fdeedb4ad976d074820eff0be023cf5d9ac3eda011d33c9cb3f3c9c0b8d725b0

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
Size 3.3MB
Sample260831-pex98s1epd
SHA256 fdeedb4ad976d074820eff0be023cf5d9ac3eda011d33c9cb3f3c9c0b8d725b0
MD5 42b43b8a9c129cc00c1eb2397b90dfde
SHA1 a00d31996ab4c54c007bc212cbdd63bfb70b250a
SHA512 53cc61ea49f6c9df820fe1dbdb779dd232cc8899ef4cd324e8662668cc785837f3d67a5208fc3e808b43f767c05808ca40e9cf3b61e35010fc1643672c338465
SSDEEP 49152:U+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXdZ+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+A:lmNmA
TLSH
T1ECF56C09F99244F1D977417089DBD2BACA71BE158621CEAFF248971B6F33B90AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5cb-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x0008000000018296-396.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
1756	svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
6828	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCBCACCBCAABBCABBCABCACCABCBAAACCBBBAAAABCAACCCCCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe"	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCABCBBCCBBABCCBACABABCBACACCAAABCCBAACABCBBBBBABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe"	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3588	sc.exe
6504	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1960	cmd.exe
5572	cmd.exe
6260	cmd.exe
2448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6872	schtasks.exe
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
1756	svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
1756	svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
6828	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
6828	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
Token: SeDebugPrivilege	1756	svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
Token: SeDebugPrivilege	6828	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 1960	5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe	93
PID 1960 wrote to memory of 6872	1960	cmd.exe	95
PID 3400 wrote to memory of 860	3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe	96
PID 5280 wrote to memory of 5572	5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe	99
PID 5572 wrote to memory of 3588	5572	cmd.exe	101
PID 5280 wrote to memory of 6260	5280	2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe	102
PID 6260 wrote to memory of 6504	6260	cmd.exe	104
PID 3400 wrote to memory of 2448	3400	svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe	107
PID 2448 wrote to memory of 1740	2448	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_42b43b8a9c129cc00c1eb2397b90dfde_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCAABAABABACABBBCCCCBBBCBCBCBBBCCCBBAACCABBCBAABBCCCCBCBBCACBCBCCBCBACCCCCBCACABBBACBACACABCBBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCBCAABAABABACABBBCCCCBBBCBCBCBBBCCCBBAACCABBCBAABBCCCCBCBBCACBCBCCBCBACCCCCBCACABBBACBACACABCBBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe" start= auto displayName= "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe" start= auto displayName= "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCBBCABACAAABACCCBCACABCBCCBAACCCBBABAABBAAACACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBCCBCBAACCCACAAABCBABCBAABAABBBBCBCBAAABACBCBBCCAACBAABCBCCBACBCBACAABBACBBACCBABABBBBACBCCBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCBCCBCBAACCCACAAABCBABCBAABAABBBBCBCBAAABACBCBBCCAACBAABCBCCBACBCBACAABBACBBACCBABABBBBACBCCBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1740

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABBCCCCBACABACAACAABABABCAACCBCAAABCAACBABBBBBAABBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 31ec9ca3f378ab5594fe41a91b6603e46fad44cee373aeb83232e899c9fb24d5
