7dfa36d24a2f3da244c65a132b64786a3fcd73c12485bc8454f1fb1b61a1382f

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
Size 4.6MB
Sample260830-1sd93asyev
SHA256 7dfa36d24a2f3da244c65a132b64786a3fcd73c12485bc8454f1fb1b61a1382f
MD5 0d2441c5abe2f277f138501ae80f7a64
SHA1 92f25c849ef29480849b7ef1346317f01ac790be
SHA512 6d0e8106b265799dd5a933e44ba0db0abdc2cd920623c5e33910efc3ea36a65695c87164160152109759c2cdc37b81521bb074579d929f0663b5aef1fbaf7cce
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECic:i+W
TLSH
T173263B09F6DA04A5E977617049E7C27ACAB1B9518732CADFE244C72E1E33BE0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
2800	svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
4512	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAABCABBBAACABAACBBBCCACBBABAABAAABCBBACBBCCBCCCBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe"	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACAABCBCBBACACBBCBCCCBACCABAACABCBACBACBCABACACACBCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe"	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
544	sc.exe
1100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2008	cmd.exe
708	cmd.exe
4416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
2800	svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
2800	svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
4512	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
4512	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
Token: SeDebugPrivilege	2800	svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
Token: SeDebugPrivilege	4512	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 708	1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe	92
PID 708 wrote to memory of 4024	708	cmd.exe	94
PID 1860 wrote to memory of 5548	1860	svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe	95
PID 1136 wrote to memory of 4416	1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe	98
PID 4416 wrote to memory of 544	4416	cmd.exe	100
PID 1136 wrote to memory of 2008	1136	2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe	101
PID 2008 wrote to memory of 1100	2008	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_0d2441c5abe2f277f138501ae80f7a64_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCCCAABCCBBCBCCBBBCCACACACBCABCABACACBCCACABABCABBBCBBBABBCBAACCCCCACBCABACCBAACBCABAACAACBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAABCCCCCAABCCBBCBCCBBBCCACACACBCABCABACACBCCACABABCABBBCBBBABBCBAACCCCCACBCABACCBAACBCABAACAACBAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe" start= auto displayName= "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe" start= auto displayName= "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBABCCAACACACAABACAABCAAAACAABAABABBABCCAACCBABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCBCAAAAAABACACCABABACCCBABABCBCBACBABCCBBCAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f1348ce56f806f0aa8e02a28fffefc377f934d422374cea8daf3ad141739bb1a
MD5 5afaf65177f464786a8f70767eaaf875
SHA1 2ca7aa5eeccb141a20830bd9372b581507350c4d
SHA512 291d7281a1552ccbe6c59ed1cbe37fb8023f7a8d8a1eb3e421d58f751d9159af86756c71b31d9b26aa6ce9ce68c0b351299288b1ff055d5c4a3c789526cd0343
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.2MB
SHA256 79ed375de7d1a93e2f67ea4c4cf63b1a70bb002b2c74eb4589f2cca3bdd197ba
MD5 9410de120a3c1c435141315d4ee2dab2
SHA1 65778e020d76ea2fa5a934a57b3e5af72612e299
SHA512 e18636957fda48bd1d2b0d45de2b826c145dedfe12806bd7d20d41e3863bb7d206163155af5ed29f86fb751e611f39c886fe10c162fac4fa4635fe970b8b0f75
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECiG:i+ZgZ2Hb9t+2xG
TLSH
T1E6465C09F6DA04B5E9B7617049A7C27ACAB1B9514731CADFE284C72E1E33BE1AC34711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 7bad6cedd806c853c13def5c52e69f973de5c9e5beed789757e1f69f289bedcb
MD5 07bea49d1d178b2ccdee61105bce3a13
SHA1 0292b8bee3e86965eeebc3e8f4502d7249a092a0
SHA512 7ef9426894b27fd317ac08f1f1c43199b834b1332d429ea150bf75654edacfdb63de6126ede3456640f98c99488085a1e32b1342e69003833aef20b7053e4023
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 75d3d4dc9302b241bfc6e68f9af0c450e6c781b3fcdfef8316ce3553f7f0ddcb
MD5 ad110aad42436cf861ad260d4f3ebfcd
SHA1 61c1ba4fe2fd9f7546f74c1ee325214088e96924
SHA512 6adfab0bb74b519d65af3206f3a0bcbb52ea67154a39e87314350ba73a23bc7a50025d94cdff3f35224a288da5c81084936af5366bbdb61821b1b4e65f9d5d4d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 d4fec7e1ed37d8d0fd49bf3e21b8e6263d3f7014119359e9adcc4e98a98958d9
MD5 49abec079045e6bb41539d3d69906078
SHA1 2e85077c07feacc73770321b9d7c885aec1a3641
SHA512 c9855305ad81b96eec8f66f2005f11ded725fd95833446625db137c2cfe371da02a1e72c14b8bea3635cf2bac433f5441788013a47a7a8433ed857bef01ce3d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\qap`g`v~dtlq
Size 10B
SHA256 0f1e49611fbad4925fad6c284675b9be5bf35b842bbaed501caabc3c2c627e09
MD5 731760607ef93a4e9df941bb466d9cfc
SHA1 65163fe3983b991ffa4540b1eff06ee413f76b56
SHA512 ae472cd5fc79f85079c9a3815aa8dc6a54322f95c10b7fbbb9b0a5e168cf9f101c7b405aa201f40f6518db0758cd86a2c0d0ea82e283657a44496a8f54406fad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 db33779b63c9edfda13f4facf23ce8f855db5e410413e6d26cabab27ae0bd1df
MD5 6aa5b28a0123e23cd7f593c4d02c78e4
SHA1 c331609e93bfbafbbcb87e3e01b5e930a3848114
SHA512 5748b6b96a39fecb520c5074e06530b58849b621daf8b4a84737dca5d7d3c4c98c2cfcd1d0b3f966f1b6294ea567c93ee0331c89e323be4ff20a00446f3b0dec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 362f8b4522664adb5ab0af23538ebf47f378084ae425502240b2cb4080439690
MD5 fe2462264ce6cca1df55d6ffe380b480
SHA1 b314a53978276dc4f48dae67f6a3f1fd6873f2ff
SHA512 caa0ec15907f547f5f06df6819b7eaf6055d54b04ff64c3005f4ae7172dd25872b72e383939d3c2d376925aee883f91939050aaf0b4f8b1339f8bda365bd9520
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 429f77912bd655d5d7fdf8b53f0057b24be9f499e71365e351ef10550b9042d6
MD5 9c235c5c84583ffc1c0547f29901b0dd
SHA1 c8273b13471efcbbbad8cc31b22c4dc363957555
SHA512 ef9d62f55b52f75496b9dc2eadad83dd1c3554dfacfc590f535eaba44b6959f69fcefb1789f72154445a188394eac428152f0caf59dd669de66a6a8d39b84925
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aedad19619a56392fb3ecb1a920bc1f3b4b1cf4abcdde9fa52024e51adb065b1
MD5 61d32b8db92ef61d490146fec870e781
SHA1 08871ffe8226dd0ff029c16e4e8f772e76f3d8b0
SHA512 f9f3ebaccc74d8226197b53589cf2a40114acc034e536bad7917132d6006951fe74012d9cc4e97a67b267bce984489ca7b38d8005b86e0cc3b04e983ebb2ec74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 363cbb43d57b0bdf80e8c9ad36ca88e78bfa988120d21d3de18d1e2f0320db3a
MD5 36cd53b990baefd608fb328cfdd65730
SHA1 f9f599b0b526b7767db2fb5f3afa775f7085965c
SHA512 27a7904e08a35abcd8c38e4fb8734f536d73005c4a54cded6dff187c00dc4a945ee54b110adf1064ec971a30f74a7f1fd43ec4d508732c23a50c09e2b1cd4fdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fab638b7aae68d32a094aecdf6dbc20a1571baadde5c12d5574fc284a42d23c
MD5 54743113678a3f8fddb3147ea6628233
SHA1 2b7d87d64127f1591ab0a67810b80080d010138c
SHA512 23018d8f95ab7b7592010044bae31481126ac3c4acb4ef916bfe9c9810678d4aefc2428bcfef49fd968b97b755ca48c81f1de51ce35a2facd34ed86779064b6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48284fbcb90fe1fee844cd09e7563e693ca6b6b55d15890c387935392a0a55a6
MD5 75a002080eadd91828aa2c98ab4bc776
SHA1 55a20e86906223a5d31686f215fc41a484d6f096
SHA512 8bdb8e19df0da5b072fbb1068e72b317c08c51fdfc6ab0027e81d423afeb8f4a5a16abd8e0a0bacad94f208c319406b9f5c664ed39f5c42c6984e770591fac56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\Spelling\qap`g`v~dtlq
Size 10B
SHA256 825f05c29fc4fdeaef00c7dde3cc65c91f977be45ff53a48914cbc8e59866a30
MD5 b5eafb05efe45da38a74a10b27e208eb
SHA1 f870f856b39d42289eba19f411de3ffe638667d5
SHA512 8a408c941dc376ab57bd712eb0c0293d837d9bc9fa976ded8803345d03c16505c8c9fcc45c216197a2df4794e463e601558ed98c8c8ec264080446b40154246e
MD5 SHA1 SHA512

