABCAACABBBBBA.exe
Size 20.3MB
SHA256 e9240ae7c25990475e4d9af61547b530d73693d7fa86f9f8fa071ef7bd94eee0
MD5 ec48f47422a7f283c0b400fc2bc0a8b5
SHA1 3280af4846c405e2df6c32f950b7963d64c00642
SHA512 e153b39a77d67f40c9dec8d22cc45ef3f8a1bb01b178a9e270a640bd7bb8d853da572ccfc4acc1ad3a0eb3bfca87efd5ec1844b05c477db16af7b1da2815e77a
SSDEEP 49152:U+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+E6:Xp7+
TLSH
T17B272A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4DCB5B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f507b4803714ade7c9fdd57e2f57d25b004102dd5261f6a9f27dcf54112b5745
MD5 12237c9c028826cc9658f771c19dbf07
SHA1 97ef3c21a2d71f130b0a87ee4e28a0e051634ab1
SHA512 b856bffb2190e8f08021417672129e927b7a7e57b33f6cec2b144887f072e5cf25facb2c8c4f3c05eeecaa8125e4f05c957937ef47dfb18e6fb609b3562ed3f4
TLSH
T1AD112731E4F5C8A3F532289F412EDE921CA13B9EAC5C6E68130C4218A785837CE55AD2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d2588678eab3dc6ecdbe73439d3addd69b15319f5803cdcf989930dc44319190
MD5 fa2227a367b8dc40373a40f6c91b1a25
SHA1 105fb01b3f074565f28e53e0bcd52bff3d623792
SHA512 a041dc9f3098fccbb48e80c440a388f67f5787bb36e68c711b42ba4ff04b7220b80d69a67ea3cc26bfe65f295eea0db5337925286d59e5c2846334c334259f5b
TLSH
T152210771E4F4C8A3F432288F512EDE921CA53B9EEC5C6E68130C4118A785C37CE45AD2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2636-1569-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4140-31-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/4852-78-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/5692-0-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5692-7-0x0000000000970000-0x0000000000991000-memory.dmp

Download