f3210b58cc7e6e933561d17923ca64598615214542cf879b9b7a39f32e215064

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
Size 5.9MB
Sample260810-dh98estygv
SHA256 f3210b58cc7e6e933561d17923ca64598615214542cf879b9b7a39f32e215064
MD5 1394c0b7f39ffd8355eabab77f38fc51
SHA1 efc442ba3250780efe93451063d00271bf01f718
SHA512 b5210b9d02adc6772ccb7e828ae8a0bef73472d1458f2ab200c64ef025dcefcb599d7f1ae42c9d83e8cf242f592deae6f96c52af080c67f25d25036aa0f6a2d2
SSDEEP 49152:U+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMho:244444444bn7O9
TLSH
T19F56291ABA4408F1E86245388582D61D9771B815CB13CFCB72A89EDEFFE36D19D39630
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001bc36-18.dat	UPX
behavioral2/files/0x000d00000001c4a3-25.dat	UPX
behavioral2/files/0x000d00000001bc36-69.dat	UPX
behavioral2/files/0x000d00000001bc36-77.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
5892	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1200	svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACABCCCABABACAAAABAABCBABCCAACABCCACABAAACACBABBAABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe"	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAABCAAABACBCBCCBCCABBAAACCCBCCACABAAAABCABACCAAACBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe"	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5004	sc.exe
4864	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1512	cmd.exe
5476	cmd.exe
3404	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1200	svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe
1200	svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
Token: SeDebugPrivilege	1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
Token: SeDebugPrivilege	1200	svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1512	4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe	91
PID 1512 wrote to memory of 1340	1512	cmd.exe	93
PID 4008 wrote to memory of 5476	4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe	94
PID 5476 wrote to memory of 5004	5476	cmd.exe	96
PID 4008 wrote to memory of 3404	4008	2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe	97
PID 3404 wrote to memory of 4864	3404	cmd.exe	99
PID 1052 wrote to memory of 1668	1052	svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1394c0b7f39ffd8355eabab77f38fc51_coinminer_elex_hijackloader_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBBACCABCCBCABCCABABBCBBAACCACBCACCABCCBAACAABCBCAAACBAACBCAACACBABCBABAACACBABAACCACBCBBBBAACBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACCBBACCABCCBCABCCABABBCBBAACCACBCACCABCCBAACAABCBCAAACBAACBCAACACBABCBABAACACBABAACCACBCBBBBAACBBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe" start= auto displayName= "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe" start= auto displayName= "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABCAACAABAACBAAAACBACCCBABCBBBBABAACACCAABAABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
1⤵
- Executes dropped EXE
PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBABBBBBCCCCBABCBCBCCCAABCBCBBCCCBBCACBBCBCBCABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 afd96c698272a68166f9be56a66b59ede8a39683651ffc51336788876c6bca15
MD5 c20e8faa9677a14e22a413ee6181be7e
SHA1 db23490b612e79c5505c4edbd3684ab572c1498f
SHA512 c0ae19c500b550bdad063132d707f1887a42bc12f5cdfd62fe61ff8437afa70cce3a6234cf75d884a9e8b7fafb698cad42db458a163a7cc815337735a861e993
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d5f058a7d09b12411284b61af738f61cfa6eeb2ac9350cd0a76fb7a6c8cc2fc
MD5 6bbc285cabab01baec2938fbce2b2d7b
SHA1 8820f598586f0c637e21c373f3b0895bf12f161f
SHA512 60a117196660b19e7eed1729c442318b050868981c892bcb5a5902ce0f289bfae7ea19fed1012805b0ccf43fe5422df0bdf90dd628e87e654c16dc8bc8fdd944
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f4433f5587b04bddad9a9a7893fd3f9b141dc741f0e1e31326f2d56d925a13a
MD5 a9637313dc08f3666150b65e0f5b50e0
SHA1 d943b05b1ce2b3b7effc4928ca154bea4b133994
SHA512 92d221c9a6d93255e2e0fe1e07064848067acf7bd23ef5211271188af4924c4bb3a15576a464cbe7cf5391f83cff6971f99fd0c501f972c02fa042b42f4493f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d714f823b6d2a1c3bc7548ad164c89ee11e3aa4e76788eefdc117bdcc30288f1
MD5 432aaa83648db6f3905e464836a7cc9e
SHA1 aeac494a14d012f2a13f0ad3417cbc2c668f2555
SHA512 c2a21c6c462d01867776f3c1bbc7d576fe10e779f2a6f5fd713126842bc879a77c881ef7b0a8a73c443a50ddb79c1f5945eecb4535e1f863fc9a3edd0203524f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7420716b6a0dcc560b2944f2b587476e3732676870eb1764b757aa99882a997
MD5 5465ee2a42562ca5bd80561ec88db07f
SHA1 5287501132294b5e24c9faeb4f8d72208b8aa180
SHA512 d641bd573cc6c17a2638449354de5853209bfb3a5c6389f2038370ba84f29437dd24a0d99f0de62ffb5ed4b7bad5bfd4089b1a4fdff4d78407631a468241f848
MD5 SHA1 SHA512

