f86b956b6e25207d64d7a3ee8d522f3af51bd3cf7d48c8676603f945fc01c0ff

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
Size 20.3MB
Sample260816-sfdtrseb33
SHA256 f86b956b6e25207d64d7a3ee8d522f3af51bd3cf7d48c8676603f945fc01c0ff
MD5 25e406f194bc3a4b2b13844d985bfb4f
SHA1 f6961956fb96c7e6c9952eb5cbc510c620a357e3
SHA512 d7b5b1fcd7d4fd8177f40f1e2bb4810adb1b6170bfa5ef2af7a15a4be29c4bb91066c5a1bfe4ac799d0b50aff3545c591d6fabf3ff85d6c8eb2932de449d2550
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E9:/
TLSH
T174272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
4156	svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
2128	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABCACAACABABBBCBCACCCCBAAABBBCACBABBBABBCACCCCCCCCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe"	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCBABCCABAABCCAAABAAAACACBCBCBBCAACCCCBABBBBAABBBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe"	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
672	sc.exe
1828	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4388	cmd.exe
2732	cmd.exe
3980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
4156	svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
4156	svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
2128	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
2128	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
Token: SeDebugPrivilege	3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
Token: SeDebugPrivilege	4156	svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
Token: SeDebugPrivilege	2128	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 4388	2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe	92
PID 4388 wrote to memory of 1532	4388	cmd.exe	94
PID 3016 wrote to memory of 2888	3016	svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe	95
PID 2744 wrote to memory of 2732	2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe	98
PID 2732 wrote to memory of 672	2732	cmd.exe	100
PID 2744 wrote to memory of 3980	2744	2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe	101
PID 3980 wrote to memory of 1828	3980	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_25e406f194bc3a4b2b13844d985bfb4f_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAABBBCCCBBCBAAABCACCCACABABCBBCBCCCBAAAACABBBCCBABCBCBAACBBCCACBABCBACCCBABBACCCBCCBBCABBBACCBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAABBBCCCBBCBAAABCACCCACABABCBBCBCCCBAAAACABBBCCBABCBCBAACBBCCACBABCBACCCBABBACCCBCCBBCABBBACCBACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe" start= auto displayName= "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe" start= auto displayName= "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCAACABCBBABAABACCABAACCCAABCCCCBAABACACBBCBAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCCBACCBCBBABBACCCACCCBCABBBAABBBCAACBBABBCABAAABBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8d7d41193ead01fbbda5e629927f67d1c0c4c8677dc34284f2866b864cdf6677
MD5 640b321d8a58e31fcdd868b69fb1471d
SHA1 a57455a09aeae452dda9202066b3e90cbc3e5969
SHA512 a8468698a08df8fe5c005d659994155e4358f82853bb2303fd7df5937acccf95e97aefb3747bc554ee9fe47490e4bea16246185f304a192be2336344ccc2e52e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\Scripts\qap`g`v~dtlq
Size 10B
SHA256 b3ba42f2d26c72bf626dd963f1cfaddd44124354cd5c0e4593f33f914495ac6a
MD5 b8fd02483a04ed5d79ee29bc78cc7c57
SHA1 4dca56c2fb03cf5f6453f8b471b19b4510441e01
SHA512 eec02fcca7dc04e80adc86b0c049ad2d5b272113ea37b1e96a07236b989213706c181104c2b8ec895e9855882744bbdbd9594876cd679c1479cb94f8bec981af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\GameDVR\GameMRU\qap`g`v~dtlq
Size 10B
SHA256 b9f7dfd03a6974481551ec9b804663c6ecd43c3bd080ad4dd9147f3076feed58
MD5 19ea4d8f4588998016a35ac09c62b53d
SHA1 03a958907fef90fbb3088bd05bddbd4a143ccafd
SHA512 f2b50195f961238e0db72cd41592bc3b997719c7039d0b4400c2532f1151ee94e3167b94fd74009457def4d80a4fa17e2144741b013278207394445d4b38731e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 acddbcb50db100a6c3e2c0aa52f7a6fe1c857b08ae9452b227430b06a67274ae
MD5 00075122272efa2a9f5070a87f1ced9a
SHA1 da3279235a903731835b9be9e865e224baaef9d5
SHA512 3c299dc31b69656fe438dc4fa55dce197a73948feae83c2b5138a988f255ecb49b21b9c01de73f559f56ce1af43d083ed459a9324b7c272629083acd7c091671
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2cdce7c64f46484da328f655f76e8fc19bded7def4d8592df07e6e9b168314ac
MD5 23fb7c05647b3e02b8a87db1cf52909a
SHA1 51076ca2847d91bf87bca4020a5e0494fd68ec7f
SHA512 2d53b510467a3e42a59b86ac57e83aff7b1cd07f343066a3b7b575eee3b21fc7a3c981b3f17d41d259617229e0dd5013a189e82cf9d88d7a95a797a7cf72f33c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5cb9a91d827a54387d7be6ae29b5931ce29e5fb079bc5a934e13cd3830f821da
MD5 50f182c2171ce5208d141269e0790a19
SHA1 b7d9bd80a01c50c07b74ac2d5b5291cd45598ba6
SHA512 d3894464807185f3aca08b268021c81947ef53cff392cf00d7081412ddc2b788418bfcd63734b17dd8ea11bf04a777a227e1c21c4d56dc1a5c80223dee6df263
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7b2f0b62c41dbac55bf1787594f44ac8bfe2b2f33d45b516b5b47da86f1177bd
MD5 330d1c72cdd3905db6883f5f2ed38a23
SHA1 196e6162269145407f133870ed8e7de4d82354ac
SHA512 5e798a193a4d05401d24b99b836346bca08201a1535f8a9a8448dbfacbea6dead137f71039b502e12737d4c7ccea3d3f15d8907fbc524a5f0ef728fd888a68c8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d50f55eab48d51fcbfb4d10694ff3899b1230263e726e768683ddc9fe88f29ac
MD5 eb81cb4222d2c72bb070bcc88f863dc0
SHA1 2c02e46fda96de541d5099d600141c20cd255780
SHA512 9c7067476ae8e0f11463ca33c5165b3f5e548b5c2d42b5f0d3b816655125ed740a7e1c76f911236dccd31145128c3903804d9e5d0a7b1f6a1ead48730214cdee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c63997d12f18fe4102e12cb5a7e873d16cc3033867fa680bddcf260f282b236e
MD5 c371f9336517673fdd78ba49a6db9ee5
SHA1 0be66b2f861c400a84fd455e21ae3490ddada4b0
SHA512 6876ce3c991223be6d8c02879e1b6a2e89a73f719a4ea5f9a3aacbb4c29e70e84fda735e534405b0a48186ff5733e9495a69e8020fcdc0e9b41e7787c6b789b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4214ede468487110d92f5c7d5ce06fc1a75fab1d8b408db19de7b800b779388f
MD5 5404c463e9db0c9774178bedf40ba811
SHA1 8447e92ced9b053a6cb712469a08c1b7b40c2610
SHA512 025d90cb62e4dbb715e33ed7988357a501e001c8367b5d7abb0d82811710191ede42d3e046018666076fe93b8a99409df0b276b92d427dd27da38d822c2a841a
MD5 SHA1 SHA512

