caf405a2984148742d21a42bcb7536277612de2b850f2748110950c10a758b6a

Analysis

max time kernel
147s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
Size 2.6MB
Sample260831-a6767abr4x
SHA256 caf405a2984148742d21a42bcb7536277612de2b850f2748110950c10a758b6a
MD5 f3df97985e134097c7280898b3753721
SHA1 0c084a19734b4aaa7e81b6eb4f8fef9ba52a5d2a
SHA512 8a845292cb74457068045f7d55071113f3e25b33d8954d4443a05c180f423e4abee89c50df6a5c7ea0ac8a1302d7b8f5b082bb0665993e28321f08d1195a42a7
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IO:6O4q75Av7fbUhabgf
TLSH
T17BD54B2CFC9541B2D436867088D7F6FEDA317912A6014F9FA5D6830F4D3BB926C24E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
4908	svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
4120	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCBBBCABBBAAAACBACCCAACBAACCACAAABAABCBCBBABACCAAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe"	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACABBCAAACBABCABBAABACBAACCBCAAABBABBCCBCACCCBACBCCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe"	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2384	sc.exe
3376	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3152	cmd.exe
2912	cmd.exe
1520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
4908	svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
4908	svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
4120	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
4120	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
Token: SeDebugPrivilege	4908	svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
Token: SeDebugPrivilege	4120	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 1520	4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe	92
PID 1520 wrote to memory of 2740	1520	cmd.exe	94
PID 1968 wrote to memory of 4568	1968	svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe	95
PID 4072 wrote to memory of 3152	4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe	98
PID 3152 wrote to memory of 2384	3152	cmd.exe	100
PID 4072 wrote to memory of 2912	4072	2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe	101
PID 2912 wrote to memory of 3376	2912	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_f3df97985e134097c7280898b3753721_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACBCBCCCBCCCBBBCCBAAACBACABCBBAABBAABBACBCBBAAABCAABAACCACBAAABACABCCCBABBACBBBABCBABCBABACBBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACBCBCCCBCCCBBBCCBAAACBACABCBBAABBAABBACBCBBAAABCAABAACCACBAAABACABCCCBABBACBBBABCBABCBABACBBCACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe" start= auto displayName= "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe" start= auto displayName= "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBBACBCBBAAAACCCAACABCCCABCBCABBBCABAACACBCCBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBBCCCCCBBABCABABABBCCBAAAABBCCBABABCBABBCBCACAACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 880598bbed66ab5b29e8dfe2633b7e8278a4bc8c7bea151fcbfd82621ed85341
MD5 f1df0231b62a05667d64ec6645b9be4b
SHA1 4958aed9aa24085cdc578f5e7d9482e79632e934
SHA512 1f6b5a1ed8e5460ceb6c82c825ae014fe95cae68845675c7a198521e8e0e4404658e3e8c550ad30cef76f4968b99b288014c3307334d461e6f7776a21a89b0b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 c7593e029ef9cc415b5c9c2caccc169566d1bb6817932ed1c6cf9fd3efec5c25
MD5 be480c73fd0af417154a02f3b311305a
SHA1 5781f4032147bd73f5e32cfa77a5f2f4bba53801
SHA512 f5d871cbac0a3f575135e7cd1098141ec17746eb68ecbddeaaf2770b1b6050587f9d7415b6ec5bd1ea47036891f1a40be6fc7bddc278400f7e129c0bf7a29152
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 55366c3e777168218ab92bcfd2fdc103bc7e9faf7d20f5e4303caf0c0e00518c
MD5 7341874e1abdfbe0a7a24bb42e958ce8
SHA1 52b810a149bdf855a9b2a36d79f843b4f7b775c8
SHA512 74e6cce38d53e97291c80160fe2b4bfad187fd903e7250bb97d03b1dcf66d21b7b49b59cdea95c63ba2a1a108e8023eec407c96b27e490ee37e28c4514b5d2c3
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.2MB
SHA256 3b74f3f571ecfa1df5579996bd40674c84417066ed5dead50aa2eb11f81d193e
MD5 59343720a69c69a5bc9ae5e2f74085a8
SHA1 085aa5becf10925e7c3e841211079124665f8ed6
SHA512 9ff07c6f52bb51866b6656d2407cf49740bf172b4e64ec45cad81422d8fa3f98e662171fa4cc2fabfd05a19a0ab3a45f9d898c9257f2ae80f07bb65a60764d7b
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8Iu:6O4q75Av7fbUhabgSgZ2Hb9t+2xY
TLSH
T1D9F56C2CFC9540B2D576827188D7E6FEAA30791267004E9FE6C5830F5D3BB926C71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\CacheStorage\qap`g`v~dtlq
Size 10B
SHA256 2ffba26e40f8ef6250e2b13389eba1cff7667a556a77506c53758a7bdec15be5
MD5 418055b444d125ee38d122b9d135e085
SHA1 f19b46e240837deec09edf4247d5857e7660efbe
SHA512 6d91df235f14c51983938d6a630f4432cf6eba2d809e97e52621dc98ec97916d7e17287d8daea0c642bb28bebd47bc34b4b09b807a23d45dd0413887d6481b6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
Size 10B
SHA256 39ceb240d78e6cca814a941d6c80242a3dbe0895f2f523e6c496bc7f87d816e5
MD5 9b5f9b323fa521c282504256746821b6
SHA1 866cf05ecc511a33628d3dd29393a65763862fe6
SHA512 5851b1956f2c6177ab992e2192c947cc1b8fed01908a0c62864e9099a8690dc58623d2b4198b99d01e730190544df321da12bf17ebb524025065f1b9da39d119
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73f13033d25480bfc193edb8c8775d9034859dedeab640faecf9c4d11d705f5f
MD5 7bff1760f5c75e19774f50bdf5e1e8a7
SHA1 a3827235e130b59acb47fd2619125560cc60c9b4
SHA512 18b7bfbec694ecee678b97a058852b683fbd8f79094577ed0261194380fc0bd0368b773a555674fa81f6a583d9eb5c0f08145e2694a444c335d2d92be384df83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5177a8a334ded5542361179c851fa3feafbd0dce256b109d458d3a96fcc0c1e
MD5 7ae9d6d373b279d23365d8cc28173cd9
SHA1 90ce62b360389ce62a7fd2c0fc1d7bbb2ad558b7
SHA512 f84d05e203f265081dd3b2f29e7d77a246764772ffdaff51d27915904559086bae0479b5b31e79b304b29630c14b7aea9dc4796ad7b96ccace3eaaadf35b6e3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 398478f5eaa9628b919055b1d80a01be1fa3b35ba916444a5ed35e50bf1cac82
MD5 b9017c5eae925c8bcd4029ce9a756b2e
SHA1 7c8163d3265abce62c4ed8b2390203e35a474924
SHA512 daada87b536afe7cc29d2bb78f6a6ac0bf779106c52df0fe935415448cac002ac462e4197f5814c474fbcaa8cf51725ee41287f286d6dca6c312325051bdccfa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c436975bdca3a3868303f3cddde6555a695ac7d2e42e9423d34af6b0be292a90
MD5 6e527ec528b4abb7a07f3982748b0a28
SHA1 2bcab2a87683c5690a57cdd8a36cf83a397ea3c0
SHA512 c26f9695c6fa25636abb1f540b97a9e86950a09b87043dc8a7d529baf00557cdd443fbd9c38591d173a0f6f29144ff74bec6f41da1c47bfe43621ff15934de0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 00c298ffdb28c0a1a98a751fe7cb522f79cc2024003eff1291afd7e25a9b72b4
MD5 3a94d352e656d1f7b3462bef07b81bb2
SHA1 91cde0977057d121b49aae234807010693fa15a7
SHA512 dcc53fd1d2c3efef4bdff15a155aaa26fe22265a1bd9758eeaebc73da76347da62eec260b99b349f4fbd03db228c1336b077aa0ad5abb46c5fc559a6f5f69c5e
MD5 SHA1 SHA512

