04501c379ff227a650730917b35246e343e7fa124a205d04b5b99c2bd1473faa

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
Size 20.7MB
Sample260826-2ntpmaxekf
SHA256 04501c379ff227a650730917b35246e343e7fa124a205d04b5b99c2bd1473faa
MD5 6886cf4e395c0d106d2a1d30e36d07e5
SHA1 890c4b5e6e39a8094c081dd07f51eba6b2d0b5f7
SHA512 b25a18737e73f58885d485f935cfdf29b4c75e2164e3ffa4edc9073c3880497172b3dc08f8210c96d090ffa5e114355da89062a80bff49987ab15f29fcdf4076
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ER:n
TLSH
T15F272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
2316	svchost_CBCBCBABBCCCCABBCCACBBCACACCBCBABAACCAACACCBCBBBABAACCB.exe
4440	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACABABBCAABBBCABBCBBCBCBACBABBABBCCBABCCACCCABBCBCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe"	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABABACCACBCCBCCCACCABBACAABBABBAABAABCCBBBABAACCAAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCBABBCCCCABBCCACBBCACACCBCBABAACCAACACCBCBBBABAACCB.exe"	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1152	sc.exe
3208	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2332	cmd.exe
5768	cmd.exe
6100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCBABBCCCCABBCCACBBCACACCBCBABAACCAACACCBCBBBABAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
4440	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
4440	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
Token: SeDebugPrivilege	4440	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2332	3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe	91
PID 2332 wrote to memory of 5800	2332	cmd.exe	93
PID 8 wrote to memory of 2348	8	svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe	94
PID 3368 wrote to memory of 5768	3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe	97
PID 5768 wrote to memory of 1152	5768	cmd.exe	99
PID 3368 wrote to memory of 6100	3368	2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe	100
PID 6100 wrote to memory of 3208	6100	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6886cf4e395c0d106d2a1d30e36d07e5_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBCBBAABCAABAABCCCAABCCAAACBCBAACAACACCCBCBABBCABBABBBBCAAACABAACABACBBBBBAABBCBAABACCCACBABBABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCBCBBAABCAABAABCCCAABCCAAACBCBAACAACACCCBCBABBCABBABBBBCAAACABAACABACBBBBBAABBCBAABACCCACBABBABCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe" start= auto displayName= "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe" start= auto displayName= "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAAACBAACBBABCCCACBCABBAACCCCACBCABABACAACBBAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBABBCCCCABBCCACBBCACACCBCBABAACCAACACCBCBBBABAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBABBCCCCABBCCACBBCACACCBCBABAACCAACACCBCBBBABAACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 bf132668bfac2c5692fcfc49eb3a627b612f8175cf812baefd5b01d647857782
MD5 c5b549ae2a6a41ecd48ae091a3902a6e
SHA1 89b986ebd25452b548060731a3ef7285abf2730e
SHA512 d4b8c2dabfe9721857bbf491cf4a22bacc30b282e24f69a76ed72f266e7ada7c6e97f58f438ac8de5c6dfa1adecbf458db00e9db293c0d5118f126c763e8d867
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\qap`g`v~dtlq
Size 10B
SHA256 85ccbfbe9952eb129caafb1e6b7f8079ba3f39a9d21413937f73f734bd88874b
MD5 203fd925af64afba2a5c5e1cd920baad
SHA1 c428a4cf80673c9b070dd0f59979ae5b419bbfce
SHA512 976e66899eb30c3694afda14445485728f71bb47c2a7014db36ad022f08a0b5db2362d237a978243cd6e9a23691bb49a3dcb057874d859a145d1112ce89d2f6a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 21.3MB
SHA256 862a1fdbb2b11ff8ac670cef1a7d4c874bf89a4a1abd8a42696e4cb3a66aca51
MD5 2cc13a0dc8fe98e36b4561b034575c39
SHA1 0baa54b88e2a775c4501111a2192ee3ac117849f
SHA512 3d4fc440341a43e7ddf5820e55eb72c805281239c1968fba24c7487ded99ac61a31053bf6c45c0089e829d314643603d54c812ed2428a9b3c0874a23bd3dd261
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+EG:agZ2Hb9t+2xl
TLSH
T176272909FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 fc3eaaf08f47e64f0ab91f1710743d0ba9eb19fe05c99b74b3be28b46c6f917e
MD5 abd5f4b865b1e799fbe83fb9ee4debd3
SHA1 d9971b84b23cfb7386d6bc0419c760063a239d08
SHA512 7b656f2b8188ecf22e22da8ee6e5aa66aabee3d1614e09218c948d58f5d1c31e9e1c7339993a6380231d9959b1387c99aa1d455df0885cf240455c3c4224c642
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\qap`g`v~dtlq
Size 10B
SHA256 9a9d9994bba8af4ba5ea04c10ba31eadfab212784fd0b7331fe493bd3fbd7607
MD5 4e8a83a79e5287366c98ceaa74720b72
SHA1 912ad83d4d72f9b884e222afda68f0518d269d79
SHA512 cb07225d29fd084772bad8455509ae5a5edf18cdf71b9b992fa14a6e06577f5973f80e1369786456a8f40f96525f174b0fd8bff73a6fb969e39c649f2a55b403
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 647edddf174fb0422519b2792776bb7a8bd9bb7faa676cdc096202379d99b9d1
MD5 2be7d243a9e23e07bde06162876d695f
SHA1 8df1cc64c2625fe52c6421056a4399c8fd5f5a9f
SHA512 94effebb3cd744e1cbce04b38dc87ca0974ec21ea7a029d16132953a535101e2308122608ba4d20d694c6640a90f4ec607e6fa1326d38d52b09db8b38102b57f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa9e29e2f84036db7374f0bfe7ab732190584e41734c335155aaf9c969cab1d6
MD5 8b2f118f4ae8d0e8080182b3c774c3e5
SHA1 16e2f27695a5e3d3b2c426fa5e6b6f323342af4c
SHA512 8169aae05decc117f730a8d7cd0422c6375a2851a524c99a361c5d1d38e82c6978a2da89a384675a131a9d1aab36a67eeaeffd3af5960b00646e01af9260dbb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a30b4407263db9b3147beb220c501e66705128b40c340b7e4c2a0283d273b76
MD5 754b614784beb980f8fdb134980a428c
SHA1 49a515c1210b2993f9461083cc2102ec393fc349
SHA512 0622b0f0f632381b55bf2bb54a49c122602011ee45b426f5fe9bb3218eb933f4a5720ec1233a8f1580f0d9378c79039ac8810b46eac5750b6e0f49548ba443c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60da401ddc49523730200f28376e722645579c7c1f2963c01db0e4167f09fcc2
MD5 3e28cbd1e0a1a98eee09d07b7d810ba4
SHA1 ab6ba54da7de59ebc3fc6f876743d2055dc37504
SHA512 57acb0edb17d94f6d4afed7af37f7622fc04d3394bb0220b6de7a2a88b760e5319d7d49a1f547c0a2eacd14423a820891d37757ce8eca8f1c963513bce2f8121
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fb101b973b7dcaec04a80d217234ef9c499ccb1fe762d93aaace0686166d1678
MD5 19ba6ee0472d8da674d72435ba40887a
SHA1 cfce07fd340acacfa7abddfb4f53b4aad301b8fe
SHA512 47e07123d7751ed33174e6e5f0fc5898f4162dea1f0e1a83d8adaa4879678e22e3772962bd97c414860c401a231780c9f36dce3582257735bfd442b8acd25be3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 43bc7af23ddcf88347c674ccf6c45168e028aa6f8ed2d7ed24d0f8ed92b60604
MD5 2b42f90e3ee707af8a46711faf4849fc
SHA1 c083b521b44449173e1b196a5f4886906b66dc0b
SHA512 c0a0fcbed3e62c28f08d81021c93ced84d652dde2856a56e1aef404d6a5bc6382b3be0afcb33180c1949412bfd66b7317a99f7def77fb0813cd3c830058c7674
MD5 SHA1 SHA512

