ef1387f302eba5664516ef36ac72087374f1c9e7bc1f2248eb3abc671a3217b4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
Size 4.8MB
Sample260831-e9588adl2s
SHA256 ef1387f302eba5664516ef36ac72087374f1c9e7bc1f2248eb3abc671a3217b4
MD5 c8585273e216c815bb1eed2bf68df2ca
SHA1 3a8d97fd32844a6ee9caa98b2b5fae98a9cd6fc9
SHA512 c55d1026c1b939e1d16ed151b246f6f981a027857df6798a94062e8fde3d23635f53d172b6f34ab5167c565430381b86c6f5a80f2c8b20bd5b4d8960c491f151
SSDEEP 49152:U+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2em:W
TLSH
T181361A09F6DE04A4E5B7617449E6C67ACAB2B9518732C6DFD244C72E1E33BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
4388	svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
592	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCCABACBAAAACCABACCCACCCCABBABCABCCBABABAACCCABBAAAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe"	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABBBBBABACCACCBAAABCAACBACBACCABBCCCABBCAAAABAABBABBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe"	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3680	sc.exe
1992	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4916	cmd.exe
4552	cmd.exe
3132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
4388	svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
4388	svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
592	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
592	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
Token: SeDebugPrivilege	4388	svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
Token: SeDebugPrivilege	592	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4916	4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe	112
PID 4916 wrote to memory of 3460	4916	cmd.exe	114
PID 2016 wrote to memory of 4008	2016	svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe	115
PID 4008 wrote to memory of 1736	4008	notepad.exe	116
PID 4348 wrote to memory of 4552	4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe	120
PID 4552 wrote to memory of 3680	4552	cmd.exe	122
PID 4348 wrote to memory of 3132	4348	2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe	123
PID 3132 wrote to memory of 1992	3132	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c8585273e216c815bb1eed2bf68df2ca_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABCAABACCCBAAABAACCCBACACAAAACBABCBCAAACCCBCBACABCCACCBCCBBAACBACBBCBCCCACAACCBBAAABCCCBABCCABBCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCABCAABACCCBAAABAACCCBACACAAAACBABCBCAAACCCBCBACABCCACCBCCBBAACBACBBCBCCCACAACCBBAAABCCCBABCCABBCBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe" start= auto displayName= "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe" start= auto displayName= "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABAABBBBABBAABCACCABAABABAACACBCBCAACABBACCABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCBBCCAACAABCCAACBABCCABABBAACCCABACACBCCACABBCBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 0f764a5bb267a4bbe577e00f788b0e34d568d1270045917760469e150e7df8bc
MD5 812a22f02f762dbaab03dbf960572ab7
SHA1 36dda58d41af0938bf5069d3c64341d084311a51
SHA512 ed5906d66692b1d2c49f427dcc05fcb6b88fd0d3a78b00643c8b855e278f878f46d0424b95a7a5c595d92b6a124e1e4d340a1fa7428c84445390877f14b22533
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 5.2MB
SHA256 3a3c913087b5fa36331dd44d1b65fedf04f642be9564ec6b6d231daa028007e2
MD5 211da55acee0c652195d0b0f7b057274
SHA1 a4dda39af74277f279e674d666876cb0994fd464
SHA512 dd361cae8a323acb367087ef104adf601feb9cbfb61591549cfa9673981c872acee1506b405f0a5635217a195b25707dfe243a267936ea893815a46f73d76444
SSDEEP 49152:U+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e6:BpiV
TLSH
T1C7463B09F6DD44A4F5B7617449F6827ACAB2B8518732C6DF9244C72E1E73BE0AC34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 30cd1898ecd886d6688a1a30e49e5b1ac704b80abe9dcadd7df8487b0841432a
MD5 1fd1a5320be494df7189e7253bc08a58
SHA1 9af8de90bd2c6e5777f9bb07fa92d5099adb37f5
SHA512 99267d9283b9b265ddceb52736e7b0a55d6bc0fcf29af05e991415a3a9fe1ca3dfe9e269bfbcf14fdf19f10174139ac1dd966b5f3a9db5147f9c64eff1babc6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ca-Es-VALENCIA\qap`g`v~dtlq
Size 10B
SHA256 5bb752c10514d5bd7546d14d56dbd8f750be6b2b91935bb6f287f9516f570a22
MD5 b9f5deb33e08300a06b7707c4f6ed88e
SHA1 e6b9c4845a70d11f97f1553138e126fa5f8a4143
