cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Size 18.4MB
Sample260815-1fgjnavvbz
SHA256 cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664
MD5 6597da976c106b7b44ed0638bc489005
SHA1 765217794745ae602ea543b165c7473f7da8b058
SHA512 58204d8a2e358182f4d763a19d53a1386812ae0259c19efdcaf3f3e673fa2b8e96c267ff347ab372a65ec10e839715e485f1c78ec77e6995866c0cdcfa314e17
SSDEEP 49152:U+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+EG:JK7K7K7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1AA171909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
3524	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
3224	svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCBABABAABCACBBCACABBBACBBCBCACABBACAACBCBCCCABCCACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe"	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAAAACAABCCBCBBBCABBAAACCBACCBCBAABACBCABAABBBABAAACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe"	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1348	sc.exe
4124	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
5116	cmd.exe
2552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
3224	svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe
3224	svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
Token: SeDebugPrivilege	3224	svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4024	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2980	1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	101
PID 2980 wrote to memory of 1544	2980	cmd.exe	103
PID 4320 wrote to memory of 3868	4320	svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe	106
PID 1028 wrote to memory of 5116	1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	107
PID 5116 wrote to memory of 4124	5116	cmd.exe	109
PID 1028 wrote to memory of 2552	1028	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	110
PID 2552 wrote to memory of 1348	2552	cmd.exe	112
PID 3868 wrote to memory of 1776	3868	notepad.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABAAABBABABCBBACABBBBBACBAACBCBAABABCACACBBABCABACCCBCCBAACCACBBCCAABBCCBCBBCBBBCCCBBBCABBBAACCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABABAAABBABABCBBACABBBBBACBAACBCBAABABCACACBBABCABACCCBCCBAACCACBBCCAABBCCBCBBCBBBCCCBBBCABBBAACCBAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe" start= auto displayName= "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe" start= auto displayName= "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABCABBBCACBAACAAABBBACBBBABACCCCBCCCBCAABBCCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4024

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACCBAABCABBCBBCBCCBBCCBACCABCAABCACABBBBACAACABCCCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AddStart.exe

