eb144161ab238f9c4cdb975cec799a2ba152971aef599af20250dbc50ba6ceed

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
Size 1.0MB
Sample260831-pgf4qstybt
SHA256 eb144161ab238f9c4cdb975cec799a2ba152971aef599af20250dbc50ba6ceed
MD5 41e3369a8d5260351aa085abce3b9ab2
SHA1 084fe7063f9c19342f7164d6ba300196faba3dc4
SHA512 f63a1c0e4197126b46f7fa1ea763c1a3e16b1d6741350f3f3d0d78c41b05bab8bfb8df590ebad676e22031fd265ea528a594b9ef49f5d0adf4182b456063365f
SSDEEP 24576:m9+EM0v9+EM0q9+EM0qMsTiw2ZafDd70iTWC7:U+E7+ES+EEiw26Dd79WC7
TLSH
T1EF356B05B6DA4435F4B3617149BBC3799675B8618B31CACFE388863E1E73BE0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
4916	svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
1488	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBCBBBCABCCAABBCCBCBCBCACCABBABCBABBCAACCCBBCBCCBABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe"	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBAABBBAACBAACAACCABCCACCCBBCBBCBACACCBAACACCAACAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe"	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5316	sc.exe
2308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2640	cmd.exe
592	cmd.exe
4724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
4916	svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
4916	svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
1488	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
1488	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
Token: SeDebugPrivilege	2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
Token: SeDebugPrivilege	4916	svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
Token: SeDebugPrivilege	1488	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 4724	5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe	92
PID 4724 wrote to memory of 4112	4724	cmd.exe	94
PID 2980 wrote to memory of 4708	2980	svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe	95
PID 5976 wrote to memory of 2640	5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe	98
PID 2640 wrote to memory of 5316	2640	cmd.exe	100
PID 5976 wrote to memory of 592	5976	2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe	101
PID 592 wrote to memory of 2308	592	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_41e3369a8d5260351aa085abce3b9ab2_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAABACBBCABCACBBAABAABACBABBABACCACCABAACBCBBCBAAABBCAABACBCABAAAABAAAABBACCBCABACAABCABAAABBABAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAABACBBCABCACBBAABAABACBABBABACCACCABAACBCBBCBAAABBCAABACBCABAAAABAAAABBACCBCABACAABCABAAABBABAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe" start= auto displayName= "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe" start= auto displayName= "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:592
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCCACBAABCCBCCCACCCACAAACCCCCAABABBBBBAABACBAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCBABACACCCBACBBBBBCACAABACBCBAAACBABBCABBCBCACCABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 da41c2f93fa173d3c3e14016652ccd67b182ed19872efdeeb1d8eb8a426d1e7c
MD5 6c4055dcfd5d155803f3b76c1e7fb767
SHA1 82cf53a9922691f1db4d404290c658a06375eeb9
SHA512 6afb49fedac41a0fbc14b7b42d3e03aa7c0f495234c090fb263a49845ed20531f412ddc2c2ae6e593351fb963ec365b914cd68dd574d6edd624b250c8f590a77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ExporterStorage\qap`g`v~dtlq
Size 10B
SHA256 fec5bce1cb4605ce0325750ad469b2faf499bb17bea6e429d9b0648606b848ea
MD5 27ee3784c144bc803b376a348b1da8e1
SHA1 e4e016fac2a7e05bd9c06272e4913e4595a2e37e
SHA512 0b510d92e8565207923d1a407d44ee82cdbb40d622607c0643dc4539a923b86482721bf679512183ef45161fa5d6a57e8f98cfbe44d55dc9338e22b7a228a935
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.6MB
SHA256 1ab728e734453079428f4ffd20c8b370edbaf3cff5c1fd725faa9f904e8c1443
MD5 fa4766414bc9549b2185c7d754988891
SHA1 cb18fe86b4fb1eb71052475e2bab8d891074297a
SHA512 1ae44e7e082e23468ad174541299dba8f53841feaad68b30a3b469a6157b2cae7c5d1a9453ff118fcabdb3a5794b95c929422e43737f32f2cc012be75a5e724a
SSDEEP 49152:U+E7+ES+EEiw26Dd79WCegZ2HbbZt+jqpQ0CMm:Ip7kgZ2Hb9t+2xm
TLSH
T185859E21B6D54031F5F311728DBBC3359979B9204B31C9DFE3C48A2E2E72AD1AA36716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\es_419\qap`g`v~dtlq
Size 10B
SHA256 30d3a81045ce7b8b7486c3debb78c19f63dceea86fc82220ff33b3911d4aa504
