04ee991102e232e1fab2c0c4d709663e4fccfd4d1c977399312fa4f09d08c2d0

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
Size 17.8MB
Sample260815-2a876avyh1
SHA256 04ee991102e232e1fab2c0c4d709663e4fccfd4d1c977399312fa4f09d08c2d0
MD5 c7732764521878b5d12b6e06ae005e3c
SHA1 f2be2a2f8b684baaa91de19386cc4b02ccafaaa4
SHA512 09b96009312ec4698412c0e3811b35f952aa0e98e2e9a0075d8f77aa5ed3d5a61b49196d4f8b32dbd769d1c2609c16fc76899f8c8cdf0ae872831ebf77ef3060
SSDEEP 49152:U+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E8:k
TLSH
T130172A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
832	svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
4904	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBABBCBACCCBBCBBABCAABCABABBAABACABCAACCAABCABBACBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe"	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAACACAAAACBCCCCCACCABAAAAABABCCAAABBCCBACAABABBCABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe"	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5304	sc.exe
424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1624	cmd.exe
4064	cmd.exe
5880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
832	svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
832	svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
4904	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
4904	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
Token: SeDebugPrivilege	940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
Token: SeDebugPrivilege	832	svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
Token: SeDebugPrivilege	4904	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 1624	4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe	94
PID 1624 wrote to memory of 6976	1624	cmd.exe	96
PID 940 wrote to memory of 6644	940	svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe	97
PID 4080 wrote to memory of 4064	4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe	100
PID 4064 wrote to memory of 5304	4064	cmd.exe	102
PID 4080 wrote to memory of 5880	4080	2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe	103
PID 5880 wrote to memory of 424	5880	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c7732764521878b5d12b6e06ae005e3c_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCCBACBBAABCAACBCBABBBCBAAAACBCBCACCACCCBBCABCBAACCABABBCCBCAACABAAAACACACCCABCAAACBCCBCCABCBCBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCCBACBBAABCAACBCBABBBCBAAAACBCBCACCACCCBBCABCBAACCABABBCCBCAACABAAAACACACCCABCAAACBCCBCCABCBCBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe" start= auto displayName= "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe" start= auto displayName= "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCABAABBAABBABCACACABBCAACAAAAABAAABAACBAABBBACBBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCAABBBCCABBBCABCBCBBCCBACCCBCAAACBCAABBABABBAABCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 11995993be862bd06cf7f3e426923e13a1b0a759b1db48984663e3b8e1e490c1
MD5 77d25005a7578b5195288b01d5ff8da6
SHA1 4fb1f9979bf52b62891b312e041f5124b3d6d05e
SHA512 cba07c08322dad380a4c8d475062d1ec1251ff18976f6b34c8523da93675a1efcb4e1e337a1b1cc269e162eacefb4a681168de10c425e738652deb60043ed064
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\qap`g`v~dtlq
Size 10B
SHA256 9e99419646013615d90f4afaa022ff433d38b2d22034d97d793932729b74214b
MD5 951873fff45e33e7ba239c4a63e4ac2d
SHA1 25f30fb72aa83db3cdeb60fd00a221b393f7c5db
SHA512 0f8e3a4474cf0e71defceaebb4d4b2c1ef7eb115d153a1a91bad75054df5229d4ad9ab36c1607a04bd2aaf3b7c073a1f71f1772374ab0cf60fa4f5f6d650b720
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\qap`g`v~dtlq
Size 10B
SHA256 f7d409178b98b5bf3a30accfdb1a91b4f87b35e40dfd80ff89e34e141a33996a
MD5 43adcf34e2930b91abb8faa9f8bc8588
SHA1 cfa65ace85453b252b4098a4a2b2c61cd8393588
SHA512 544834196b7c33fc85fa80b507db88991b6fb59d98c022745f28d2299ae743ac66e90c595212bccbd3ebd8573fe8e3b792e1081d218588b2f0494a7dcfa7a8d7
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 18.4MB
SHA256 9865e803b71515a68fe8857c78d185bb4edd2625926a1ac6260c1b988c4e85ee
MD5 4fe7738f8efd141322c5d13b41033d0b
SHA1 e3e67f2cb3be48a7da5d78194a41f992f31d005b
SHA512 b13564adf014eafe91bfa7cf4a38c2fcfded8b9b04fb52b8e4027cdd446fca5b2a8eb2e38bce8a426e24a65a95ae972febd872f468a01977bdfeae908b9f46fa
SSDEEP 49152:U+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+EH:DgZ2Hb9t+2xn
TLSH
T176172909FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\qap`g`v~dtlq
Size 10B
SHA256 5bb4dab9e4cd2354c6a78540d8488b5740f91d570dc5b9d3bc40950a26304149
MD5 aa92e06fc079290079c3ba7b303c79eb
SHA1 bab991a46d8266e6cbcdfa259ab9aacd33caf0db
SHA512 9cfe1f4c8cc72da68016034c04b2eafe059141231617a609e874bff48c0aee3240bb795712d3869a3dfc9020cbb615eac45f7abad41a6d62a0604a327179ae1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\qap`g`v~dtlq
Size 10B
SHA256 c211543a19cc46a595e154735ee4ae26d00fb132fc6fffd4fa538bb1592a7dc3
MD5 612a6b74976bfbd408658022c928fd11
SHA1 36ad9af88c9322ec93440aa5be06981b50384278
SHA512 6cfc6b42a9d5f04e4c2a5b2a068da6d4dc150b88784afb607264fbbc896f75e778e73af3cead28a8ca9a647a74a5e22c020ad323c1bc500788da35276ebcee85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 336927546e2bbba9b5e95f207045c93bdfb04aa30955c30b4fb716be547e4068
MD5 18615f2800f9f62426594753c9de785b
SHA1 e5bcbf9aec80ec14ad65e7c72149a678f52f0426
SHA512 254c38b1a1d355a56b19f4556d8cf66fd50d205560397d55004581247a5e1613cb9441e6bdbf8141e94549e95e359276f5402dcf2f17bf54ac8ef5c1b01261db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4564b0ae7b66879195b955f7d32ba8e73ae8bc0bc7ea96421c5573a8aab5ad51
MD5 610843e7c45a71c866dddf766b773c09
SHA1 0d2e54548d54eeaa93f433df540e1089102c6a4f
SHA512 e60cf921c1280825dffd4ac192fc7a8bfb2902488838eedc8773dd953755e3e801ea3b0296f7edac1be9bbd3f833fe01df3bc84e0514cbb0b8e5f36e620313cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c6cdd958f59aa8db5a69c98ef0f4999d68dbe61b5753ddaf4cb0f8da6035355
MD5 62d1832b5e7488a32f6bfd84da5e2676
SHA1 aa9bf3dbd41d226c33715ea86fe470252a627186
SHA512 fb9e9e4b1d7c0997aa06402830f27d14730e6e1c1d149d3d5ad154152f64e450bdc98dc3391b8051ad0a083735c7eb83b3500aabfa51cc5014426a66869a3670
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9f924313687e01cbdc504600771bb24eb8fc9c52eefff0ceb9c3adb1de03062
MD5 65a0044fb7540745676f201b9162a012
SHA1 c2c4fd50f35e16654d7589df76215d7ca09b7e50
SHA512 c729e067c39f61c7c7625f3cdd4c466819c29a8c199d2c73841240dc84c546d75a379b8ebe91a14090132f08e75ef2912954ad8ffd3dc5054ce1ca4154fa0a0d
MD5 SHA1 SHA512

