692bdd5052a139401d28bb5f1f57f37c64e67639402b2d209a3c68ec37dafeb2

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
Size 1.5MB
Sample260708-e8n9baaz5w
SHA256 692bdd5052a139401d28bb5f1f57f37c64e67639402b2d209a3c68ec37dafeb2
MD5 5a03b20d87fb559507008013f1dbb686
SHA1 b0497cf02a677d5713d936e991b520a6d6b9c1fb
SHA512 8c0a021b1125f747e01893a8760d2206cad7afe8d4ae2563e15a2f17d0b71d75f7ba6324e666385ce3b5081a827db31f25dea7045ca192c7f1ce827ca7f35c5f
SSDEEP 24576:U9+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Ze:W+Es+Es+Es+Es+Es+Es+Es+Es+Es+EO
TLSH
T1D775D590FAA90CD2EA55617D49DBD3776A3CF6E04A138F57A628B6371B13F813CC4206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Executes dropped EXE 3 IoCs

pid	Process
4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
3464	svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
940	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBACABBBAABBAAAAACCBBAAACBABBABCBCBBACCBACABAAABCBACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe"	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABCBCAACBCCCACBACBACBCABABCACCAABBBAABAACBCACBACCBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe"	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4272	sc.exe
2248	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
3464	svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
3464	svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
940	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
940	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
Token: SeDebugPrivilege	4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
Token: SeDebugPrivilege	3464	svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
Token: SeDebugPrivilege	940	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1564	4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe	96
PID 1564 wrote to memory of 2492	1564	cmd.exe	98
PID 4400 wrote to memory of 1852	4400	svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe	99
PID 1852 wrote to memory of 2820	1852	notepad.exe	100
PID 4548 wrote to memory of 2556	4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe	104
PID 2556 wrote to memory of 4272	2556	cmd.exe	106
PID 4548 wrote to memory of 4328	4548	2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe	107
PID 4328 wrote to memory of 2248	4328	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_5a03b20d87fb559507008013f1dbb686_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACAAAAAABAAAABBCAACAACBBABBACACBBABBBCCBAACAAAABABCCCBAACABCBBCBAABBAAABAAACBCCBBBCACBBBABBACABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACAAAAAABAAAABBCAACAACBBABBACACBBABBBCCBAACAAAABABCCCBAACABCBBCBAABBAAABAAACBCCBBBCACBBBABBACABCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe" start= auto displayName= "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe" start= auto displayName= "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABAACCABCCCAABACBCABBCBACBABABBCABCBACCACAAABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABAACCCBCAACBCBACBCBCBBAAACCABBAABAABABACAACAAACBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cf64af260f3794284aefa57f37229c0d3e6e3c28ba8d3c8e8affc790efe33540
MD5 2ced3c816cbc6f1e9907675048569e8c
SHA1 ae7402a9f37e3c8b1ffc7119ee050f1f5ffbf55b
SHA512 07ae84f0b027d35bf50e197991f12ae3ef607fed517c8f793bb2f0b5b54e9dd2eb1e81ecbb678434fe021a4f5a9ff44f772154da2683c60cbc088deaffc6a643
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.9MB
SHA256 ac2385761c5aaade2e532b0f7ebc1155b141973099853c8a7c8f48fd42494700
MD5 7fcae6da5ca36283069f777aede6af40
SHA1 2935578f3653bb193f7690eb17e8e06bf8b4e381
SHA512 317d0f20a6cdcb1a8fcba28acc2722eafd8c88a084950569cee5e775f8c9d1cccb542b86e1f6035c27b0ca77ffac0366f55513887beb05aa716d571b4c32bb18
SSDEEP 49152:W+Es+Es+Es+Es+Es+Es+Es+Es+Es+EBXpiMA:3pin
TLSH
T17695FB80FAE94CA2E962527D49E7D377563CFAE049238B5BA72465371E22F817CD4303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 a088f3d919f6c65ef019a7660750a359a780a772bd1bd06b18837d755e6d0e17
MD5 ee268ca61a09bada195fe87583af8b99
SHA1 32d50fb6c4d24b004a38321e2bbdf9128118e2b2
SHA512 6c6abd040ccb50d817ac9fbbad23c6e82067e8b335715f8b1429708c708021a69d6f02db2c37d58b71e289b84ec0819e5ad343a86e97b43f7f24fdd15932df54
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Adobe\qap`g`v~dtlq
Size 10B
SHA256 47fd8c0c2ba8186e42800206769af0c3354f6f33bcdb37c9bd1f3657ea1d5b63
MD5 8f6a7638f2a3e2382348047e56c02aa0
SHA1 5ad388a680b0f12220c39a42de20cce7dd85f299
SHA512 98a636a40de309fb9ba90aeec6727577e9e9e93e0e86be9e224a3b2a6259d986acce521ed08ff982b77d85e7e7c4f878aeb9c480f83529e26b50c2db0e0fa29c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 26d4251693f547317a058a0a2f0fddb61d72d7087abef88fdede436f6768dc7c
MD5 a15c21846c511732d7bcf21984f8ca1a
SHA1 b45f9ace12ada3c54a752f1caa27274e842f5f3d
SHA512 492aaef72654bbd80fc1565843718f34dca9f758cb1d63bb32e364fde1d5ecbdc5c20797aeb58263ff4ef77cf782377a6026fad3b1c1580467572d30d4bc3a22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\qap`g`v~dtlq
Size 10B
SHA256 aa562110b15d9405005c64b31c8210abaf76ad7bb6adaeda5bc3126302a36110
MD5 8446fb0abc1a0b9a0fa54d5e67dcd676
SHA1 07e4b9888cba179f61ce087f2c807581b886d440
SHA512 6a8f35c5522ac90501f8d9673cdef5e52696b2bfd7eac9fb80c399445daa78338adf5f2f37559c7545a1aad5b38ef588ffd384c39f3fb95e73d080f7d5e27534
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c1641be8f77c0cb161a4f7f4e906e4a9fa127ed395288d296b66e1f85168a97
MD5 40d6ee0de963b05110504a779dafdb89
SHA1 2f77dc04cdfbd063d39f6c0c2cd682dfc9eb7966
SHA512 559658005d49ae52ab8da3573f86c67dcb17461311e505463ad79cecca425125758fdc54b5514dde963f859aaca8205d69c727a8116860f0f7a493373fdce1f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d19f9ae9510d06ddf13e80d3a710fe49337bdebb240774514678f9f914d9884c
MD5 41ec640e4c188cc5bf0f60ebdad9a3c3
SHA1 f4c11afdffe406d8c43fe9c0a4ba0c8baaf0d3b9
SHA512 cfb3e467bd22e731a920e43bc1b865ec23c933521ef81f2d649feccdb476a2d4bb440403c1fe1afbac8dd7c51876ad6e875052db8590733cd8a3952704880609
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 68cb350f7251275d27c7f7b9dd6fe84d3aef49288a5213d6e0c76e93bd83f8a9
MD5 c2ba452bdf7f07d5fdbcd64ee10d5f60
SHA1 0fa5946541a8088fa3ea9f56cee37f6d6bde7845
SHA512 c1d3efef9e5e106366b788301d768dc47490f588ba85cbdd4381b91cad5487cf3b938cebb832491ca0622612e94325cc9f559a196833f0ce710be84f55471f97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 48fbb3e3f944cabfb4fb6b3e54643b03535a70e413052fc92fd5f760029870f7
MD5 86baa3265dfa0f4d8e686f9a4496524a
SHA1 7cd88d3a3f18de757fab9a1ef433c4ae4b427c9c
SHA512 4a8e77929d4f94883d6ffec4f092c11c5049516a787ba7c660ee4e806c75788496d1e84a05c2079aa410ddc79fcd603e3594c4befce9f1a16920f7fbec52a1ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f537bde066a456b3c919e867ef0701fe34daa0fec9c8a51b55acff8a3e6a47a5
MD5 1ae28124d4241769ddea2131282f15f3
SHA1 c4bfc7500436f8f12168864e40e449834af22760
SHA512 493144b0f08061ee63848c10f8101688737a70ec4fdea6e8f6b4fe8d176e1e006ce80824fcd6ceffa3a0c658dc80db75b50b1862cd62d9b08c865e09f76670d8
MD5 SHA1 SHA512