MD5 de5c2f8453ca905e58b458c2c0df98d8
SHA1 ca7ed05f9c627544e620fbbb0d442403f237c578
SHA512 7c57975103f0f5879334a71293d24ec72d78eddbfaf09a4d837880eaa55844f847fa96f093b6283aa3d9df32f5a1d2a8536ce771134337441c08a9744151ca90
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.9MB
SHA256 7f0421470f5b757f32d00b29f0e3b568ffa2408a7d92107c0ffda25d9906cb8e
MD5 522c402739ffa00526ea231dc0348342
SHA1 dcbc766ec57c63fc58741275952f3876cd8049f4
SHA512 bb2923e25daede0638ac39511564eb45bf03f1ac2c52fe4d3d7bb4f6731b1b405b4144872efb35255f4d312ab536469d01279520074b907a3dd12c5a5e5d8694
SSDEEP 49152:U+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXdZ+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+B:lmNm/gZ2Hb9t+2xV
TLSH
T12A167C05F99244F2D9774170899BD27ACA71BE254621CEAFF3889A1B3F33B916C39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 725b40f2a82cc672d675ebcb07e4d1e07027033f927322781fe6877dfa7a6284
MD5 c305ee87647f6cfd6d6ef95d97ebc886
SHA1 bcb7995206cdeee8ac338ffdcf6733fa616e0ee0
SHA512 84869310407935c6143b47b6496bd696cbae021181bf11ec480b1b52278989ed33855fd203e119ea362850c94ac725ee20a66cb5190f757c57e6417c6e48703b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\qap`g`v~dtlq
Size 10B
SHA256 e8ea129f9053ce1c1b5e25a7a07387ddefab6f0f5e49ab1cc865c2482019b4f7
MD5 4e1723a49bb97bb97c324116ff488038
SHA1 b22155217095c46663b551ff19aa9c10f8629079
SHA512 5bac1d473f7775ebe36ade7a947fc5cd6ef35457eab5ec1b9eb900c06cdc8a90b155d15f3fa6617e059269890bbd77b02913690488c1e601ab8c023d03c5eeae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CookieReadinessList\qap`g`v~dtlq
Size 10B
SHA256 0cdcfce8545888e53789869a9c78d319f6fd80f77d4e473772da00f1a7ffad42
MD5 1ab989483f76261c316fc210d120ae87
SHA1 614fc860a83653f0e7a42bce856a2d332877768b
SHA512 b85fc5c907bd5bb9acaaba63bed751e958ec3a894d45aa197f93ab5a79ae4b0fc0dc5f77d894dab0bf7794a35bb2ba0115a91214d614a2643b620007905d4031
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\TempState\qap`g`v~dtlq
Size 10B
SHA256 7a78cc7c7f501ece5ba2a94d6d2223aa84c3b82fad371cdb57d601037165e406
MD5 8403d9d2a7f43eb843830ba9c9689b53
SHA1 4c895e0e250d375f3c0f8bc8446ea35e108c84e7
SHA512 b55b3531b76971d7086eaf79a5433c1b4dd392d8ab20d7e9becdbd2df8787705440ee8767b29b0e0e300b0f8a39ee58aa77a5314eb6f8dedd570177f4bc73dd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2245c05ba11978926f9b4225792ccc1b46140a4c1911d7fea06e896ddf690d6
MD5 b4ac90f24de7ef9f3e821f0176feaaae
SHA1 5573286a2698c3493d5ab76fbbee226c8a68f0d8
SHA512 0de2d56bac209db17a9df8df636202df4431f5d4d39346c5c9cc14dddb319628eee227f5fb2c234b6e5e6213d5ecc88d11d40407ccbfb09afacfeda0f830319c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1d13986a06fe99a6df512d51a0b685f021e9b15ef57292ea61389af8776c2db
MD5 17d1da2bc7cece4611a7b5ce07f2fbc8
SHA1 cbf24e3ffcc1b08a805e26f815d687e9008f40b9
SHA512 6c8aef4b7f4e2d9eed7cdd1630a753b0beb34801aac048198338675ea07a7202038f55dc39b6df71859dee7025e130b2a08ee4cde71791a10344d422f617845e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 519c4a3fc96ae0b63237cc1f85198953b26a4b0f53031d6e14d4bcd79b05a330
MD5 b4f150689bffaf471690229dc1e0c31c
SHA1 d8f45f75ff2a77ce843132269634e1b4a8cee6a5
SHA512 612ff642eabbd4ea7b0b0b304dddf841a7028c8196d2a72428bcc22dd0acd06403d449dfa45364439e24236b3738eb1cf3a0176b586418086c26effeaa020ba3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6fa950271781a08913f33a60b2dcb88f1b6b37a8f0e1f7ffb086c2d00f4b32b
MD5 7a4e5bc58374d645edd54ef0b79633c0
SHA1 7b0050b84824db75d36bb8a86d90dcd0b1cbd0ec
SHA512 4b75e262ac2084ce4ab5495ed9e05147f07cbe64bd978e4ddea96537dc0d2eaef91f085cbbf578e89b541c6c669414b6ef28bb3f77af2a75778b8fa3850dbdae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f384a2ee2081112723923079eaf2578c259bb8fd32eae615456d32655a9b863
MD5 8bc951b6ba587729d3a60c7a8845a121