Submit Download

svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBABCBABCCBCCCAACAABCCAABBBCBACAAAAABAABACCACBBBACB.exe
Size 2.6MB
SHA256 caf405a2984148742d21a42bcb7536277612de2b850f2748110950c10a758b6a
MD5 f3df97985e134097c7280898b3753721
SHA1 0c084a19734b4aaa7e81b6eb4f8fef9ba52a5d2a
SHA512 8a845292cb74457068045f7d55071113f3e25b33d8954d4443a05c180f423e4abee89c50df6a5c7ea0ac8a1302d7b8f5b082bb0665993e28321f08d1195a42a7
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IO:6O4q75Av7fbUhabgf
TLSH
T17BD54B2CFC9541B2D436867088D7F6FEDA317912A6014F9FA5D6830F4D3BB926C24E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9e41cfd46034427ef0b9df16e54a59326466f6d373e2f04a672e51f7b5f7564d
MD5 c19bcbfad85795ca3e1f20f132370b16
SHA1 7c31751f08bf095197571b4f6a2e1bb07d747f04
SHA512 892c6150ebcc5279c69b184d95a6bc302819f85f744e5ae0cd3294f22826eb08b0919d94cfa24b9430e6b412ef06f5682b8a7cfac603c074ea13b17937626023
TLSH
T1EB110421F0F6CC93E672ACCBE221D9970CA4339B189C6A04234A811C67DEC35DD110E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1968-31-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4072-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4072-7-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4120-2968-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4908-78-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download