Submit Download

svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABBBBAAABAACABCCCAABCBCAAAACAABCAABBBBABAAAACCCBAABAB.exe
Size 4.6MB
SHA256 7dfa36d24a2f3da244c65a132b64786a3fcd73c12485bc8454f1fb1b61a1382f
MD5 0d2441c5abe2f277f138501ae80f7a64
SHA1 92f25c849ef29480849b7ef1346317f01ac790be
SHA512 6d0e8106b265799dd5a933e44ba0db0abdc2cd920623c5e33910efc3ea36a65695c87164160152109759c2cdc37b81521bb074579d929f0663b5aef1fbaf7cce
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECic:i+W
TLSH
T173263B09F6DA04A5E977617049E7C27ACAB1B9518732CADFE244C72E1E33BE0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cd9258c352b93693f59ccaadf26330df009947ebd31206220cf5dde37ee25259
MD5 5713f30777da327ac2f29b3480be9927
SHA1 219e137237b869a105aa42f5c0ad417d539366cf
SHA512 46e61153064cf77d232725b41d1629a147164129c6952489ce88a75178112e65b9c1b95fd2473a4840a7101e857c1672ce3ef6c606f326b98bec4dfb99f403e2
TLSH
T13211273060EACCB7E53238CB9131DDE64CE03197689CAA10230A4018B7A9831CF5D0F6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1beeb75172ae68d988cfb40621568db423053c52a427d5fc36c3f5382f963b14
MD5 f59b5c0009ab4f8db0ee37faab7123bc
SHA1 b243391ad0a441c7f20dd244984227615522e62f
SHA512 cc2ba8b6be89b7af7b4d79c2dc4a1a04c4249425a3d5baad200ec9290065eedc5cb5be3e2eec6a43f4d9763229b2a715d482984395f94a41b2d0cb326c3d1d59
TLSH
T16821087460EACCF7E63338CB9121DDE68CE43597689CAA10230A4018B7A9822CF5D4F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-0-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/1136-7-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/1860-31-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2800-78-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/4512-1824-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download