c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Size 3.4MB
Sample260814-eblrxstyay
SHA256 c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f
MD5 94fbb309fbc68b55d00131d75f9e7d49
SHA1 9ce6ef6b1ab59fd6e8af2d5ff7a79d53b8c90b2a
SHA512 1c5f88666321890966d7d3a762a428c9520a75bbd4d4f539f14f8fbac7eb8cb2d8969fe70baf32f8830793b25b80a736f3f619b41cccfb621cedb0ac1cc6b081
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+EC:Rp7k
TLSH
T13EF56D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
3420	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
3948	svchost_CAACABCCCBCABACACBCBABBCAACCACAAAABABCABBBBCBAABCBBCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCACBCAABABBBBBAAABBCABBCACABCAACBAABBCABAAACBBCBAABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe"	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBABBBCCBBABBBCBAAABCAABAABACBBABCAACCCACBACAACAACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABCCCBCABACACBCBABBCAACCACAAAABABCABBBBCBAABCBBCCBA.exe"	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1512	sc.exe
3904	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1752	cmd.exe
1896	cmd.exe
2028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABCCCBCABACACBCBABBCAACCACAAAABABCABBBBCBAABCBBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Token: SeDebugPrivilege	3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 2028	5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	95
PID 2028 wrote to memory of 5784	2028	cmd.exe	97
PID 5240 wrote to memory of 1752	5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	101
PID 1752 wrote to memory of 1512	1752	cmd.exe	103
PID 5240 wrote to memory of 1896	5240	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	104
PID 1896 wrote to memory of 3904	1896	cmd.exe	107
PID 3240 wrote to memory of 4572	3240	svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABBACAABABBCACAACAABACBBACCBAABAABBABCCAACBCCCAABCBCABACBAACAABAAABBAAAABAACBBBABBBABAACBCBBCBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBABBACAABABBCACAACAABACBBACCBAABAABBABCCAACBCCCAABCBCABACBAACAABAAABBAAAABAACBBBABBBABAACBCBBCBABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe" start= auto displayName= "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe" start= auto displayName= "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBACABBBBCAAAAABBACCCBBABBBCABCAABACBCAACCBABBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABCCCBCABACACBCBABBCAACCACAAAABABCABBBBCBAABCBBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABCCCBCABACACBCBABBCAACCACAAAABABCABBBBCBAABCBBCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 10.5MB
SHA256 9f5b189ecd4ded198a63348817372cd73c8a8e93fc6cc300d575c7164cedca5f
MD5 f965394883d19d4f8b853a7bef230142
SHA1 3fd736e84e751d8441ef87e46e106ced35dacae3
SHA512 58d83f0aa9af2da7474aadfc0a6ba21aa9bd76d3125a7efef0f8557f8012cbef3e8c2f392114b160510f2bc8a76099554e7bd736a5ebc131fae4a406155488dd
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+ES:Rp7Ap7Ap79Uh
TLSH
T10CB66D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 20.8MB
SHA256 0a2680d77d7fc2ac6fc025a4210bbb45655ede05a1ae413d4ef359a4ef31a7e4
MD5 957ad6a8e72788340c9201b634413b7c
SHA1 1795bcf260f5123d34873ab881b51179b57dad23
SHA512 1bf92ae98d7625aea1f75ba0e63120651f0f05811a86aa02dc2fc67ce0e8f1d4a495f4fce23e74f030dc087bd15dab1ebcb1e87975852fec63b151dc0990fdbc
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+EO:Rp7Ap7Ap7Ap7Ap7Ap79Um
TLSH
T11A276D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 24.3MB
SHA256 ff3f4ed939f658011faab046c87f5dd21f6dd28dc1824e665d8d0b0af72403a2
MD5 7f13eaaf9a6a27a58cf27404ff416efb
SHA1 c8dd2baeda03d9418a4d90ff43963d7cf692cc2c
SHA512 5587fb63a2f3db86ec8ffd7054fbcd2196e32d4ccb306ff0bda0018fc5f79df2aa80a400d1384e6beae210a1f9b6cddcfa3498740e342ab4e72c0bb5370084d4
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E7:Rp7Ap7Ap7Ap7Ap7Ap7Ap79Um
TLSH
T162476D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 27.7MB
SHA256 37fc7a6d0e985d990f18d59104c5bc32e87ee049c4e20ec326f5a9ce2863ad3d
MD5 80d7d5f9f11967ef07f52cfe2843d253
SHA1 03d68aa0c21b4dcf190cde0a0302d5de3744817e
SHA512 3cc4b1d929f582748d45618761e068a7a6563bd1ce8c8733975bd69b4e05308cbf8de4e40c495ee6d089b9472cf5852845246e2ef21cea24e778191e73a2d561
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E7:Rp7Ap7Ap7Ap7Ap7Ap7Ap7Ap79Up
TLSH
T113576D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 31.1MB
SHA256 eb6cdf83921958ac4aa6f04e34a8136e9caf256f85842400d8e28f0d7cdb0185
MD5 2dec19033064fe234d50401a4761bb37
SHA1 8a9bab9bde84582af47ed85830734feccc2fc06e
SHA512 24392f98ca53c0b510ce4832d33e5d7b992be2bf8854fa77c722930a5e8790948b251943a0e34889de9c281e46416a01c8221189f7f4d16231777c07b1a88657
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+Em:Rp7Ap7Ap7Ap7Ap7Ap7Ap7Ap7Ap79U9
TLSH
T17B676D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DebugAssert.exe