Submit Download

RemoveStart.exe

Path C:\Users\Admin\Downloads\RemoveStart.exe
Size 18.4MB
SHA256 ec11cbfd40576fe2a6bfbc61579be3da483c65b4d78c73840209f3ca1ea3ffcf
MD5 28388ddf0150f2ea4ac480e79b86ba79
SHA1 9f53f48721fd99ec1e16ae4d13e3977b2395e5e0
SHA512 bbdfb130cae496b6d44bd654d56878a50baa43b59dc117da0bdb8ce0968d46625d8e97301c043d1410f0be816fc97710a1ee3e7b903ea674e90953d1b58a5c03
SSDEEP 196608:244444444bnS444444444bnS444444444bnSp:uJJE
TLSH
T19F17391ABA4408F1E86245388582D61D9771B815CB13CFCB72A89EDEFFE36D19D39630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveStart.exe

Path C:\Users\Admin\Downloads\RemoveStart.exe
Size 576KB
SHA256 d4f580612d340a1fb585684c8b112280fc81aa0f110b4bc8fdd7c3298a5b30a2
MD5 a45b4229a2b2edd4d59f7854a3c13b31
SHA1 964fe82a37ccfb96d1e746242c3ccd444b2caadd
SHA512 f0594fbecfd72f20c266a3ae07675e23bd7ab7300574be6a344763825404605ab2f448867823a0ac764407a7d5e1b9c39840e53541b7b13a5f5b28b076ad0240
SSDEEP 6144:m+dTTUFgEs3XojAFV0fs9P0qEkO5VScfo3nhuzvgnbZiwLuLahmZ2uhuY:mgUFgEsnojAcwYkUVY3nMkbZwAmZXuY
TLSH
T18EC4291ABA4408F1E86241388582862D9771B815DB13CFCB72689FDEFFE36D19D39631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveStart.exe

Path C:\Users\Admin\Downloads\RemoveStart.exe
Size 1.5MB
SHA256 72c7898ad3fcfc9742943e79f9da7e02ee6a15a19292264e88e5509a523da557
MD5 aefe8f78f42a6efebb11634bbed0f75c
SHA1 e1d83f4141db037c2b02e69f129efe82efe901fd
SHA512 d906671e5e27818a8b64c6e15d27d275a0806e87c8eb64f449aa31398900aeb0157b84dfc1217700c170b26f1560e0c1a3e76b51f745743503f273518c0f3e76
SSDEEP 24576:m9+EM0bwMOZwAhYi9+EM0bwMOZwAhYi9+EM0b0:U+ElwMhS+ElwMhS+El0
TLSH
T1BB75181ABA4804F1E86241388586D62DDB71B415C713CECB72A89EDEFFE36D59D38630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveStart.exe