Path C:\Users\Admin\Desktop\AddStart.exe
Size 37.4MB
SHA256 9489692de4d0b21890fe2bb6c44462500bd15a7871bad6c10407085e7300cf77
MD5 ae19b4923ea0a2f8e5a3e9a7a8ec5e26
SHA1 eec511ec036aed15d4417078e104a6795ad2dc32
SHA512 b82c770f9bff699b0f9811bcd13a5bf95ad4233312a5e97f635d663b795b693dc92f1b53feeabe8884e2643bb6fdd4da730bacb99363ffa4fc69a8ab90abea7e
SSDEEP 98304:JK7K7K7K7K7K777K7K7K7K7K7K7K7K7bK7K7K7K7K7K777K7K7K7K7K7K7K7K7SW:cch
TLSH
T18C872909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 14ea867b7e6f574b0253f7d1a7bafc6964782c806dbf30edb12445e465a17662
MD5 89fec91ee6266d2ddc2fcc39f313df85
SHA1 be73904ff2ff117239f2b96e51ab54391e382280
SHA512 0c5973898bc09fd98a6968e8e89f8b5f405a6173fbcb345fc410ed12148502e00087592db8f96264828e18e796e291e706e20226629a6df53a8dde9d04a7f032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f864da6fa3e574ed0ebaaa129fb5b408474cf6dcad13d6221fe1c9455de09595
MD5 33dd073d08706a62040347af078a8a48
SHA1 a582aede849f3616616e229beca0a651e9947e8a
SHA512 02094058652dc5f66a43b3bd5d465bc212ea04b63d1a56a4ce443f4964f06a33a38c6f7f028889d46cf7642d422758902924f8aed6f714404ed61e3e779bd59d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e90b069a54af0b9035b09c344c0c23bf8970a2625da8a85093ebb8c4b18f2792
MD5 46c0cb328382324212f8c1ac417f0fc0
SHA1 e86dbde66893181615ae55752adc08730c4c58f0
SHA512 2da12b67fa5aba75275c9aef9e61e7b48055dda1f11c9f05ffdb4bdb2d2b701a83a3c820c63258b7ad6df71eaaae98d3bae2c33021424c2a466ffc6ec4e59108
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27d4642382e77b25ce5bcc75acc9deede5b8531b2c7e2e46ba974211572ce886
MD5 01aac2c1ac450f916dbcbb00ee8d7d03
SHA1 50321f90653c459b9c0e42d01d639a8c0a361fdb
SHA512 083e082ce23a330fb1dcbc73a8663a05f24169694db78de2104736418036d13164d76fc0ea1cacd10b691b3a8e0bd52d7468eba144d4b2f540614609f2053e18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9aa0a4f0f7e94173bdcef79802ae72ee9f2cb6eaac781c7700e2975178db6b8f
MD5 70caf7918940a56be4a63154fb53e152
SHA1 738a530c9ddbdb823a22987160e2e7fad6b1aad6
SHA512 6c3a6a9008b8dd8c1505c6cb598eb5c56f48feedcc7d728f9a86e6484946708259198b9d793e7f20136af1e30d3767a2c776d75834e8ff0879c8db72dd689818
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 838b1f06e49df75d81ab66cef14be083c0f022df7fc43e2c73627f2e876eb9ef
MD5 b782f0925cafbc7a06d1c4e83d36db48
SHA1 9d05bf7b4deca2a5e9849d3b7b52e6ab9b2e22cf
SHA512 2419b031c1ca35c3db1b4677aad8fbf79af0ca3f5306e99fe47abf2daaa04edb58b6fc8e964cee570558f5a6197e31fbe8aecf59d33dcc7277e0c6429ba06fa8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3bd78e962d7572e65189f096ed2538421527be45f6cee1dea39d69e03cd46b40
MD5 41e30505cc878e8c0bac5da94f7eacbd
SHA1 8b30e815a40b630974834d6964c8e3227a076264
SHA512 a3fd16ea61e0a60bef7166a0ff9a43eae8aaa5f6cfc4016447e9c5408e58cccc6beef788eaa470a7fd5df46ee5b1a96a2561998d36d39c0b92a4f5d352688a81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d354d193e03b37ec59ae43b23b490f5fca5c666302b2672951c49d363a4fb164
MD5 50def44a16e9aa57fd0cbddc88eabf07
SHA1 496a6e4f498a0c274337079a3f88e8f14379b8dd
SHA512 8d3b3ede263d039d63e3e0fc25b1cf5a28277071f2fa4551dfb79a37fcd272bb5f91129ae72a82c5ae8d8556d1f724fc4f8b0476cca3e205326a5f0b2610febe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 50edb831b22fe204bb00bff934f9d9a67404b345dcddd35aec9f50459ca92061
MD5 c2b34097e95ef8236487a252738572b7
SHA1 0ac7e698ea7ed4b12a1049cfaf90167a953d5d48
SHA512 531f8d161fbfe7bbaca3828ce042e5fd5cba4af8e5ded799d6aa35da1500201f981ffaae291e906c12541ab96121735a769af827dd88ee7f79010f5d9db25864
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d173a0d7a67aeb9f4cd63712ea54e59439be3e1acab5c30ee8fadd43b76aa47a
MD5 6420777c71692a69ca6405217faaa20e
SHA1 23fcd067d014aec21a23b45eaaaf5705de4516b2
SHA512 875c99dd637928ea78540cbf285aefb1e646f26a005f340d70778507df13113966d1ae346ae9f1f740ffca9d3bb670656b9e6d18c178b4f0ba2c188725a877f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 73aa6e65c31d09eb13a3f2058536dfe2197ea53f6020cc8d42ffa2c8f8998be7
MD5 293a0f044e68850ada0464f642ab8aca
SHA1 7c0e36fbbe2afe85c9fc758b9ff0476c96799a7b
SHA512 cbcf48053e8a07164a93f774208a54c4b129adf9b3b93d10d4600b46cf424bb36f6345e75aea5549b7495ff6fec94d3500b8658ea953f375fd8495ff45727490
MD5 SHA1 SHA512

Submit Download

svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABCCCCACBBCBBAABCBCCABAABCCCCACBBBACBBBCBABCBBAAAAA.exe
Size 18.4MB
SHA256 cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664
MD5 6597da976c106b7b44ed0638bc489005
SHA1 765217794745ae602ea543b165c7473f7da8b058
SHA512 58204d8a2e358182f4d763a19d53a1386812ae0259c19efdcaf3f3e673fa2b8e96c267ff347ab372a65ec10e839715e485f1c78ec77e6995866c0cdcfa314e17
SSDEEP 49152:U+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+EG:JK7K7K7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1AA171909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 e02cdc7a4cfc18d5eda8df207856f9e2bad4fc9069e2dc83c538806f6c76d66b
MD5 93914f0481e9f8de42483524cfac49ff
SHA1 43fddb7c373564d86f46204d3f25c4397e9adcd0
SHA512 e37a925bae4a9d44af24866d210f9f9a553e2e74b74b25803a44e39221022b62f673ec3d20080dc75303aa8bbed5c6d5dd83efca806a30c87768aa7ce8b46551
TLSH
T1400184A4F4A6A8B3E93368DF5629CFD24CF53BDBAC989E041308C119A7549338E250D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1028-79-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1028-111-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1028-30-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1028-46-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1028-14-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/3224-121-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3524-115-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/3868-105-0x0000000002F80000-0x0000000002F81000-memory.dmp

Download

memory/4320-95-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4320-43-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4320-127-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download

memory/4320-68-0x0000000000AB0000-0x0000000000AD1000-memory.dmp

Download