2dce3bc58aaa90f6c156fcef86c709d86b36c31c2de5c7a8df7384d33abd8970

Analysis

max time kernel
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
Size 2.6MB
Sample260905-b6b97adj4t
SHA256 2dce3bc58aaa90f6c156fcef86c709d86b36c31c2de5c7a8df7384d33abd8970
MD5 a10b20f799b7bdf5b89d1284d399654e
SHA1 a7758c5b1cf7512850101a27139a6ac59611e877
SHA512 f3ca2d4110aaa187868dd36b3f097182b38ac5eacd0fa648d0433df588f986a85bff8c89b6e03760eaf70265d2cbece64dd4f720f6d366eee4281d33ec8e0de0
SSDEEP 49152:U+En+EYDd79WCn+En+EYDd79WCTpO4q7rHbBSUldP0v7f8IUhabas4f7my:1p7ep7HO4q75Av7fbUhabg9
TLSH
T1B1C54B2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
3680	svchost_BABCBBABBCACBCBAAABBACCAAAAAAABAABBBBCBBBABBCCBCBBBCCAA.exe
5276	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBCBCAAABCBCCBCCCBACCCCBBBCBCBABCBABCACAABBCCBABBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe"	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBCBBCCCCCAAAAACBCBBCBCBCCBCBCCBBBBCCABBBBBBBAACCBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBBABBCACBCBAAABBACCAAAAAAABAABBBBCBBBABBCCBCBBBCCAA.exe"	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2484	sc.exe
1208	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6052	cmd.exe
4220	cmd.exe
5620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBBABBCACBCBAAABBACCAAAAAAABAABBBBCBBBABBCCBCBBBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
5276	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
5276	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
Token: SeDebugPrivilege	4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
Token: SeDebugPrivilege	5276	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 6052	2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe	91
PID 6052 wrote to memory of 4180	6052	cmd.exe	93
PID 4520 wrote to memory of 5504	4520	svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe	94
PID 2444 wrote to memory of 4220	2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe	97
PID 4220 wrote to memory of 2484	4220	cmd.exe	99
PID 2444 wrote to memory of 5620	2444	2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe	100
PID 5620 wrote to memory of 1208	5620	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_a10b20f799b7bdf5b89d1284d399654e_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAABCBCACCCBCCCAACCCBAABBBBCABCCBAABABAACABBCCCABBBCBCACCBCCBCCACCABBBBBABBABCCCACBACBAABBABCBABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAABCBCACCCBCCCAACCCBAABBBBCABCCBAABABAACABBCCCABBBCBCACCBCCBCCACCABBBBBABBABCCCACBACBAABBABCBABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe" start= auto displayName= "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe" start= auto displayName= "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCBAAACBAACABCABBCACABACABBAAACAAACABCAAAAACBBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5504