Path C:\Users\Admin\Downloads\RemoveStart.exe
Size 48.1MB
SHA256 43d97aa5c0f1ddeabfc0acb33bc8224601f17fd5721501e9bf6ca166e55dd343
MD5 649d340da86a90228ec71247676bf217
SHA1 2c2184c7a344c853c68109b3414f5cfcd24e165e
SHA512 acce66a6956fe8d7322d37b6f4d3d1faa46b2e897621746bc122e13bf1390fe262fdad56d0f9a6aaf2fa7d63ee3eb3ef2fd8f95d1be034ea781e9242eac14785
SSDEEP 196608:244444444bnS444444444bnS444444444bnS444444444bnS444444444bnS4445:uJJJJJJJf
TLSH
T144B7291ABA4408F1E86245388582D61D9771B815CB13CFCB72A89EDEFFE36D19D39630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveStart.exe

Path C:\Users\Admin\Downloads\RemoveStart.exe
Size 54.0MB
SHA256 6693f2ec2e8aecb5ec67e4261c37a8e296fa1fd7572bb07ad74360a5f615e95c
MD5 999e33b9c93d9adb5233df01c4a54d22
SHA1 586dfa229bddbd5ce7682583568020149d1c3dd0
SHA512 a641b0d1f83395708ad479fff59552de9f952229af82b1c44f7b7b870acd441dc79aae2dbf2b295c0e94652af866f49e84ca9ea5f33f0d7b85a65e31aacdcad8
SSDEEP 196608:244444444bnS444444444bnS444444444bnS444444444bnS444444444bnS444a:uJJJJJJJJK
TLSH
T1B5C7291ABA4408F1E86245388582D61D9771B815CB13CFCB72A89EDEFFE36D19D39630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8850fc811e294a8150db542c2cb98d891f14b2bf9ce1b4aa1474ab86678bf20b
MD5 755f52dac5bd57e840e8611cdd94a982
SHA1 454d1c7e92b7f8fa5194473fd75c850cc7f94f2f
SHA512 232f1bc341833cd1ca79fbfa2bda844bc1c3b3345e606c6f41052b0900a1242e4011169f70218d260b674d250f341deb69802f33d83dfbc535c585fea9228643
MD5 SHA1 SHA512

Submit Download

svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCABCCACAABAABACCCABBACBBABBBABAAACABBAAAACCACCAACAAAC.exe
Size 5.9MB
SHA256 f3210b58cc7e6e933561d17923ca64598615214542cf879b9b7a39f32e215064
MD5 1394c0b7f39ffd8355eabab77f38fc51
SHA1 efc442ba3250780efe93451063d00271bf01f718
SHA512 b5210b9d02adc6772ccb7e828ae8a0bef73472d1458f2ab200c64ef025dcefcb599d7f1ae42c9d83e8cf242f592deae6f96c52af080c67f25d25036aa0f6a2d2
SSDEEP 49152:U+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMhS+ElwMho:244444444bn7O9
TLSH
T19F56291ABA4408F1E86245388582D61D9771B815CB13CFCB72A89EDEFFE36D19D39630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 89130cd7297c5fa31bf4b47afa72fdc56bc0331c920ee4c8e8aa2e39dec17c90
MD5 571d1b92c331d2988a8f0b9cd79e9a50
SHA1 0311ade13c389917f1c6afbffd9e0b34f2d15e20
SHA512 aa9732d885b9bb5b0aacdb1d7d525c74c831194beaddc3d1730706ab6a3b30398fe711c687040777e20183e0996aa34d6b1303d288ba9b0ede52bf5dada5f8e1
TLSH
T19811ABA1E4A9D863EC3268CB522FDBF30C9C77477868AE242249451DFB4DC22CD550D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-108-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/1052-50-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/1052-72-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/1052-32-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/4008-59-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4008-81-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4008-33-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4008-21-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4008-10-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/5892-88-0x0000000000090000-0x00000000000B1000-memory.dmp

Download