Submit Download

RepairRedo.exe

Path C:\Users\Admin\Downloads\RepairRedo.exe
Size 61.3MB
SHA256 1bb50202e7ade6da3e492557c115e64a621bc21d2c9092b7d3c32c7f1b379d6c
MD5 20cf0331fabca5733aa042f74874d779
SHA1 752f33aad52993dbdf6affb865c49444e034d611
SHA512 9bd4e60f479d90acb0e8ce9453ba25d356f75cfdd488fbce36f3b4462eafe06b824aef5a52e013a88ca23d70a79eb4d316c0f8f39f083e882570ae084633a1f3
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+EO:mMHDvc
TLSH
T16DE72A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b6a2c0e0bfe6d551021db6c8cb4e2059331e171d8bcc81d22a346c310f7008ac
MD5 68e2fd9ed22e3a6a5095c1030acf3087
SHA1 2be67cb8daccbd1316651ff747dc5e05c7c80366
SHA512 b4affd6a7ca198ad60b9e0572cdaafc0f98daac46a806de3b73befc923e0300fab55aef11059045a69448497c81a21ebca51575aa1f75f75de8ccca71f7b47b6
MD5 SHA1 SHA512

Submit Download

svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCCCCCABACCAAABBCAAAABCCACBBAAAACABBBACBABCCBABBABCB.exe
Size 20.3MB
SHA256 f86b956b6e25207d64d7a3ee8d522f3af51bd3cf7d48c8676603f945fc01c0ff
MD5 25e406f194bc3a4b2b13844d985bfb4f
SHA1 f6961956fb96c7e6c9952eb5cbc510c620a357e3
SHA512 d7b5b1fcd7d4fd8177f40f1e2bb4810adb1b6170bfa5ef2af7a15a4be29c4bb91066c5a1bfe4ac799d0b50aff3545c591d6fabf3ff85d6c8eb2932de449d2550
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E9:/
TLSH
T174272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f5677908805f47dcecdb64a4bdbe369c7f36c041169c89a1db99f99e2920b84f
MD5 a6ee028de936b38fd7970e8342a2b366
SHA1 f564e218c376c643070f0d2245e92c07d6b7d8fa
SHA512 043cf368e299ca87469c896c136cf0eab1561d428396d7384d9ebf99b9e76276deca7c130484c2dad7bed30744166ffe781cb2741b544ee56e12801f8843e345
TLSH
T1D2212751D8E6E493EC7368CF572DCEC30CD937ABA81C6A1423054618F7D9C318E5A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 161b5d9445f722de502b03b41c8b13d01537d54b32c4fa7b3d25df4c83c991e9
MD5 b567f7a8a87ce8d333f7e4322aaa0c31
SHA1 de3b07f3765438ed2d12a42bf467a771c7ba573e
SHA512 47daeda8abd5a828b48efca6d7da214b227762d7c5d6d8580ca1cc319710ea45731d6cf09ae5a873ab5b26a7b08341d524e76fd064eb388a55a1f6b28bf0d5b2
TLSH
T1A8110241E9F6E4A7E87268CF432D8EC30CD937AB685C6A142305461CF7D9C318E5A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2128-887-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/2744-70-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2744-108-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2744-0-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2744-48-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2744-22-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2744-11-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/3016-68-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3016-47-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/4156-100-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/4156-879-0x0000000000100000-0x0000000000121000-memory.dmp

Download