SHA1 f0fa90b25688fd863425570cc1c6c6604186728b
SHA512 f258962009696b760428c03b1a54592b13c9c1dc14b0ff2b117596ca791ed2b3849c7a21414cd9421f19de0949390560e10b6fcab37f66b7ba17f1e01bc4b695
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f575c695e95b79139154e04ccfc8a31b28002d3d374bdf1bfadc74a394ade3aa
MD5 e6a3983fe19d2176e0c2ac41e68fe779
SHA1 732cd877b6fcfe8c0257db34957756911e8ae3b6
SHA512 7efaf9952b44b87c5f1f3b5114a7105d57ba1014fa86e7264165155c1914ce0ca6249175d17a84579bd318575dcd7afdb54fa370bebf38bc026d7f2128919ac2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e97dd078aa30e8f3709f335c25a4fa243186495cbe7f2bf551d5091308ef547
MD5 df6f717f145feec1431f137efe43de7b
SHA1 0fcb57df9b58c834f6242f967c2fe194c80a476f
SHA512 99a15cd4dd0165770ff2f3a103f7cd8fc4cd18c359b90d7865fad256c4deb4e0a8529c595ce66ab3cc23298e6f3fda8a09090265a3775f70d426c97fdb30ea99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\History\qap`g`v~dtlq
Size 10B
SHA256 324c94d9145ceecf482fe4ee2f0b0586b56b91522e2f6a3a6e872b8fd23a9c1d
MD5 bc407befbb79e744e6581579888e6c21
SHA1 088be3ef19a60c7f8fd4b3791d3cef35d334a700
SHA512 fde381d09e9ff20239bbdada5a6c731a54d9385540bea9b7f1e68b1f24de09448c301565270d7ee30df0b76910cf89dd16e10b8cd0818da8d93c0dca6a7f55bf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\qap`g`v~dtlq
Size 10B
SHA256 b46d38c8ad208c8071cfa7a15ec9899f7fb51c67c10a4875f049b2b0170765e2
MD5 603af8e17d04cd8539568b6debf85bda
SHA1 ad7ff5622a7ea0f8c079b2d67e23e22e4e9e6006
SHA512 c8af5efcc4f8867834dbeb58e58908f8acc44e5082660770858ec480e337d5bf6468f9ffb7d56d1e058c1e502eee4469b6219c281fdb126ba466aa9847988a7d
MD5 SHA1 SHA512

Submit Download

svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBBBACBAABBCACBCBCABBCACCCCABACBCCABAABABBABBACACACB.exe
Size 3.3MB
SHA256 fdeedb4ad976d074820eff0be023cf5d9ac3eda011d33c9cb3f3c9c0b8d725b0
MD5 42b43b8a9c129cc00c1eb2397b90dfde
SHA1 a00d31996ab4c54c007bc212cbdd63bfb70b250a
SHA512 53cc61ea49f6c9df820fe1dbdb779dd232cc8899ef4cd324e8662668cc785837f3d67a5208fc3e808b43f767c05808ca40e9cf3b61e35010fc1643672c338465
SSDEEP 49152:U+ES+Ee+ES+EXH+ES+Ee+ES+Ee+ES+EXdZ+Ee+ES+Ee+ES+EXH+ES+Ee+ES+Ee+A:lmNmA
TLSH
T1ECF56C09F99244F1D977417089DBD2BACA71BE158621CEAFF248971B6F33B90AC38711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 663747a978d4fc16f82a65bfabba666a9218e6b754bbccc09e9908fbafeac62c
MD5 f3449a9920b2b76c95272e191631ec70
SHA1 c27a040ab51a81c0defe02efe24fde4d31709031
SHA512 6e13474fe5c0af93dce4c135fb02d01232c9087f229f84a4129f2735f3b3a90b930ac66190b75712e616e5a3a9f14d3e579aa1aa1f7a3cdfa1d40e18c837ddee
TLSH
T1E2218061E0F5D8D3E83368CB93259AD708A836DFBC6C6A45671D5218BBC9C32CF154E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2f40f6c31d366381158e6c0dd9219109d2abc7566fed90a06adbcf83524648a4
MD5 d850b2969ff5cff25bc193afb167c528
SHA1 c775ce1e458f3e1db6ce562f68330e1c1314ba81
SHA512 b6bc8fab59d204e2996ee98e11bd05122768ff3607cca02fb087b77ef7dea9a7c6f62df374bbed587939484f05b2d53c306ac2fda577bd6fc0bfa9878035a76a
TLSH
T17D118F61E0F5D493E93368CB93229AD718E836DFBC6C6A59235A4119BBC5C32CF150E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 333351e002953a98860c1fb10251a02193d9b4ba454cb4aa65a4ba6e427f4991
MD5 2eeb0bbd1f346e98a352bff8eebd9eca
SHA1 a5199cfa2ae6f8b66e8225289e4b8ea8c190e93e
SHA512 a6b11bf716c03f4b3ca1fb8b0aa5ad8f6cdce2588896f06eaf5f7e8c5b3ff87b1b43ada57edfd9198d9df8a6f34c57216dad38bba82ea0c36328abd470c61caa
TLSH
T12C21A161D0F5D493E83368CB93229AD708E836DFBC6C6A5923194218FBC9C32CF150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-72-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/3400-33-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/5280-6-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/6828-402-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download