SHA512 28a41123048abb05fc88f7e54ae4675e60545afd23df0aa57a419e072e6371d26a952e0ea9ca60688b562ffc7999f3e53dd4abc7817e171e2e6fed498a184547
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6212f4001a5ecdc586ed9cdd61a5cdba63edb9dda7095faa9175f5cddc277c1b
MD5 8edd72f9e37e7746659d5473bb0d8826
SHA1 6d07db14d90cd271b208a0735256d1a44d810a35
SHA512 3525332c2269686fae1aa80fae5aec7c43c872e4ec58b21c84febaea610d6d4748a1d6c2d09cde587687181620168774cca030a2ee6f5240e65f24fb225b507c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa895a22012de9fd995835d05fc65fe7b4a50304006a41c0efc6117ca42c5f37
MD5 e8bf955ee211832eaef6dad58bb5553a
SHA1 efa78fedbb425595c259140135e2b97787d634af
SHA512 a0af7ea41fa2a3fef3bdcfa35e96069582d65208a18dbe2f92a7ca592b57dbf5f6a8c65099c44b697775d0ff0991fb10ffdd5cb26b5131b5a3b8f7289cb92107
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1c43aa06cfd45f443084766355c1c7e90257263df95ac933f6f2a9a5872c05e
MD5 3cb4f1684ba65d855539e5cc17008ca8
SHA1 38065644fa57eca5fae3175c5543344d2c666064
SHA512 98bde02c8ea883394a33a3e00f575fedd353fcda927f2c0dbe0aa6498b4e8609e29d1b86211cd6b7c82b7ed8fc7fbf12781ac3a70b823ac3227b205b3b41c6a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d84da88e26c562b098940c38f0903abe4d9bfd64664d1fd319d6ff75e0f0f4f2
MD5 3bb4958948f4a8c74f25aa74a5fde050
SHA1 3c093e7f0ecfecc3953f36029f49e5a09ce0d8bb
SHA512 3ff9c63f777c0c77b81286fda5378d0893a7ca823ad7202bacf0302b0c0944509bd048c7102949764276d4f46e7f5ff8f657fd440a820fabdb192c4e8f81ef8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 839ad61a0598702f5423431585a6ea0727b20c8a454a6d53219989e176d9c591
MD5 597b836a1b65ba9dd561286fea5514ee
SHA1 5267b4e53dad1900560610cfc91e770081020629
SHA512 a30fab7e78b8993d9638bd0d8f5707ab7cffe4b589417147a67bcfcb24d6a0379e9dca10ed76d7738ddab149a80bf11341bbd618f8a0fcf4f2c014397b1db475
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c46f107a997990e918ec37a2d4814e8f8d32899048cfaf74ea4abb3ee00cdf1
MD5 20ff972462807fd66be86a157212da4c
SHA1 72d9fd9e2ca2ca05f0c491c316234e77976aabf7
SHA512 b0bf17daf40fda1d8f8ca76776db670cb90327bb4cf1b5f1877b07e3935ad7654b0d506f3d59cccef9e545096832a027600ac7dcd5d9d7dce0093b528ad3e136
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1863ceae8728a7739951e26e57874c5a074c10b78e75e9efbda6f1884ea34796
MD5 5b976cce3f720110ef7f8e99dc6513ee
SHA1 5050a7af77620306aaf9b52aa28b185afde17604
SHA512 4cdc54e4fe2b2903664257bf41131b4fd0072cf00538e5e204970fae4f3365a1aa94bd38c965d0ca963fb7c029c7f9c7ac4fdf4e7d6b852f7f131a2234d153df
MD5 SHA1 SHA512

Submit Download

svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBACBACACABCCBAAACACBCCBCCBAABBBCBCBCBACCBCBBACBACACCA.exe
Size 4.8MB
SHA256 ef1387f302eba5664516ef36ac72087374f1c9e7bc1f2248eb3abc671a3217b4
MD5 c8585273e216c815bb1eed2bf68df2ca
SHA1 3a8d97fd32844a6ee9caa98b2b5fae98a9cd6fc9
SHA512 c55d1026c1b939e1d16ed151b246f6f981a027857df6798a94062e8fde3d23635f53d172b6f34ab5167c565430381b86c6f5a80f2c8b20bd5b4d8960c491f151
SSDEEP 49152:U+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2em:W
TLSH
T181361A09F6DE04A4E5B7617449E6C67ACAB2B9518732C6DFD244C72E1E33BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 76909c6ca86cb2980418da38bea94ce7296a4dca64018d16febe41f5fdb43b41
MD5 2a23539e06c235f23cdab433bd625ee2
SHA1 bc7502d823c614b0c7a3fe09ce6c3a65a3876cce
SHA512 394c05f38fca59e047c19bbaf0bca40659fea3c635dbde78f5ed7a483c023a3c1f434cd2b6b8996809cfe1c420339c610d3f7cf8dbd6206da0d6b0f6932e94cd
TLSH
T14F112BA2D4D5D8A3F43628CBD129BE8B1CE1339FEC585A54232C851C7B85C32CD558D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 019d8022478bfe89d22c5ce34c63d5123115f8fa2106152820c2f09f1dbe3f5c
MD5 96ede1f03d82fed8459fa412e4c0c0e9
SHA1 b11fd05eef1f03810cb4b56b553ff59acf9ebe62
SHA512 fe5b8d53463034f9a8895a6d0958fd2b3838ccf4bc92f94c917775ea683d231eba8e0ad15935700446202ae9d93c5dd2331eb2123187cd199b423a057a08f79c
TLSH
T1EC21F6A1E4E5D8A3F43628CBD119BF8B1CA5379FEC5C6A54232C85187B85C328E558D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/592-138-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/2016-36-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4008-60-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/4348-0-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4348-7-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4388-81-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download