Submit Download

svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAABBABCBBCAABCACACACBCABBACCBAABBBCCBCCCBBBBBAABA.exe
Size 1.5MB
SHA256 692bdd5052a139401d28bb5f1f57f37c64e67639402b2d209a3c68ec37dafeb2
MD5 5a03b20d87fb559507008013f1dbb686
SHA1 b0497cf02a677d5713d936e991b520a6d6b9c1fb
SHA512 8c0a021b1125f747e01893a8760d2206cad7afe8d4ae2563e15a2f17d0b71d75f7ba6324e666385ce3b5081a827db31f25dea7045ca192c7f1ce827ca7f35c5f
SSDEEP 24576:U9+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Zd49+EM0Ze:W+Es+Es+Es+Es+Es+Es+Es+Es+Es+EO
TLSH
T1D775D590FAA90CD2EA55617D49DBD3776A3CF6E04A138F57A628B6371B13F813CC4206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 e488fc47d3a2840a4a0feecc75a4b4cd8871fde362c775b8058321977b27e0ef
MD5 2519a7977d5c6409bb93bd5ba7eafb43
SHA1 2eb58514e5321ed7ff4b6f34957e5e36d3d824dc
SHA512 1433a8163aec88887e41514d65c0a9dcbcedfdad9a4a3f8b47b6f9b955f77ff28e9ef6b20530e0886abeb7c1e27b3591a71a32532763f28f21a76431d4afd104
TLSH
T16411C851E4B5D8A3F2322CC791128F869CE4679BAD1CBA09A3094319774AC31CD59CF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8ba213b9fbbc9fb6f90d3d090af862910bd5d52548c2dacdccc5a35b36773162
MD5 b9747154771a31b7dade62c87fcfa582
SHA1 a58ce08c1a0f6c994fce18ea5784f40b48b1f855
SHA512 77cc1c31616fff53cb56568180f91813154b1b002e4cb4ef2bb7f73abee26eafc6f42396d92742738e6892f09886fa5ad78bda3122967d96ae40f9f14a35ba88
TLSH
T1C521CC51E4B5D863F2312CC792128FC79CE4779BAD1CBA18A3094319B74AC31CD59CE1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/940-1630-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/1852-59-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/3464-87-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/4400-34-0x00000000007B0000-0x00000000007D1000-memory.dmp

Download

memory/4548-0-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4548-7-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download