Submit Download

svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBAABCCBACABACBACBCBCABACACBCCBBAAABCCABBBBBCAACBCCCA.exe
Size 20.7MB
SHA256 04501c379ff227a650730917b35246e343e7fa124a205d04b5b99c2bd1473faa
MD5 6886cf4e395c0d106d2a1d30e36d07e5
SHA1 890c4b5e6e39a8094c081dd07f51eba6b2d0b5f7
SHA512 b25a18737e73f58885d485f935cfdf29b4c75e2164e3ffa4edc9073c3880497172b3dc08f8210c96d090ffa5e114355da89062a80bff49987ab15f29fcdf4076
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ER:n
TLSH
T15F272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2aaa34df393b2fb527da25928e51adc21998c4e5d925f36b8cc767cf804a59b3
MD5 46f21c2adfd89561d7014d3e65803996
SHA1 0ae7c79244505ef3f361bf5e786120d118ce4708
SHA512 f6fd0bc7bdce2fc788771765ed2f3b63de460a0c36821e1ed0a6077a931823b47c81a222383f593e5e4dcbe0046e2b8a720716f225be15d2c35e6cb7c125ff21
TLSH
T150110B28F0F58803F53768C7D719DDD2389533DA9C946EA82308811D7799C368D595E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-33-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/8-23-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2316-69-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3368-0-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/3368-7-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/4440-72-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download