c6e6e1a5e6972b5cc4a945b7e16da31a951fedd9469c29faa08cbdbd61d9e8ab

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
Size 3.5MB
Sample260811-czp35stdpf
SHA256 c6e6e1a5e6972b5cc4a945b7e16da31a951fedd9469c29faa08cbdbd61d9e8ab
MD5 b7a3989f8b0b650b02b9b54a99195747
SHA1 2334019bb51ce36c9ee968d341bfc067ea24e8bf
SHA512 f73f23b2fb1a8ec06181887637d7593e7d29258b40e5d2754fa8b3674972e345f441728c69e67f1a28974b6a75bc07b43aeb348efe95f42bc2fc5f21f660a395
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVbHQ+Ee+Ee+Ee+Ee+Ee+EVD+Eea:Ewm
TLSH
T122061905FA8640B1D4774170499BD27E8630BE25C6138EEBF649AEDEFBB2A905C34731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs

resource	yara_rule
behavioral2/files/0x000d0000000118ec-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c539-27.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d0000000118ec-41.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
4556	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
3044	svchost_CAABACCABCCCABABCBABACACCBBBCAAABCBCBCACBACCCCBBBCCACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCCCACACABABBCABCCBBCBCCCCACCBCACCBCBBCCABABBCBCCABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe"	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCAAACBCCCBABCACBCBCBACACCABABCCABABCCCCBACAAABBABAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABACCABCCCABABCBABACACCBBBCAAABCBCBCACBACCCCBBBCCACBB.exe"	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1932	sc.exe
3488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3152	cmd.exe
4176	cmd.exe
5336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABACCABCCCABABCBABACACCBBBCAAABCBCBCACBACCCCBBBCCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
Token: SeDebugPrivilege	5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3152	1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe	95
PID 3152 wrote to memory of 1424	3152	cmd.exe	97
PID 5288 wrote to memory of 2128	5288	svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe	100
PID 1784 wrote to memory of 4176	1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe	101
PID 4176 wrote to memory of 1932	4176	cmd.exe	103
PID 1784 wrote to memory of 5336	1784	2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe	104
PID 5336 wrote to memory of 3488	5336	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b7a3989f8b0b650b02b9b54a99195747_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBACBCAABAAAABABACACAABACBCCCCBCBBCBBBBBCBAACBBBCAAABCCAACACABCCACCCAACBCCAAACAABBAACABACCABBAACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBACBCAABAAAABABACACAABACBCCCCBCBBCBBBBBCBAACBBBCAAABCCAACACABCCACCCAACBCCAAACAABBAACABACCABBAACBBACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe" start= auto displayName= "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe" start= auto displayName= "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCCCCAAAAACBCABCBCACBBBBBCACABCAACCAABAABACCCBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACCABCCCABABCBABACACCBBBCAAABCBCBCACBACCCCBBBCCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABACCABCCCABABCBABACACCBBBCAAABCBCBCACBACCCCBBBCCACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 11.0MB
SHA256 d7343eff5b79a275f58fa0081de33cf97d88702f78d15e4e51c17825a1f067b9
MD5 4bc86a4b73a5dcf7be92c58fcd11e4d2
SHA1 b899edefedc3410f1203b530e5fec1b428feae60
SHA512 de504f03ae4b7ff132d8953e0d5a11a5c77f076a5528cac4fbafe34ca98bb7c96ace8e75870e36b55be0bbfd23ac177a2dca4b06e9f5d372b0660bc3d2ac0173
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVbHQ+Ee+Ee+Ee+Ee+Ee+EVD+Eel:Ewbwbw+Sc7Ej6Y
TLSH
T16CC62A05FA8640B1D4774170499BD27E8630BE25C6138EEBF649AEDEFBB2A905C34731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 9.9MB
SHA256 79fc4ae32acbbfbd4bdc051b3525b40773598cb9ef6e745d16ee34b97e78ce7d
MD5 c611fcf1e03f460f975ccccbf8e25a9f
SHA1 49b80409dbf3895010fa7ec75be02f4a1c2feb61
SHA512 3320937e070e051dd1809898ccaf75a97f3b516eec9cd503be92e4e40fb8f095afd7998e11e425fb01bb79360566903207597b03ae3c07dc02679502f86c3c3e
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVbHQ+Ee+Ee+Ee+Ee+Ee+EVD+Eee:EwbwbwM
TLSH
T14FA61A05FA8640B1D4774170499BD27E8630BE25C6138EEBF649AEDEFBB2B905C34631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 1024KB
SHA256 97e17fc46e756114752255a9c54541c23b8ff4d73ecd51dc6b76a20c8115dbe9
MD5 e7548e9b7eb4558235b7dd904ad21868
SHA1 989b48ecc0537686ff7a187a5b2340981b8923a6
SHA512 4dd3e00265b90a4a67b832bbbb2903580bd064bb79ce98182a72b45f7fbcf70a871d30cf9a73fe1cdb142ef42728fa61160b15fb0b3cade677c1cbd4bcb7e4df
SSDEEP 24576:m9+EM0q9+EM0q9+EM0q9+EM0q9+EM0q9+EM0Tp9+EM0q9+EM0q9+EM0q9+EM0q9Y:U+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+E3
TLSH
T111252A09FD8740B1D92B51B04CDFD2BF8A20BB2587128DFBFA4DCB5B6523BA15838255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 640KB
SHA256 40f9257f19ac7c4af8fd80664901e976984dc85618a037ef33723ef6e47f335b
MD5 beff2d22454f7828c14321726c714586
SHA1 2625bfc926ef2e4fca7a56066cf7bbd36d5ad861
SHA512 53fd57c8b04b91e7387bbc9a5a4a456cf527686e670c87de3f24079d4d15127d752e334e9eba565f41fcee7003eb5f205fb772bf48553547bf784192d2edb6df
SSDEEP 12288:mgUFgEsnojArgUFgEsnojArgUFgEsnojArgUFgEsnojArgUFgEsnojArgUFgEsnt:m9+EM0q9+EM0q9+EM0q9+EM0q9+EM0qI
TLSH
T104D41909FD8740B1E93B51B04DDBD2BF8A20BB2587128DFBF64DC74B6932BA15838255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 192KB
SHA256 3418ab2c1a33d351436f1b266a689b29c8ef4b01bf44db336fb9bfc550979571
MD5 3ca96ddded866edeb92ea3e57d2a6f2a
SHA1 5446b7347d7eca875090dfe4d35163ee87bdbe50
SHA512 3d695a59a2c543ee3729709484429ebbd6ffaebf023659096438af0a6bc3a0b12c8a29153f00b529de1ccb782b91a73bc422ba0e6570328be1e06d0156c451b6
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdo5dtpUtI9vTTLoFpmEY13XojAdo5dtpUtI9l:m+dTTUFgEs3XojAdh+dTTUFgEs3XojAE
TLSH
T15C140909F94344B1DD2B50F04CCFE3BF8A60BB2586124EF7FB4ECB5BA522BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1cfc5790e846bc320768f3e8a4d2eea053a28c6a8c596c7036fa642507d2f9d6
MD5 f84b356afdbd699c8a0e56eb30eb7d84
SHA1 10e39a80540ba1ab60c3fe9397758bffb260ea27
SHA512 723e0ffbb28b6d0621d1a3305c0f2a0ee08e1b722d2871845dc1f16f732b8bb253f555079be6d701c6c7a48371a72e1a105ffafff79c68c4c52b2774ac7a89a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7b6c6fa82f457e72b9e9220581877ff3715ffd21c873d7727c7c46efa099ebf
MD5 0ea115863e60289f943cdc48fa4679ce
SHA1 91344a1ee5c1d1361c23c442e69c15d65e159365
SHA512 fd162686456c6228a194295d4263a0ff1066b1f69d9487449c9b01ea415cf1370fa12b4266648fa01098a13173fbc94010b08959edb2778767e4d35f0d12735d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3fb752b1e333665a11af87e09f72b914d774d111773420a5b7ae3f71716ba45
MD5 c1955790681450f4d7a708481fcfd8dd
SHA1 5b76537b977e4441fc4e17356b2f5703f257f92a
SHA512 a602c5665faa74d089087a1c599ad678aadbf2b3b66e3f38ed21dd348942e1e8904fabb68ffef4b7c659c0ab7ff69e9d9d73e32d628e236490361005b2c091ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8472075fc4fa238190512d295ff0ae9f2a0ddbf388515c886b6acf3cc511e72
MD5 e62ac930b2a6fe9117d1e72b1a39894d
SHA1 9699dbc5f3e673e24f5cdcc4004ff172a755f04b
SHA512 6d1b0e71a625509ab21a5fa0f5423a63bed21fd9b34aa6e66e186d614e4f351d5bd3a21f575dfaaa252c02cde47c51e8c8888022ea2866e0937052efb87f5097
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fe4ff908df489abac859ee232f1a2ecd5b0547a6a9a2219076e3d0c94bc6c2b
MD5 160a4967186bef4364abb0943698da2b
SHA1 db637960a90fd442cd40d6a2bdf5d36e6c79a85a
SHA512 e33d484f71dae5734b6633b0bc2d04b2bd2089eab6968ef65d13cee5b562525870ff537381c3bd82a733cb61d8fb97d3532aac067235b10db77302582c60edf6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a2cc29f03eef5d328dd2603cde915bf1d1868380801486143707278464ab912f
MD5 ae8db9abf323c2a1fb700048cce30161
SHA1 8d2726a3220244db780e00312f1376b011bedf46
SHA512 e57be179e6151143d42fba7d75560ffcc9e27882f9f2f6bdbafa7c8cc716d36ec19ef6ca7ba76cb8cf5297cebc5304666ebbace6ccf8405a9a6a80572555d4dc
MD5 SHA1 SHA512

