26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Size 991KB
Sample260814-d589msfa28
SHA256 26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa
MD5 a49de439406f4fb1ee412fe94acc73a5
SHA1 dc80c16f9d87c06f34ed82c43b2a31debeeeaded
SHA512 3170a853a3ff18c16af108ca3117b5fcb2c2ab825677602100d99d9bd5742d06e924e7e7212a57d38ac485ed8e528ce61776fcd9df75fbdd5f3873a5db0a40b4
SSDEEP 24576:m9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0O/:U+E7+E7+E7+E7+E7+E7+E7+E7+E2
TLSH
T17D250909F94344B2DD2A50F04CCFE3BF8A60BB2586124EF7FB4DCA5BB522FA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
2296	svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
5724	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCAABCCCBACBABCCCBABCCAACCCCCBABACCCBBCBCBACACCCBCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe"	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACBABAABCABABBCAACBABBBACCBBCCCACBCBBAABAAAABBCBACCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe"	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5424	sc.exe
864	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2364	cmd.exe
3796	cmd.exe
4800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
2296	svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
2296	svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
5724	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
5724	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Token: SeDebugPrivilege	4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
Token: SeDebugPrivilege	2296	svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
Token: SeDebugPrivilege	5724	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2364	2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	92
PID 2364 wrote to memory of 3612	2364	cmd.exe	94
PID 4156 wrote to memory of 5688	4156	svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe	95
PID 2164 wrote to memory of 3796	2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	98
PID 3796 wrote to memory of 5424	3796	cmd.exe	100
PID 2164 wrote to memory of 4800	2164	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	101
PID 4800 wrote to memory of 864	4800	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBBCABAACBBBCBCBACBBCAAABCCABBCCCBCACCCABAABBBCCABCBCABAACCABBBBBAABBBBAABABCBAACBABCBBCCCCCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACCBBBCABAACBBBCBCBACBBCAAABCCABBCCCBCACCCABAABBBCCABCBCABAACCABBBBBAABBBBAABABCBAACBABCBBCCCCCABAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe" start= auto displayName= "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe" start= auto displayName= "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABABABACCAACCABABCABCCCACCBCCBBBBBABBAABCACAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCCBAACBABBABCBAAACACACBBABBCACCCBBBBCCABACBABABBBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e6bf666e178fedb5df73513249ec4dafc7fe6bbc3c0d310a8c444843582763ca
MD5 01d63909d56c3e42aa7db429d10904ca
SHA1 b0515bc9b7bb49aa1118bfb003f577334d4a7335
SHA512 cd393fa6a90aaff08ab08434e68a8cbe75d68cb352c63c46fab13b477180498c61375b32544c4002478323eb5fc5f9d66f33a2818970077e29542af1a4294a56
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.6MB
SHA256 2a1c4eb5d9fbd5ae786d9b52b9842d874d9ac4ecd8ee435763506dcfea758e54
MD5 84fe1473d339e5266d65709175220673
SHA1 f0241241b253536751179a874d1ad33cef5af666
SHA512 c036e9aec61b86afb36df691c75b891ae4dcfd29173d2a8b04ee50a4169f28ac3269820c8080017312d827673626256d099b59e47d18245c649ec4a668ec070b
SSDEEP 49152:U+E7+E7+E7+E7+E7+E7+E7+E7+E5gZ2HbbZt+jqpQ0CMg:sgZ2Hb9t+2xg
TLSH
T1E3757C15F8434072DD6A01F14CCFE3BE8E64BB2487118DFBE78DCA1B7932AA1553A256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\fil-PH\qap`g`v~dtlq
Size 10B
SHA256 f0b57851ada398496a1fe09d1cf20d12c5dbb2429cef6af40cfda73ee2a6cc23
MD5 bea86a2fd9ff103777c4c996b29ad22e
SHA1 3b453b2590680530e1fff744b92ed0e11dd82617
SHA512 83d01bea119a02a4e80eefa330f45dd065d377092f73354d592bfb5b41a71bd4bc68ae3fba670f7901d3122437ab7d00256f4b353b6688b96c3d14c0bbe1916f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\SwitchSubmit\qap`g`v~dtlq
Size 10B
SHA256 b76d4d8ebd2e8e4fa97c5ce7bd7c7bb52531088bbc775b75da72319eee74b746
MD5 ed11f6e463c9c64621ebb670ffa00ab5
SHA1 c7db39f9f425b71863251da8f62b656150a69c59
SHA512 c6a2266cb7ed0307fe1b60664de3e053232c6c2113d82e24c5040e9b0075b6826234fcdc03b4b8e918b25d30dd3911b5b0068e23b701b3f8bdc144c198d09170
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9948f466f9e12a19fa096c04eff13eb95b842facb69c785f17ab38da4d666ca4
MD5 5b6a3e568e9b638064631ff75d1aac37
SHA1 24eca6e7073bbe954b35e6441e935c365ef8eb6e
SHA512 c80f914036b9d92ffe16b472225a5abe59dd487ff4a411e1179090c3979188c14e655bd0da639a0b052dbf944109288dc4c53c583ed28ba7a8131e3cbcd8bce0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1eec36ace66044aeef8ad32f20d528c399faeab2a6d47a98866fda8ad01e539
MD5 cfdb0a967ee12ef31f6e6bddc5aea5a2
SHA1 d830415e3716e3f0b87d52e8a9ab217f17712a2a
SHA512 86b16ff30e8b50aca9edde0b99b0271a5320c438ddbaa8336352e297083c0e8bd4a2f23d0227cc5bb1b04d9acaf18d8ab3b273fab43362cb876d6bdf495aad98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec51cfa5169660390c34f8ba0b9cb17c38675c3d355f3f51881ffa3ccb3acb88
MD5 b807a7dbd01f7f478a2eb8e5bfbfd70a
SHA1 a740adc6d7d793704895088a0065e650a0ba8cce
SHA512 ec1ae735362255a3254a2d7aeddf758bba6ed0930bbcd77f2714068d508ed38065fa484aa5dc0a6eb60aee86631e69c7af4008d824bdb21ed9b46db09fa6e113
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1430207bc342864b96a2e7e0f30e977374a87daecd0242791b6aa50c078c6ae4
MD5 e562859bc39afe98976ff876d02f22b7
SHA1 f1e9abac6c0ece719615017f6aec48f1be9eca16
SHA512 9c96a1c48ea452bba9a2367326ba7cbe014661f1c64766af0323dc809971afc2f8452f8ee39e06597a0d7fd9572d9c107557daf635b32fb38df20436ccd0851b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27282107998d424302aa27eb59416e6a52c9c1bf24c5a92a51cca0f0818965f7
MD5 6eb28413f23aa89cfb104c4954a057c4
SHA1 1cc50f11b94dd33b686259b16fb93c4e3eed2e1e
SHA512 1697a8b5bb692d90ea5f7a38cd1ef5e91c390db25147766b7a0a91f7fdb1e8f06afac784fdb5550e9a4163ccc77aa339e97975b22f9edc4ed17a05b3122a01cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba58abfeab8d32162684a66dedb2d0b55109026ed0ede31860ecb715b95b726a
MD5 8b7cbec2e8c67205ec243b8ee9e0fd95
SHA1 3fd537e78b132a60fa9f867ab66ab926a8655bcb
SHA512 fa12d06e0e77f4cc290923f07151636f2db1689d48861a765819bc740851a20c2ffad4169f4d9c2c780f53540c7206d9a10973ec72dc5cc36fa6af1aa4d0cdde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Videos\qap`g`v~dtlq
Size 10B
SHA256 12c18957ebc90950593acee4f5de69a3a4c29dbd9587f7b546d059d3028c117c
MD5 391a15dcdf6d4e771d37b31d4253168b
SHA1 27c6b8a5a3ded81f179a589ef9f3f3f86b54c62a
SHA512 4de0b432e0de80d17d7b28afb5d6d0d10cf4eabe3f56c8bf7d29b0122d50905c674500c02b6e20da9cb1b78df493bf5d9dcb42ad300e67ecc684c5c49c582885
MD5 SHA1 SHA512