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBABBCACBCBAAABBACCAAAAAAABAABBBBCBBBABBCCBCBBBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBABBCACBCBAAABBACCAAAAAAABAABBBBCBBBABBCCBCBBBCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bc3670d6f4e67d16189a6d90f4b787b79882e1c4d6c499d12f343be7301794a4
MD5 97360829df69e404ebbf6884e45a9815
SHA1 c1f947dcadb93c552d4737cdff234ece320b6fc2
SHA512 693eb85f0c17ecbe9d4964d038a43c89b174f054405f7dc57c2f33685487653679df1f68c5da545e8851ac293d0d3d09999bd746ade5497b9d4967e1ee5b4d7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 becd4e355f2fd50fdd235b9ac05999623055db2adde896d2e1f34b2357e39900
MD5 5efcbf8dc9f13a2484b9f5b80de35569
SHA1 e0884c9f318b4d3e3637f3505b24076f5a3a29c7
SHA512 7f597e93f5e2483efcdb4bc42882c59866d68607c068bb0d6586eba36821fae78c6d0b2149ef33825c365df5321a79435182499276c9ba476fc8247eeff684ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 e7add92bf19ca49c2f419b86a66f0cbabb60aa7ead3e5af6dc156fc684804613
MD5 8ab8925fdb40e93d5f8123a460c4e8fa
SHA1 b7966a57888e52c64c3ffc2fc2b4f07a5512e967
SHA512 5e80ad0c8afd42eb80fbe87de2e57590ecc1f4e279ba4119900f306347e5512c64d773c4378bc10111aae12db2cc3af8a91d5a83438a731d742a66f3bf52d8e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\qap`g`v~dtlq
Size 10B
SHA256 180211da614a25768518408e1bcecfac84e284af5068545564615f0b75fc9397
MD5 4ce403b9b411fbe18403718ac62c8c6b
SHA1 6aedde738543b78546c73749b2627b05f366616a
SHA512 6da46445c3c3d60e4a3dfd22ee1e1badc5e3c3f89b318b74bd23f09a218690576e7bccbcf846003522d688afd183a626578d6bb945dd0bbee8470518e0c8e659
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 a51b4dd48ac3df192713bc6e92d11eb62b88f059c61adb22d267e16f965ef6a2
MD5 24ba44f2575baa107a1660cb635a0ae1
SHA1 a5445c04a960e71d861bd8813e41d14b84f23788
SHA512 be3f8fbfc0d3e0cd00ceb568258cb19db0d85ba0bd73efdc96ce464333b50c070d2f5ca231f668a72855eecf2ea7126cb5de18b4c7f5bcd98296b7d42c399772
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5dcd36d608193b23cb14d9136901cb69dd5d48b308c0be15b19591f49ea5915
MD5 a8a3594ed8b5be8c309adecec8ea0739
SHA1 c5cfa8b5ee96c4cb31c1ca7a3060027259d794aa
SHA512 9de9ba6e55e006f0410a898e73deb5e70fe1bda2d11c8ef70222fec0a61654f4826860926fe762e4b45af9ef71675c30e8f97e9fd6e05a2bab389fd0bb83f086
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bbec6e10e6fcae2c39dede59fd0e978beff97f4c92daacade0bc94051fb94e6
MD5 857aea522288135ef663419031c62661
SHA1 631d2fbd00978768f581b8039ae37ff1fec06e88
SHA512 2ac55cf846925b7c85bec2aec728a091a6bd7280345a6c09ea5c21ba541ea9c64f46b43e09013f6ed0fca961dcec9e3bb08f32b62634242269973090ec7b7146
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a06f300011c10dcd168770ee91823a762814f94074ad0443f4bbdc5598923171
MD5 9d71a89e7cb3073dab97237840d53d8e
SHA1 cb6e187a5948d8bcd0075a0f4d467fd7e3371c55
SHA512 8a67dbdbeb9c5951d9dca9f88556b4a136baf05a668b1404792ce117972a02b67191616a8b944ab22a9aa9baa089ad959d7cf1e4f0cf779cef3fffb2f6fae685
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49289c918ef5d8ea4dcc570a1da9ddcb9aa0adc18a63468b7de0f7b1f6856640
MD5 f646e7adba44a4cb3ee5128ec6f71600
SHA1 7bd344bbac969bb56541c8f41d714e4cf377b909
SHA512 4df6da243f158f360b6523c40527742570d964d1d175ab519b4a7201bea9a3c5a748b99ba9f6cc0d0b51d3679b05e50995bb6c9fff2e8990f5f3f94a70f8e878
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9aae88d1ec8ce9de7425930158c9fb15b27ae12195dd0ae69c3c42ceed7e469b
MD5 7413a2bffcb54d9ef336cc63862d0a67
SHA1 314be0526c18da87b6b13728bb3cac9ce03a4fb9
SHA512 842b6159814aa2410d0584bb84475ad39279521c29ea69dea2151d1945f3e47e177c8b967dc333efcdf3ea812f8efa1bd6cfa9210ec013b45529864830299ccb
MD5 SHA1 SHA512