Submit Download

svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAACAAACBBBCAABACBAAACBACAACACBAACAAAACBAABCAACCAAAA.exe
Size 3.5MB
SHA256 c6e6e1a5e6972b5cc4a945b7e16da31a951fedd9469c29faa08cbdbd61d9e8ab
MD5 b7a3989f8b0b650b02b9b54a99195747
SHA1 2334019bb51ce36c9ee968d341bfc067ea24e8bf
SHA512 f73f23b2fb1a8ec06181887637d7593e7d29258b40e5d2754fa8b3674972e345f441728c69e67f1a28974b6a75bc07b43aeb348efe95f42bc2fc5f21f660a395
SSDEEP 49152:U+Ee+Ee+Ee+Ee+Ee+EVD+Ee+Ee+Ee+Ee+Ee+EVbHQ+Ee+Ee+Ee+Ee+Ee+EVD+Eea:Ewm
TLSH
T122061905FA8640B1D4774170499BD27E8630BE25C6138EEBF649AEDEFBB2A905C34731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-33-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1784-61-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1784-0-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1784-22-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/1784-11-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/5288-52-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5288-34-0x00000000006E0000-0x0000000000701000-memory.dmp

Download

memory/5288-73-0x00000000006E0000-0x0000000000701000-memory.dmp

Download