ab353b1fb2e95e7909a50ab9e9b8e0173e3655c13779097db0441260cc1fe0dd

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
Size 3.4MB
Sample260831-df3esstflg
SHA256 ab353b1fb2e95e7909a50ab9e9b8e0173e3655c13779097db0441260cc1fe0dd
MD5 dd040790207c305bcab741c4385331b3
SHA1 ef50620e42cfc9f719e216b8eba292df3f5c62a3
SHA512 fb81727fbb46cd6da32d75dbc80cd65744c3e027cff14941edd9a190d9c6b3e355d60109d0b5013411af80d60d199983e5b427b50880686e43c760fdd37a72ea
SSDEEP 49152:U+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EGL:1
TLSH
T157F52A09B6DE04A4E5B7617449E6C67ACAB2B8518732C7DF9244C73E1E73BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
3228	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
7136	svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAACBACBACBABCCAACCBCBBABAAAABBBABBABCBABBACBCACBBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe"	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABCABACAAACCBCAACCABCABCABABAAABBBABABAACBCACCBBABCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe"	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6528	sc.exe
2808	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4288	cmd.exe
5760	cmd.exe
2140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
3228	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
3228	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
7136	svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe
7136	svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
Token: SeDebugPrivilege	3228	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
Token: SeDebugPrivilege	7136	svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 5760	3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe	93
PID 5760 wrote to memory of 5136	5760	cmd.exe	95
PID 5808 wrote to memory of 6136	5808	svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe	96
PID 3524 wrote to memory of 2140	3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe	97
PID 2140 wrote to memory of 6528	2140	cmd.exe	99
PID 3524 wrote to memory of 4288	3524	2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe	100
PID 4288 wrote to memory of 2808	4288	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_dd040790207c305bcab741c4385331b3_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCCABABBCCABBCAABACABAACBBAAABBABCBAACAAABCCBABBCCABCCCABBACCACABCBABABAABBCCCCACACCBACAAACAABABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACACCCABABBCCABBCAABACABAACBBAAABBABCBAACAAABCCBABBCCABCCCABBACCACABCBABABAABBCCCCACACCBACAAACAABABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe" start= auto displayName= "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe" start= auto displayName= "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBABCBCAACACAABCBACACACBCCCBACCBCABBABABCBCACCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCABACCCCCABAAABABACBBBCBBCCCABBAACAAACBBCCACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e237edd094b5150c5de0fb522a4e2a99e166de2af30e8233bf3caf73528a0f84
MD5 f422f68333190370b761fab4829ecde4
SHA1 25212edb829733bfbee07bcaff568c6df543cffa
SHA512 bc9e35468f10b601c5163075f38690955d0b7b891aec131b36148ead5356ce27e5703dd34339954b2a3ab6415db1e800a29be4c2e250d446aec7ccaf1e0e13be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7eb4d1da38b4ffa458620b8fb9791bd2933b8d610d21be3217790d0d9c0ae1ce
MD5 cd9c80a36cd8c22833e870e53d3eb542
SHA1 8cdd69fb6615bf2601820c493943c16f5ddfc601
SHA512 3c68cd38281a95e42017afdab857e3cdd9425e3e57c700099ad833e7bfae8a1f2206f59c79fce1663f92536443eda25a5c177b6245faa907421c105ced5a5833
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.0MB
SHA256 f6769c583c7398efff1d19da8456428aa615d754be453dded67d395ec7f00462
MD5 84fa376f96484e9985d59c3d341c1382
SHA1 da4d42732acfc7a182c72a363bd23ebb2b756668
SHA512 23a757014b16255fb1430f39197028c00ec8d0b9a6739149e5db6d2d9095a2abc7b6d436b929dd440c3bc01f38c16da501f6aee1c536cb9900cdfec584b992f9
SSDEEP 49152:U+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EGD:EgZ2Hb9t+2xO
TLSH
T14C165C09F6DD04A4F5B7617589A6C279CAB1B9504732CADFD284C73E1E33AE0AC35712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\qap`g`v~dtlq
Size 10B
SHA256 4599c1add2c1632346f8f61869057719735b63e5973dec2bbbc7a383e267c0a7
MD5 ea42e54748e417b438714a9805354a34
SHA1 5d1bb13130ab446e8b1d657c845b92525b1f68fd
SHA512 ab1bb2802909a6bb24fbed1dee2ca85f472dbd3508af3d05f4c43588076c2a8eb8317f0a7e25b4d34face73842cf2c22eed9720aca8f5ccf72be81b41e41afb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\IECompatData\qap`g`v~dtlq
Size 10B
SHA256 2955c223f237d459f1ab410ec56631c1afa4b2f7225e1eb28e28fb59beca0352
MD5 0590c5a9e9140695706c3d867e484dd9
SHA1 71b6120ed7f145c0f015d92bb22d2fc91dd40b5f
SHA512 7ec17a098ad56167c092aadf9845f309a0b2ba156ee165c7a7e50de58e4c656c9a05e33e8805f20ea6880b9866a430067f22618d760e92b8d10642bca44a5ac2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\qap`g`v~dtlq
Size 10B
SHA256 9e2ead15031bb1ec37b733862d38deefca93925b3dc179441d8ba6dedaf597e9
MD5 0f64845dfa435bc60b3a73975913d456
SHA1 24ae7844c231ae6061e37345a35ba81e6f569128
SHA512 399a2da25850bbfbdc6c3473d8f629e6f293122b981904d23fc681cd0320c8e64e77c5e1c410be9a1dc81ca0bcf133791d37f5759e81843aafbc6b2daef93f23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 839cb9726bd24ed7083313ef6364f7fd4f12908a66dca0e992b38565243cbf44
MD5 18659a510a3758116726082b100db801
SHA1 a45ffca5c2ba70a2c3d6fb5fe1c9dec51e919e48
SHA512 bb980b7e2432d5bc84eab14fe8ec08df15f8e27e3b1adffb5a5096cf61db7f50dec408dbd41e493974a787b7663586f0128005d8afb592a1583aab009a6d1e20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b135284bd03fd430c6f65bd898bff48310f19b59ede53873f3c47691a029402d
MD5 4030541f6c3dd87fb174487f7dd92ad7
SHA1 05d47dae48c0aab6e6a38299ed7de80d60b2985c
SHA512 9ff69fe919b3ad671928fa8b51174aff956dcee6d5fe728d4aa128e91b5d4d3a28089276ec452364c1748e60825405e521e50ab83cff49523aa11c21841c6361
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7d1438dbe011ca908a2f6e25ddb0323ab5f13da0653708e9eb6ca7f0adc51af
MD5 0d86db8ef4a18fff07ca5195890656e9
SHA1 c4d5c6e6d7f32668514fdc29f94b1ae7f676cc13
SHA512 c4a0ed14787a43c5d03f6892f0570b2c88b302a3fe4a684275840025c9f4fa1db0d1f803d6a7a1c1bb4474296b1253b79de84a13d654738d25852ab3d0277cf7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44102f9d0e6abd6a8b289321182962345cffafc60e75d7a8f7c61888db66e02b
MD5 116984630cff91d7ef63328f7ac480ab
SHA1 8d0afc71cd41ac90763995036deb6002c0456c3b
SHA512 196b88ed347b73af3a04daadf2551f868a11ef4546cd9904233d0f97639bd3bdaa93cd53639f1be2b3af6160a50e0e74ad30d32238a810f0eb716db7bd5b9a16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d952b163f729f31272961bee426de9613781af07e92115532089fd8001650dc
MD5 69c163793fbaa3d51cb091727f939eb5
SHA1 57977957bfa45cfcb19bbb9921f30c34addfee84
SHA512 f5f9739ac1b4101a83232e96221ad3f4543413f383b3cf4c97532b380ac0180bf71323f89a6e7cbb4317cd3788819140ffbe344e30e83eaec538975abb5dc44b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b54afc4f9591e8e0c513fb5492da02271bf9aeadba19f632ecadad84ad8f39a
MD5 eca43dec397b209c8cca34683f004506
SHA1 cbaf6529cc739f1ae0e3b09aa77110f9e62d5145
SHA512 0717625e033f39a97521e369bc10e1c9e570f63ce2ff7597e7012ce3f114cf4f50459aea25533edad1ab7a9c5d656c43fed714b1e71c9e3f63b9d2f050aed676
MD5 SHA1 SHA512