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 27.2MB
SHA256 0ac5e7cd76d9d5e80167f8e2371f47438b3ede11cd97a5f95563f7e0575177b0
MD5 48204178f1814fb7a474a2fe4e6767ba
SHA1 6cc54e2161b553e3c210efead97b00d0e733700a
SHA512 46e0fd1c878d824fbbb4901ac28e6cc2aebfc667f4c81770f04c38af6caa4fcc69d70cda0c272f317345729a474848ebd46a6d662f2c88df8873dea1b95be636
SSDEEP 786432:LhasRhasRhasRhasRhasRhasRhasRhasRhasRhasP:l
TLSH
T12A574C2CBD944176E4729671C9A7E6EDEA3578126B044ECF62D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 8.6MB
SHA256 c2490151bb573a9daa3a7487daed6280cbeafde4476bf94756ac851f87ff1f4c
MD5 b42249e9b55b353fdf63e0fbb5d03aca
SHA1 dcd64330a30ab7daf091341c42a3a820e8c0bf2e
SHA512 c368ffe2ca9f6341012a1f91c4ed06d6dd96dd493f3553b34b12ecb78ac800c37bd69662b7c17d739eff3e1b31e136fd304333eb39857adccdff150222e634a2
SSDEEP 196608:LsHO4q7+zUhasNsHO4q7+zUhasNsHO4q7+zUhasKnO6am:oO4q78UhasCO4q78UhasCO4q78UhasKJ
TLSH
T1E6965C2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 6.4MB
SHA256 993ba0896814c351667a8b8f74854c9bc6ddf243f55231d703f61855b92f7f01
MD5 b27fec52f35e1f34c2fdefc488eb87a0
SHA1 96c3c7c3ee2daaf70a505c11b8cddfa11d1888bd
SHA512 0e97b7ace514e9af3e2bff3641f183e6ec5684fe655b989975e72f6b9d189f46ba2e8f4b96d7250689b4da377c1b3093a3c5b301435e5200a05a489bb625e440
SSDEEP 98304:1p7ep7HO4q75Av7fbUhabgvp7ep7HO4q75Av7fbUhabgvp7ep7A:LsHO4q7+zUhasNsHO4q7+zUhasNsA
TLSH
T1CA665D28BD904176E4729671C9EBE6ADE53578226F044ECF62C5134E4D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 19.0MB
SHA256 4cfa6ed3097be146a1bb4253f8658a14e6a787dba972925b1c5530910512dd72
MD5 f086b3d51d584483c40577f52b09e304
SHA1 92e9cb9706e78f295d2ea0142d65128bd4b1f58d
SHA512 271e9dd72560a8cbf7b7bdacf5c1bb207e7fcb2bb3c238959f44cc697806a23e5576f87439f8233db0587a40891f8b97cab34cb2893b9d8b2ab650d70249a3bb
SSDEEP 393216:oO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4f:LhasRhasRhasRhasRhasRhasRhas+
TLSH
T17E174C2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 21.6MB
SHA256 f21a3631334f5eddc0c2c69a6701c1ce7155a30fec700ab2a15bb6a2d8979710
MD5 b39b8dc209ad974785ec808af97a66c8
SHA1 32ed4cb7bf4441d9fb746159077242fb3f277091
SHA512 5815f7a8743519bdb968449be2bd18dfd706441472b9398aa7dd85943a6dd1555cf39d4c7ab9dade65a574f78dc906d88e90f2923508a486499cbc5b64dc86e1
SSDEEP 393216:oO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4q78UhasCO4p:LhasRhasRhasRhasRhasRhasRhasRhaP
TLSH
T132374C2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 24.2MB
SHA256 f2ef89ec0eb963d0d7c1dc9fe51cce31f2f336dc364b20d2e7db56f4cce3d461
MD5 771f158afbfcc6b05122acd03c0219f9
SHA1 3247e4c8231b76d867b4f974dd8381477c624e44
SHA512 1730c9301fb2ffeb0f25bbbae633240b9be71fed635174af1cb201cdaee39744aec97dfeefd3a7b5f117e4a4884e22b2a4aae08dcf4b5474a6c5f46f02f1a5c7
SSDEEP 786432:LhasRhasRhasRhasRhasRhasRhasRhasRhasV:d
TLSH
T1F0474C2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClearDeny.exe

Path C:\Users\Admin\Downloads\ClearDeny.exe
Size 26.8MB
SHA256 caa1925f61c7ceb988c87c53c6ac3c585bf8d23adf95f46ab7d0a36a18e1c391
MD5 3a7f64c70c5e385d8b46fb52fa3efd1e
SHA1 f650158b2d08d2b9e3df8c5201a0cfc7a73f8e24
SHA512 df5e10a7ab1cd95c448c82df2accfe401f9ded4d5655e98ed1a41c9b5b703d8bfa11b9ba3c42d26ea22a5fe78328d609c0566830688bdfb2ba1133b74688123a
SSDEEP 786432:LhasRhasRhasRhasRhasRhasRhasRhasRhasRhasf:l
TLSH
T19C574C2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCACCACCBACABBBAAABCBCABAABBACBAACBAAACACBACCCCCCBA.exe
Size 2.6MB
SHA256 2dce3bc58aaa90f6c156fcef86c709d86b36c31c2de5c7a8df7384d33abd8970
MD5 a10b20f799b7bdf5b89d1284d399654e
SHA1 a7758c5b1cf7512850101a27139a6ac59611e877
SHA512 f3ca2d4110aaa187868dd36b3f097182b38ac5eacd0fa648d0433df588f986a85bff8c89b6e03760eaf70265d2cbece64dd4f720f6d366eee4281d33ec8e0de0
SSDEEP 49152:U+En+EYDd79WCn+En+EYDd79WCTpO4q7rHbBSUldP0v7f8IUhabas4f7my:1p7ep7HO4q75Av7fbUhabg9
TLSH
T1B1C54B2CBD9441B6E4729671C9A7E6EDEA3578126B044ECF61D1134E0D3BBD26C30F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5580f2588d2910eff386537743b4f0b8b05ea0d30eae1a49d4ad736c74eb946e
MD5 ffbfee1be08302b500f8774dee5920a7
SHA1 621565d118a812046e6c77eeed0c1691992fd6d0
SHA512 09a4ed04b1e8c42dd5b35371a9870716d862a98c70d38cdf61246b87818f2b52e69474abe0f7fa3344dec066985ac3c06a47a09b0bfacea1551339649bccc8bb
TLSH
T1EF112359F0A5CC53F031689BD71A9ACB4CE83B9B585CAB14230C4618F7A9C36EE15CF2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2444-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-93-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-22-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2444-11-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3680-92-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4520-70-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4520-94-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4520-48-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4520-33-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5276-95-0x0000000000400000-0x0000000000421000-memory.dmp

Download