Submit Download

svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBBBCBBACBCCBBBCBCCCCCACABABCABCBCABACABACBBBACCABAC.exe
Size 991KB
SHA256 26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa
MD5 a49de439406f4fb1ee412fe94acc73a5
SHA1 dc80c16f9d87c06f34ed82c43b2a31debeeeaded
SHA512 3170a853a3ff18c16af108ca3117b5fcb2c2ab825677602100d99d9bd5742d06e924e7e7212a57d38ac485ed8e528ce61776fcd9df75fbdd5f3873a5db0a40b4
SSDEEP 24576:m9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0O/:U+E7+E7+E7+E7+E7+E7+E7+E7+E2
TLSH
T17D250909F94344B2DD2A50F04CCFE3BF8A60BB2586124EF7FB4DCA5BB522FA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5697eceeb8f85c48432ce22317a4fb50b69b35291d8ef83b0492c5ba3463aff8
MD5 27b9a52d7a0629a156ff04e6e7a88004
SHA1 55ea8ac8d27b88cdca4bd7f25a8985957629de3d
SHA512 ab182e22848ddc010263987e0f7f0aeae393b0343a9188c1eafc2170bab4b747bb372a112913a34b27ba4a029b109aefc339b52871d8e646654e4fa96c67b416
TLSH
T14511EE9164E5D467F83274CF422BDB821CB877AF5D5CBA25130A852D6B85C32CD154D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1caff14d34aa0d8da7574dff1cb52031c52b694632abc2b668c9c77f6085a6c5
MD5 01447990a330100961985aa2a56352eb
SHA1 4cae1301f19b33e838556f867713a6fb43e7421e
SHA512 b621114f47b1a1c209dd24aa258ea2e30f104d245bb9bac76f45a717c2ff973c031f8c6251861191b721b956e6c0a6e8db5f261a2fbe2d93a94ae0d45eaeec58
TLSH
T13D21F9D1A4E5C867F83274CF422ADB821CB877AF5D5CAA21130985286B85C33CD154D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2164-0-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/2164-7-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/2296-78-0x0000000000580000-0x00000000005A1000-memory.dmp

Download

memory/4156-33-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4156-23-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5724-81-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download