Submit Download

svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBCBAACABBBBABBAACABCCBBBCCABACBABCABCABABAABAABACCC.exe
Size 3.4MB
SHA256 ab353b1fb2e95e7909a50ab9e9b8e0173e3655c13779097db0441260cc1fe0dd
MD5 dd040790207c305bcab741c4385331b3
SHA1 ef50620e42cfc9f719e216b8eba292df3f5c62a3
SHA512 fb81727fbb46cd6da32d75dbc80cd65744c3e027cff14941edd9a190d9c6b3e355d60109d0b5013411af80d60d199983e5b427b50880686e43c760fdd37a72ea
SSDEEP 49152:U+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EGL:1
TLSH
T157F52A09B6DE04A4E5B7617449E6C67ACAB2B8518732C7DF9244C73E1E73BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1138e793f548bef866ffc691141fb44b0a49cd419dc5a08c50fb35a0aac77205
MD5 c63e880c32dda33f486e7f1f10c0fdbf
SHA1 bf8db9aa6561fd31e6e1a64b6af0df15ed773039
SHA512 857e72f0ffba49e4f7b179d802e38b16355a0f6c55451582cc8cb5f701b77eea0ab2207583faa8e3f904e81578d40fc778320336231d36e99feb4897d0f2ff3b
TLSH
T196112062E0F5CCA7F832A88BD3259BC70CE5775B689C6A546349811CB79AC37CE150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3228-70-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/3228-1461-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/3524-6-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/5808-32-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/5808-22-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/7136-71-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download

memory/7136-2018-0x0000000000B90000-0x0000000000BB1000-memory.dmp

Download