7df1db93d8235583175a3f1093c16db89b29d2b051c28d5e36dbcce0d5c175cf

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Size 6.7MB
Sample260903-zaangsfk4w
SHA256 7df1db93d8235583175a3f1093c16db89b29d2b051c28d5e36dbcce0d5c175cf
MD5 e20c58fde7516af89037d6d11827ee36
SHA1 3ac50ebfb37212fdb652280523ff549c06f3cd45
SHA512 588db315230a18915ce8287be735e418675cb4604cef6c52d09fd1274163fea1fd170812b610ae551f94e02132981b340519d0e0b455053cac64d72a2861803e
SSDEEP 49152:U+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+E6:H55555L+4j4
TLSH
T188665C08F58744B5D86B41B04D9BD2BE8531BE218B118EEFE788CA7FA933BD06534B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
2952	svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe
4524	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCABCCACBBBBAACBAABAACBCACCAAAACCABCBACABAAABBCBCCBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe"	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBBCCBBBBCBBAACAACCCAABCCABBBBAACBBCBABCBCCCBCCBABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe"	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2028	sc.exe
5584	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3532	cmd.exe
5900	cmd.exe
3756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
4524	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
4524	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
2952	svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe
2952	svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
Token: SeDebugPrivilege	5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
Token: SeDebugPrivilege	4524	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
Token: SeDebugPrivilege	2952	svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 5900	3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	92
PID 5900 wrote to memory of 2824	5900	cmd.exe	94
PID 5684 wrote to memory of 5912	5684	svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe	95
PID 3156 wrote to memory of 3756	3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	98
PID 3756 wrote to memory of 2028	3756	cmd.exe	100
PID 3156 wrote to memory of 3532	3156	2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe	101
PID 3532 wrote to memory of 5584	3532	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_e20c58fde7516af89037d6d11827ee36_amadey_elex_hijackloader_luca-stealer_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBABABACBBACCABCABBACBCACCBBBABCBCAABBAAAABCACAAABACACBACCABAAABBACBCABAACACBACBCBBBBCBBCACABCBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACBABABACBBACCABCABBACBCACCBBBABCBCAABBAAAABCACAAABACACBACCABAAABBACBCABAACACBACBCBBBBCBBCACABCBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe" start= auto displayName= "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe" start= auto displayName= "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBABACCAABCAABABCBCCBBACCCAACCACBCBBCCAACABACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBACAABCAAAACBBCACBAAACCCCBAAABACBCACABABAABAABBCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fd7ae9ae4cd6165def77dc0b010c57e1bc0a952256943a3f88d46e7a64b00e42
MD5 55ac00906a6e4f864ddaea2fd0b9b0f2
SHA1 8bd58a532c7f939d495d22056c86e4eae787c0a6
SHA512 e554ddd3e65f153d32a6a14cd413bdd40cb47363b7112c390475af6c3fa4809e355d71eaa81273fce8d025c6c7c46292aa8aca5bea61cbe3956370dbe8983eb9
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 7.2MB
SHA256 d4beafba844ef193cdef4a1b4e3c14499f89527dfd613f789406510a9cf90bc0
MD5 1fcb7342c31548560295ec1a4a578d26
SHA1 40eed43e6d2a1e922a0d6e1d699b434f57c1d825
SHA512 474ba16999c7aed7929a7049d75a569d25ddb41357646d55085cf1ba1eac2a3672d20db7846257a1838b7c7ca3f15cca861a56183fbd6ae4e872eb6bf1f0c11f
SSDEEP 49152:U+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+El:H55555L+4j3gZ2Hb9t+2xD
TLSH
T120766C08F58744B5D96B41B04D9BD27E8931BE218B118EEBE7C8CA3FA933BD06534716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 875dfedb681d142abbc9895c71aa68291c0d6be14da43682234e694f99ee049b
MD5 861bfac5435a9a3950ce53cee8384a88
SHA1 26c8fdf5907919c1dc348e7e14d309583bb497e3
SHA512 98f88f336e9939e842a2e73f89fa206447f21d13996f51c318872081ecabf2f0997d80e7ab954700146d8bc1cf43de8fbc1298fa191af575d00483cca88a58c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38b3ab5394d06eff3f5851769c2869c2f2876cf812492b76e5003e724a494ad0
MD5 42afbe3fc2e591a3d13a1473124b539c
SHA1 ece36c8179d2601987e6c9e9be657c846eda885b
SHA512 9015cf393d348691591294cdcea5c334cb322f1caae10890bac67c1d88c61b83a0a463784f0257069b22b901a448b12580bb698a2ee96c76d7527d2eee08f331
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bd2676dbc3acacdbc866a8c98d5e1a0a6b033a32e50b647adc19f1fc886e31f
MD5 6916c98dc2554504640341fbb70d5143
SHA1 1379de14e357d3bc05ae72ae2484db12904ea3dc
SHA512 a2f82b5730c1bb7f8061dd06bb699c17072af0a1f3c22d133eefccb8eba4b81500ef59319e60107ec2026035f517b1190ed7bbdc190eacf6cf8a6beeaafcf971
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3590d7d76fbde36fbd7c1cd15adc4b597bb1be0a00c684569acb9197611daa88
MD5 5ce0dbac1b31ae853949f985f087f2e6
SHA1 86420b0837d43fc0ef93bca06e1c833ef7fd5ba5
SHA512 c69b26263d6ed8abc8be88a0bfe80c9d50975c6e3e7e4801d491da74c4e423b3d28527af4978b6b1d861c74473b4deb94fa40b53147dc81a47397a8d40231c18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce4ce4ec977976db9d9055a99de64e86ae1f446358c1c586194d2e9219345ee0
MD5 959b2b96f8df7a5929f21a9bf8217fbe
SHA1 8f1ca6361c96a1df70b26bc5b3712b8995b27a11
SHA512 68b1dfd56408416620136b87d09cb858f7d424ae0ac836d6b84159955406cdacac60ff18ca8ae94bc722883daa23caaa430d0f3055cb93a6e0e229d10c43b200
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92b9cb172f5799cbf2c3b7b962bbba798b04a4d24e4223e6918488bde52c88dd
MD5 5e0f6285c6c9e1b7479868b43842affe
SHA1 4a2194308a097754d05ff2bbda7a9ed9f5c8e328
SHA512 cfa2e68a94fff3eb84f1e56c342de2146c9ef034e031f1375912343d41a97e6432374d9009ae1b0257f5bcbe8585987c1980346097c0569f19ceafac01b82338
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a24e082039f3e54291365f1f9485b35cf143b394586566e8334eea7f80f14b3b
MD5 38cfc0b0eefc3197a6a5b643ee88f443
SHA1 ed4cc771f2309a7c757a8156c82802b7fc991ea4
SHA512 7c26f6fff3466565324e28f1a30dd80bc6b5fe1b8ffee7eb322e5101ff0c006c388cc052a7db662a920adcb56dbe46b64a268d1d26afaaff159858d4df5299b1
MD5 SHA1 SHA512

