2ee3a018eaab8108d272fff1db9a3b37d0c6565895520a88d93d13abe1e45a54

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
Size 688KB
Sample260814-e8zeaavwb1
SHA256 2ee3a018eaab8108d272fff1db9a3b37d0c6565895520a88d93d13abe1e45a54
MD5 44c1eee16bc70f3395a82cca430817a9
SHA1 147cefc9a92add8a2f93db23c668f5e1f022c52c
SHA512 44b1ff058d76d83d2239b33e9563c3864dedf6dda6766d4d298b5d27a2be0780843b9344b18210be00c14c5f17073b44e087b51268fc68d93cc82d47f2eee864
SSDEEP 12288:mgUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUe:m9+EM0n9+EM0n9+EM0n9+EM0n9+EM0ne
TLSH
T12AE42C09F94354B1D92B51F00DCFE3BF8A71BB26C4128EB6FB4ECB1BA932B116508655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
436	svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
1636	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBACACACCCBBBBCBABBBABCCCCCABCCCBABCACBCAAABAACAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe"	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACCBCBACAAAAACCBACABBBBAAABCAACBBCCABCCAAABCCBCCCCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe"	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1940	sc.exe
4648	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2832	cmd.exe
2440	cmd.exe
3800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
436	svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
436	svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
1636	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
1636	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
Token: SeDebugPrivilege	3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
Token: SeDebugPrivilege	436	svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
Token: SeDebugPrivilege	1636	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2832	1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe	92
PID 2832 wrote to memory of 4704	2832	cmd.exe	94
PID 3248 wrote to memory of 1336	3248	svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe	95
PID 1772 wrote to memory of 2440	1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe	98
PID 2440 wrote to memory of 1940	2440	cmd.exe	100
PID 1772 wrote to memory of 3800	1772	2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe	101
PID 3800 wrote to memory of 4648	3800	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_44c1eee16bc70f3395a82cca430817a9_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAACABBABCBBCCBBCCCCCCBBCBACBAABBACBBACBBCAACABBBABAAABBBBCABBCCCAABABCCACCCCCBCCAABBCCCBCBCCCACCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAAACABBABCBBCCBBCCCCCCBBCBACBAABBACBBACBBCAACABBBABAAABBBBCABBCCCAABABCCACCCCCBCCAABBCCCBCBCCCACCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe" start= auto displayName= "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe" start= auto displayName= "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACBBAAABABABAABBAAAACABBCCBCBAABBCAABCACBABCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4648

