ce3dec1462f1b183052fb477827499cb87e1c62517002ac685f88a887191b334

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
Size 844KB
Sample260908-j5ye2aeb57
SHA256 ce3dec1462f1b183052fb477827499cb87e1c62517002ac685f88a887191b334
MD5 af8e292cea0a1264ba99a7b35c42ff5c
SHA1 1d8baa446bf4c584bc273e98271ba4b000aa27d9
SHA512 97f6b9222432bab7b95c4a33c458b1cbd7edf56ee7ffb463aef5d926ff0b71cdf658bd61ded37af94abc1a40afa62caa51a28b8c0f0f8b56bb338411e2e8279b
SSDEEP 12288:mgUFgEsnojAJgUFwCGzLUeDuUlIKLrrCB1igsNBfcsc+ZOniTjkWIw2y:m9+EM0O9M/U6sslZOiTiw2y
TLSH
T18A053A0977ED14A4F5B3923489A68265D6B2BC615B31D7EF6290C23E5F33BD0AC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
6008	svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
5480	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBCAABAABACABCBCCBBAABBCCCBCCABBAABABBAACCBCBAABBAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe"	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAABBBCABAACCBABCAABACABBBABCCBAABABCBAAAAAAACABCCABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe"	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3696	sc.exe
4208	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5208	cmd.exe
1720	cmd.exe
5696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
6008	svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
6008	svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
5480	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
5480	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
Token: SeDebugPrivilege	6008	svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
Token: SeDebugPrivilege	5480	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 5696	1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe	92
PID 5696 wrote to memory of 5708	5696	cmd.exe	94
PID 2628 wrote to memory of 2836	2628	svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe	95
PID 1312 wrote to memory of 5208	1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe	98
PID 5208 wrote to memory of 3696	5208	cmd.exe	100
PID 1312 wrote to memory of 1720	1312	2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe	101
PID 1720 wrote to memory of 4208	1720	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_af8e292cea0a1264ba99a7b35c42ff5c_elex_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBCACACBCACCBABCAACABBAABCCBCBAACABBACBAABCCCBACBBCBACABCBABCABBBAACCBCBBBCABCACCBCCABAACBCABBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABBCACACBCACCBABCAACABBAABCCBCBAACABBACBAABCCCBACBBCBACABCBABCABBBAACCBCBBBCABCACCBCCABAACBCABBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe" start= auto displayName= "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe" start= auto displayName= "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAAAACAABABBCCACCCCCCBAABABACBAACCABCBCCCBCABBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBABBABAACCBAACCABBCCCBACBBAAABBCAABACACACBBCAAACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1b4ac5bb7bcdcf8359bcbe8d41a17af91b87a05fce085999021d5a419c8fd857
MD5 1502d76cebb9d58e50099fd7a871ae06
SHA1 f8c6e0ba0beeb8373d09d7878b5dc42f5bbc042c
SHA512 709bc908ad779043bdcbd8dd78141900ecd892b7d482de561d2e8662be0aba25fc851278b137471d7caa0aa41a7bdd01014f1b871d14d41c4be2c623181256e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\qap`g`v~dtlq
Size 10B
SHA256 b8b03d3ef5d58f91741c6aeaead2f5a1a558e45dcc30e9bb9b3f8dc867d1c931
MD5 040c1a7c26d1e6cf01d601d4ee2e5c6b
SHA1 b68233232d79bd94a3b338ebaa60e02d6ce1d3b2
SHA512 88b8da2a81d3436aa8de989a114da10abc6152d6ec2b126b7b017b7e8754d8926852ad4620dcc1100a7e0cf4df49764f8e8be3ed2b38c079dff0c1b83a9d7700
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 bb67a45e54ebfe1ed96793d9c31313fb1b0cbb7f916a9e5ceb8cca2f185b0693
MD5 33beeff8210dcf33778cd80da8c07155
SHA1 fb445df747a11dc9b1d694daef9a3d8c2a8a6563
SHA512 9ce3c54f2bc904c9e42cb27c6c6bc33000ec0a3aeccff1e6c844fdccd493bd2f17705687f2900ae78ce8c50d774957fbbaab16f66365235972b3482c86beb61d
SSDEEP 24576:m9+EM0O9M/U6sslZOiTiw21m39PZfePv3r7fm6t+jqp+3l+zCM0e:U+E2M/HJiw21gZ2HbbZt+jqpQ0CM5
TLSH
T14E658D25B6E800A5F5F352319975C231AE75B9201B30C6EF93C0D62D1F73AD1AE76B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ig-NG\qap`g`v~dtlq
Size 10B
SHA256 a1c5da10873d917d71b181e2a14f4792e9a5a9fe2cccacb87ec863fbc6f8b912
MD5 74eefae09c79c6e39b2bbba3d7744776
SHA1 624d76f7fbfae5164829a58e33ea84402990dab3
SHA512 3733bd67812c03f41c9327335008001f25cdeced54efbb6bdbc9cb3a54f9eff52d95ebb6db779df3d70ec0ee1b3083b2a7e5bd0815aa643a51c9de59dd554055
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\TCDBAD4.tmp\qap`g`v~dtlq
Size 10B
SHA256 e5ebf36483a046fe96dab178c3a834ae2d2bb164ad1284561b404c381c5ed013
MD5 34ade3e701e5f7bf0078637e12b28af5
SHA1 298c0232f72baafee10efda8c95be36d1555d84b
SHA512 f83a0feb4890060f36873fd8f9bec48032752de2779fbbf5af80ce784f35becac17c34097f6869074723982f58ac2e53635614d9af2f0fe1c5d6c8bcfb5cacf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b97b3b8e16686837ad5a27ffb2adf994e9cfaaaa302fccb03a3553488caa9ec1
MD5 29a97571344e2864c8c5395cd6f51eca
SHA1 f15a1b55def9afddc0b3dcfad49d17b8d50b9fa0
SHA512 5b72a9804e0fe0b9c4a72c126322c1e0d4ad8cd530e644999ff5045dbe6d8697e601f396e4d190f35ebc5193e08dea490904f6d7dff416810d1690c1121b54e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 317069bd8f893b59829507cbab8fdf69e0a8de70968f1fb8f4eb50acaa1a5925
MD5 3dc275e9763d0f8b9577674e867b898d
SHA1 f8845dd412ff01c7f9ceb865f5eb9fac82d2a118
SHA512 b60b4d6e1c1971fe6c616ab6f1ab6700d8707c2e3f54e084bcc5202c472557ae9c07e9115275ee1c497b2a3b18e350d88de40ee0df4cd6755acf07ea4cce9af3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 117c0536b5f7d9b508b10f5b8e6c0f8bfe60886d7a8ccfc801c74402324626b0
MD5 3bcdaed4e9ebee59279bd6bc385f4414
SHA1 c9c2752ddb171bd48823fe0334f4cf5025be5ade
SHA512 aee9c89a6ac86b11b8adf4c92defa517f615f0f05f5bc5e4f79406918afc32dd526137cd1bb19bce8dc0c60ff60bba12e8905b7f64f13d328f15d27cb24590de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c1835892ecb0d115b1b073429bab87fe6eb1620e38b0dd09af80f069c6659b8
MD5 c0026817671fa44b9460c50d69146a1d
SHA1 899f8d4e87fc5dc123df252ef4ad3f6a421fccd4
SHA512 6f721aac28c837a5949297ca3271c0c2ea594bb2e7a2c63dab2615defa72be0fc2cfc7f6dc9a1402886c6786f5b58d11dac19c645177b5820100df463c3bd024
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d4c368d4e8c0b23922ab4c92f9ce55a30fa613d2f3c0c6a37fe56a2712ff076f
MD5 fb503dc6f96b1c8d755dc173ecf830e4
SHA1 4f484e4b730a5df500ba2ce171649d580f99b9c2
SHA512 78f472f5616adebd438dfec9fd7bd98ee73f903b9b433e99bfcbed95eac1215ccd1cfd1df4b80af4b2071a2f49965bcde035653570a3e6a9900a779b274155c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1d6eb860e4a70f297dac8447958d417a39cf54b216cf5fad9393db00b6a8bb32
MD5 fcc2d92d9913ddcf9303571b4e07d5dc
SHA1 b5d80946e56921bb5b702b6f94dba9d5b052c9e5
SHA512 070eef5e6b1526c71af71f379ef6da2958fad72ad654f9671cbf0d5a97480fb63290422cfa5c004a9a7e4e9840ef8b3ec171ffd35fc6757ab0d892dd089730a6
MD5 SHA1 SHA512