Path C:\Users\Admin\Desktop\DebugAssert.exe
Size 34.6MB
SHA256 ff198328143e79a8ebae07aacb42c49572d0faa42e4befa63208dbfd3a29ee41
MD5 3424aa931f34c9dfe03c8615fa5d8cdf
SHA1 ec7a440655d664a772d42380895e6f048040319f
SHA512 b627bacd5f29332caaad5154354934be7255d816487821127d59e2b0602e4025a6ccbdeb8c6c6f889738565dcc47a4c3a11365317c5ea7b228474d64daf8d52d
SSDEEP 98304:Rp7Ap7Ap7Ap7Ap7Ap7Ap7Ap7Ap7Ap79Uf:X2222222229Uf
TLSH
T1E5876D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 970f4d51674b74ca400d4a2a609e17bf208f1fad6d946fb5b2bcf75303d6d025
MD5 aac4771bf817f2fd6166082282815d11
SHA1 05ba6102ef48523d9c2d98d6ad214632e47506b1
SHA512 9dcf9b09b550a779bccb19cccc34beb4253817d6f4b6cefe5bf9bda261620d3a6e27a291dde15ab9d045e8b61e270f585f93b12ef3be30050009b386dd26b7f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 546898f90206eab259104b20fa62a6f4801bc15e7c7b33a7966e8327f17945e1
MD5 fdb2ce38fbf29fd01f1cd7f4018f4fb5
SHA1 a080010e64ce1c497ba2e022cf9ea7895b243b2d
SHA512 6f85df5e7d90730f05cf4b7170719a5408f20c7f626d4746f46230413f76f0ee21eb9602c1c9d510fa02c21848c7d79a62a7b3e95ff6ac44b38b5f065bef60de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99589612ab689734b3c41ef3a4671d0a558a035abbfaa18b43770baf94c49145
MD5 f561901e68c6b6feb432ffb5b11fa4bc
SHA1 68435a7eb5f0cb7917d960e2c62fb1ec7b6c6a8c
SHA512 8e3bc42a9391d994d52c44fdec4cfc2f77406d49ca173a61086ab031b55fcfc16c4864652574c25a3c2120b8f362ca35e9903c7da6fc18ef55d0f6a53c675b1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6fd5a44901845e0f58fd4bf23de03b9fc6073dc86fb8c34ac1d3b768e97a3c5e
MD5 4a3f84c4fdcf222850e29c3151dc5db3
SHA1 380fece2cbd8d73d0ab01c8e31ca0218c2cc5a7e
SHA512 f91dabd2ebbe5c4f0b63dc0c3fc02b5124044db0225036bd2c455d8c789a787ba3d72946dbcc29762f8eabcd553f603d2bc62b2ba2a1d951b44e1d92a0a088fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0f8874d26f72668f329be41f470780e49e124c70883183bf7b6810e2b0d534a
MD5 4ece434d8a01c8b95dfac348e15b95b0
SHA1 b06067c8603936107de7432f4cec732ead70665e
SHA512 1db0afd456b4e879482907f140de41b052f3f9b2b4f246249572571fd63f362eab2621d8268153552821416d843b941f2ddad8272981fd716ca70b5703fcca25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5eecf4210fd5eece38bbdaa38d4de79bb89dca6f9606179af4cc99fc2f9d9b64
MD5 1fe1e6a5829f387f0c445391a6f38e34
SHA1 479f818712de385796fb383796d2c90b1ae538bc
SHA512 4b9c623e00ce838277ce667ec00920cae537a25f23f49bb6bfe300aa3106fc7a72a42681f64bb7a366c66c87d4a20a511fd5be9e7f8ddb08ed36492cf4962983
MD5 SHA1 SHA512

Submit Download

svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBAAAAABABCACCCBBABCBBBABBBBAACBCBABBACBBCBCACAACCBB.exe
Size 3.4MB
SHA256 c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f
MD5 94fbb309fbc68b55d00131d75f9e7d49
SHA1 9ce6ef6b1ab59fd6e8af2d5ff7a79d53b8c90b2a
SHA512 1c5f88666321890966d7d3a762a428c9520a75bbd4d4f539f14f8fbac7eb8cb2d8969fe70baf32f8830793b25b80a736f3f619b41cccfb621cedb0ac1cc6b081
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+EC:Rp7k
TLSH
T13EF56D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3240-95-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3240-50-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3240-32-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3240-71-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3420-87-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3948-96-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5240-10-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5240-82-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5240-21-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5240-59-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/5240-33-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download