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBABCABBBCCAAACCABCBCCBAABBBACACCCBACCACCAACCAABACABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 7f4c2644600b10eb17c556a779e37c8cb395c31c6b73a7f77538212a26886c15
MD5 134585c5c1ef0c3d3ebd783c3e9f0d3e
SHA1 a083c1f99add05f11815bb5bab29c5ea49a31bf3
SHA512 dbafed573dd47fb7e42311f0b2a81f188715198b93fcfab9850712103569f5675ff397856d84e5227c7809bbd44d99641474688b22fe64be3749c7ccdf920219
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.ECApp_10.0.26100.1150_neutral__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 bc554de1c7ada3cddc29c192de61f459756d9dd3c217b0a99003f065281e1d37
MD5 c6e7cc6e28eba525ceacc0f40ccc1c58
SHA1 8be5ed276d093985efeadacc7fce6d9004b38abb
SHA512 ead4c0d300da6d527dd4cccf6a4860c4f41d4551d03b1be65ad5bedf5b7bdaf790479ce387e15f02473ee77ca3ab0323fdf8ffe44d6df8ea0e5b3f19e7663c8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 5cd889172fbaf27648fbe4926f02792309078c7744819ae0de38f60f1a1d986d
MD5 33076c4f7e8c3ee0e36229c653284628
SHA1 1d4b6fb65f37046ff7f68f5a8756d024cbaa9062
SHA512 66f2091aa188b123baa991213bd0ff280eba60a1386fa3aba5cb36f6dc18a1eb6dc59878665d571849ccaa1b008a5008b963362dc6bb611c2eb5bcb9df4c7682
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.3MB
SHA256 ce9c09de1ddcccf26f853f6b4b65168597b349dcab1efe54b6e6f8b5c758963e
MD5 d27b36da98c9cee48440b6e77b3ba999
SHA1 365ab7d41e032a7caba4131ecbf42bd965d9b823
SHA512 8a37c7d60a82e9a1b81908ff032ae16d03dbbf618aa1eca338aee719fa95445c3be923a271317d857657c06dff2f71b22cd960d4d8a714a913924f98b4e1f6af
SSDEEP 24576:m9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0Dm39PZfePv3r7fmE:U+EL+EL+EL+EL+EL+EL+EL+E1gZ2Hbbf
TLSH
T19E559E25F8434072EA7A01B14CCFD27E9E34B72582118DBAFBCDCE1E7931A51667B216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 d8e70bd0712301b999b9fac4744e3c910c96fd72adbbd2caafafaf8247406716
MD5 5197865b739252385a6b091d57efb906
SHA1 a53d50fdd679786dbe342bb34c0abb3be6b519ea
SHA512 184257db62963fd329a3d5f8bcad6e1fe10844b70955b567ec6d484f84c41dbe903ee80d71c667c7efbe75015bd4c412450516593c7ca9c1e885ea457a2af2d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22c8a0cf3746d88dadd47ccbedfae0a41c63adc9b67c1c215be3b8a4188afb15
MD5 02047c24037512f830f6c5c783af4907
SHA1 714d5b82abfb4330cb5912d20e622f408b21c79d
SHA512 1aae72ad866a62d8c5359547a00c9b29206c7f4db12fefd7a85ce4453fda272c2c5fef53233a5ed71239a4a2fbc2a4587b6bc4f3292352cb491748a262e1cc50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d7f308744a703191e2eecce7a02e3037b142b0a3ed5a79f908ef3bfdf7bd0a5
MD5 40361b7d225e1be70842d6c100d51f2c
SHA1 2a9f374efe030f5e61cc014ac3498b30cc4f36c8
SHA512 ee7b3452fb9e776d01ab47bca9acae9e3312979d9736eb76b7617ec7cb6075ed2b4f0f066f5ab18277bc3fc0f0e27219c56ccfdb036784a58c3593d4bd41a6fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a10a28031abbc2aade871453935341ebdbbefd198f13a9e50326144c3fe2bc7e
MD5 58f8ffb55d88983b40a573264875a98e
SHA1 a7f7393e4ad13318a510053ce2d9e62719768b53
SHA512 97884828cdbf34937f23715b905f4662efe915f295012438a319887e9dbb4fe9ff265afe37b8816648b4e163e3a964445415b898cf0264ec45566e52190af8a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2a39a392c702763d104fbf6cecd7a0e4c2211a5ad1b68e2ec572ae025ff21760
MD5 d4738a5c5f64ecfe586d1526c405ebb8
SHA1 0429facae1a81c2004884d76a6c7657d0bea2d19
SHA512 deb24443b0682b032119631d69e54ec710ab8487839dc5c361ec301b46af026caf337b33eda3c5b9199d21a2200a64d3f149a4f58a931c6deb37f26024344c5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 11f0d255fb30baa43e017802f645b646c68edc486f782df4bd030d50ffd968d4
MD5 4184fbd6623721e5e8e1bc0d062b5c29
SHA1 f3377cfb28d820f5fcf69be848816d4c1855ed61
SHA512 09a60a02eaf9d8365f8e3cd1a8489ed020b198f6f0ee91f642e0ba85dcd15b51ed4cfb3da4e29b76cccae65a6aa5b603364416f695319208ec8b1617dacc9a0f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f990989e901bb0745c7230797876c18bbea5365861d312320ed3eaba155de7a3
MD5 f1cc57fdf87f0d441998ccbbd4b5ffa7
SHA1 9128d7055a3383db7d5e27a6fd9a99787986236e
SHA512 8d382e0e35c35c0f4ec1b4365c10cc3073257c45edb10e570268e30131c6861dea34fb2f403089717f544ec8a69a7d16d642f78a71dcb64f4297a089c60f8089
MD5 SHA1 SHA512

Submit Download

svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABBCABAAABAAAACBBBACACBCCACCBCBCAABAAACACAAABBCABAA.exe
Size 688KB
SHA256 2ee3a018eaab8108d272fff1db9a3b37d0c6565895520a88d93d13abe1e45a54
MD5 44c1eee16bc70f3395a82cca430817a9
SHA1 147cefc9a92add8a2f93db23c668f5e1f022c52c
SHA512 44b1ff058d76d83d2239b33e9563c3864dedf6dda6766d4d298b5d27a2be0780843b9344b18210be00c14c5f17073b44e087b51268fc68d93cc82d47f2eee864
SSDEEP 12288:mgUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUFgEsnojngUe:m9+EM0n9+EM0n9+EM0n9+EM0n9+EM0ne
TLSH
T12AE42C09F94354B1D92B51F00DCFE3BF8A71BB26C4128EB6FB4ECB1BA932B116508655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e73b85a8957263669888d16c840a101dad3c3f002e25891252a865ae51108c27
MD5 dcf6bebb16ae02da59b0c0be280b0fbc
SHA1 a1fed112b4678e4dc0563014c04cf32c452dc2b2
SHA512 a121a72412f6c0c0442d93d8f6598b15929fad0b0b802b7331f8ee0ece253067e635e99fbd73884272fb10fae8c4a28f35fb23ad2f07c5dfacce8043aaf31e0d
TLSH
T1BA119B60A8E5D437FA236CDF911E9B461CB0775F9D98AA1413048128BFD5D208D558F5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1a037e947eccd46ebda74398c690dacfe3694a9772c5d8b1bdd9ba85bafef3b1
MD5 69993b071b9d381645d5644fa8b19a9e
SHA1 f43f62cad716aa3bae085221efe032311d1b9f76
SHA512 deb06116bffd9bedfbd33097df9b605c1f12ab993808a64402be18ac4dc56ef70fd34d408c62619f06017f224da6f61988be24b3e398bc0899e56d0219b59da2
TLSH
T1B6218A61A8E5D837FA236CDB911F9B421CB0775F9D94AA1413049128BFC5D208D558F5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/436-1676-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1636-1085-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1772-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1772-7-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/3248-31-0x0000000000400000-0x0000000000421000-memory.dmp

Download