Submit Download

svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBBCAACCABAABCAABAACCCBABCCBCACCBAABBCAAACACCBAACA.exe
Size 844KB
SHA256 ce3dec1462f1b183052fb477827499cb87e1c62517002ac685f88a887191b334
MD5 af8e292cea0a1264ba99a7b35c42ff5c
SHA1 1d8baa446bf4c584bc273e98271ba4b000aa27d9
SHA512 97f6b9222432bab7b95c4a33c458b1cbd7edf56ee7ffb463aef5d926ff0b71cdf658bd61ded37af94abc1a40afa62caa51a28b8c0f0f8b56bb338411e2e8279b
SSDEEP 12288:mgUFgEsnojAJgUFwCGzLUeDuUlIKLrrCB1igsNBfcsc+ZOniTjkWIw2y:m9+EM0O9M/U6sslZOiTiw2y
TLSH
T18A053A0977ED14A4F5B3923489A68265D6B2BC615B31D7EF6290C23E5F33BD0AC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3308208db3015a0af898d4865aedb5cee831c58720d4749fd084b6d8706b55b8
MD5 597c7c974762290043c2171397522326
SHA1 2740ae148f6359f6e39807d85beeec5055e545ff
SHA512 913c9eeb998021aa6057ed1c29e0e0d50b4824a89326a18dc23d0f0822a3ff455ee75158a6da006c2f51c25c730ea9bf663c8c1892abfbeb75da3c75e0646474
TLSH
T12211A761B1A9D867F4316CC7A6358B47CCA43B9F582CAB1463094218AB95C398E1D8F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b64e2e8fb77eba9c4286455ef70b18400b64036741acacc70fa634c21dbef9cf
MD5 4fb20ea1e7bc6a27c6ebfb1b49b32411
SHA1 7f07dcdbbecac758afca0edf4f0f188f29d38697
SHA512 4dca0cd6074329aac33d6a57f10d6e94a428428339971221a8ec44b4cb671ce220f74bff1bf96a5a0c309560101b63e126e62b14852ab69c6ea803ff95e1d52f
TLSH
T10F21C971B1A9C877F4316CC7A6359B47CCA43B9F582CAB1473098218AB55C398E1D8F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1312-0-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/1312-7-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/2628-31-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5480-899-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/6008-69-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/6008-1305-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download