Submit Download

svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBCBBCBCABBCCACACBBBCCBCCABBCCAACABCABBBAAAABCCCCAAA.exe
Size 17.8MB
SHA256 04ee991102e232e1fab2c0c4d709663e4fccfd4d1c977399312fa4f09d08c2d0
MD5 c7732764521878b5d12b6e06ae005e3c
SHA1 f2be2a2f8b684baaa91de19386cc4b02ccafaaa4
SHA512 09b96009312ec4698412c0e3811b35f952aa0e98e2e9a0075d8f77aa5ed3d5a61b49196d4f8b32dbd769d1c2609c16fc76899f8c8cdf0ae872831ebf77ef3060
SSDEEP 49152:U+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E8:k
TLSH
T130172A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 254e4931feff61db294a0a756468a7257b17f5d672e06449863ebb72422493f4
MD5 f5f6c8fda8fac09cc4c5759123908633
SHA1 0656149ada1c61fe0175e634c81eda89adf70b77
SHA512 6a681dc30d23529e30b2e4d584d0365465a6342ba31f328431e98425efb5b1cf7e4c9ab81238531a75dc222f8d7c38d0b39a57aebdc31db3607ea666894e376a
TLSH
T1B411B95694B9D453F822A88B662ECAC25CF42F8B58986E58230DD118DBC5C328D1ACD1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 c4d9434fc4f701cde45cf2e05b049ae12c767c0798692db0f4a411fa34bd4bdc
MD5 15bb229ef4bb05697275b67987cf89dd
SHA1 878eb4c8297f921d85fa9818d22d11dc3f6a0954
SHA512 776ff69726a47cc55a585af3963f7621b1b18a5160c0fa25690f202847825e516b020f6861ae64958ed92436d58eeda6ac89a9b4bc817cbaa9cf2a80d6a69519
TLSH
T16A11B95694F9D453FC32A88BA62ECAC25CF43F8B58986E5C230DD118EBC5C328D1ACD1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/832-76-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/940-31-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4080-0-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4080-7-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4904-944-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download