MD5 11418c4cfb903eecee758e11a8909d94
SHA1 cc7c20102790dba4c8214e5d4712193e0aa7f38a
SHA512 88def47a3d4406ab65b104b54d8cf8639248c553e6b5b54e899a062e1430815be4ff3191c2f285b5473fce1dec5650e1d77fb9b5459e67aaaa8d01e3bd130f99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\qap`g`v~dtlq
Size 10B
SHA256 dd4da87eae008ec2c43d59e2308b59afb2c701f67a681960b1f99a97992a4885
MD5 8bc8908b38343c360dc83700ef3a46b9
SHA1 79875c50eb751f2df66ca34f90421ceb4b58eb02
SHA512 f3494ae9ca017aaf8f6d71edfa019c88d682ee20c38f94d587675bd7ae06247f5f250d6eb31e41b80e3646f436a859679b0f7a4453ccfeb56b15ee1da6b20d62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96eaaea3a6b7ccbf8b44c50582b69875b9d3c73ae219d5daf0f0d6e87f0df57a
MD5 bb5357a9c397d02807c5fb3605ed96bd
SHA1 0863a4289a9458a4131276dbd65ac98b692597b1
SHA512 f0ca4410ed4f38e8b455db87e933bc18c254d37caa1db722346ef475cfac86ec366e11e64711cbbb253825071bfc12dd185b578a6ddc9b664e80b54e6ceb3205
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15d2de83f6e53521c185e26b8efe1715acb9612a160c637533ef37415653db8e
MD5 a8c06e6a018209392348c19e37b2b33a
SHA1 de8a6d7641aff2e9bc18374baac83dd26a722c01
SHA512 d9fb5b81867a55425f39fe70e06db8258319b0dacf8ef89e7e1f42a4b46f3204ef874ef14215ead17073428270c5076532d05f933c51f2564085654ed195ab57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f61a792aca60f1e6c3cb7168fa888d24eba50410ac87d72b64d2b8f8b5235429
MD5 f5ce42d1548c29069c324e8b94618528
SHA1 070df797a037ca7f51b9bc2874315a17954d87e8
SHA512 ac780936d0bbb492486ffbf461614d67d7f22d4d8a422fb4e756d0edb68ccfac7e71cec150e5639ec5b407f40dbd0877cdd95595ccf2f3f3d4a8d21862fba53f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ab2a92b7b87da5d8ec575e9c8ccd424b75e3f9ae2e4ebd4c82e80e2abe8bc52
MD5 1bcc6297f98e1f56cf9960d86bc247b4
SHA1 ea69e400f31fa5ddb8ccc93928f8e8891c2f9b5f
SHA512 ba08f7a67954ae7826662d9517ce0b1ff8bc2c57bc3f51cb47484a67cd8d916c7d413dde4ac01d1dd037b1918c5b3f68a288d831a8ee157d8c92c2c9943091b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2121d60bb40e0935cdf60c758ae0424fc0caac823653c47d0cec46cf2431f53f
MD5 776984037d080b56c4e1684b2d89dfbe
SHA1 bb9690d9bf1b08519f4bb7a2da04bb5bcda39cda
SHA512 7041170b6ebdf13907403b1867cce45058cacf3a36fdd17d48134a3d2871fbd8f0c303ecd0764738a3907a23d14f4fa2b98b3b490090706a1bc60b70870ca3e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df85baf3257c89f746c5a652680a5c4d763bdd86b302b8f30c26ab8c1b4bc24d
MD5 416270bd8d92320656cdc6989d384588
SHA1 1de103233fd4a441501f38785c48aff7cef7331c
SHA512 b1abf5f41e29659bc931db2eb7138e3a27d01c0fbed7ca63a6e9f88005bc21e40efa595e9491f761540142fabc69c13f365b6ce67fb8611d5cbdcf994f85b236
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCACBBCABAABBCBABCBCBBABACAACCBCCCABBAAACBBBABCAABAB.exe
Size 1.0MB
SHA256 eb144161ab238f9c4cdb975cec799a2ba152971aef599af20250dbc50ba6ceed
MD5 41e3369a8d5260351aa085abce3b9ab2
SHA1 084fe7063f9c19342f7164d6ba300196faba3dc4
SHA512 f63a1c0e4197126b46f7fa1ea763c1a3e16b1d6741350f3f3d0d78c41b05bab8bfb8df590ebad676e22031fd265ea528a594b9ef49f5d0adf4182b456063365f
SSDEEP 24576:m9+EM0v9+EM0q9+EM0qMsTiw2ZafDd70iTWC7:U+E7+ES+EEiw26Dd79WC7
TLSH
T1EF356B05B6DA4435F4B3617149BBC3799675B8618B31CACFE388863E1E73BE0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7569d6b8e97a87189133f114d76cd3a4ec16e6d0115a8d3d4d180583736da92b
MD5 49093c594477e847775c4ecac1d00e1d
SHA1 f179d19fb0e5fa5dce2fbb4cd6290a3049285928
SHA512 b2621e2d9a2add13f0ae6934d66486b8f2f2ea83f6bb6afb5ebd930608bbc606ba1f7b942765f9f7eac62a22d929dc4d462998682f448779f6452068166cb6ae
TLSH
T1CD112362E0F5CCD3F43268CFA625DAD70CA832EA6CAC6A0923094118BBC9C314F150F3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a3cdb023bf6afbb8631ac8dbdc42954bdf773dc2f109847d23a23763e6d5f8f4
MD5 fbf9c1121c49e943fe2fe1d1871f569b
SHA1 e5b70e294b3e24525e9ee233bd331d5bc7b12085
SHA512 06c721bb118a4c04751156a64bad9e617c98780046ba6df67613306ce71dc9cfc86ac67886008d3b26397b7adb81c25e41b85e66b92d44e9f6bdce76768043c6
TLSH
T10621D462E0F5CCD7F43268CBA615DAD71CA436EAAC6C6A5523054118BBC9C314F150F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-81-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2980-33-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/2980-23-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/4916-78-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5976-6-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download