Submit Download

svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCABCCABBBCBBBBCABCBCBBCCBBCCBCABBAACCCABCACCACCBCBB.exe
Size 6.7MB
SHA256 7df1db93d8235583175a3f1093c16db89b29d2b051c28d5e36dbcce0d5c175cf
MD5 e20c58fde7516af89037d6d11827ee36
SHA1 3ac50ebfb37212fdb652280523ff549c06f3cd45
SHA512 588db315230a18915ce8287be735e418675cb4604cef6c52d09fd1274163fea1fd170812b610ae551f94e02132981b340519d0e0b455053cac64d72a2861803e
SSDEEP 49152:U+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+E6:H55555L+4j4
TLSH
T188665C08F58744B5D86B41B04D9BD2BE8531BE218B118EEFE788CA7FA933BD06534B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8f24be5f441a3299fd63d1e9e9e7e5955c6eb8bf55a01851a3dba55916924779
MD5 77f7c01bbe3d6b78777b07684a98bb8e
SHA1 edfb9c353a4e9b95ad7e0d8a06951f6bd2bdf6ec
SHA512 e728d8e7aa471c91c26b84cc054c7b267109faa3c4623ba65f42687863dcd72a851f6afb92d591eb05edfff74d40006fe391978d49dd20ec797ab74b5ff0b926
TLSH
T1FA21AE65A0E5DC23E0226CD7B626DE970CA43F9BAC68EB5423180219AB85C378F154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c4514b1103cadb06d4eb12b639fca33c2c620ff39e1ad9de0547d269354e3825
MD5 33064e9a656eddae242b1f62f2620332
SHA1 935b9f5a3c3021ffa27d75ead27f24c33e144779
SHA512 06e86cf1cd3cfcdc87ebec6eae203ba094a9aeeb85817250161a8029f39a70281b1742b42f2eb21a2a8f11e5e998d9013909bc84e0540fef90c3b4f52f7e78f6
TLSH
T113119455A0E5DC27E0326CD7B626DED70CE43F9BAC68EB5423180219AB45C379E154F2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 f3df8f4f466174cd783670331375120a4ec8d05af6df827100e6809e3d4e011f
MD5 80bfa096fd44d09ae61d004ea0f637f8
SHA1 890ef15abf25a3cf4b857a8992348572a8301ded
SHA512 4467444cf47521bcb2e46d6781fafc5e2e35e7e7082a83df445910aec56b06b9b818ff0b86e7e5bcb96048e378758ad450d59776527bfeb3f07fd924114551bf
MD5 SHA1 SHA512

Submit Download

memory/2952-64-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/3156-0-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/3156-7-0x0000000000740000-0x0000000000761000-memory.dmp

Download

memory/4524-75-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/5684-33-0x0000000000090000-0x00000000000B1000-memory.dmp

Download