03d37111e805479d4c13367bf633f4c541cc72e4658d640c10a34e616e4d39a1

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
Size 5.0MB
Sample260818-ae2kbssdjd
SHA256 03d37111e805479d4c13367bf633f4c541cc72e4658d640c10a34e616e4d39a1
MD5 9546dd4171a47c7b5cba27676b301aef
SHA1 b19b5657a994700b2bfe50289fc3bf75e1c38079
SHA512 fb56bda957e0f88b2e9250d859465ba38f13bb45dfff075f70f9b4c4e211894878a2c3324be345a44f5abc46d1a2775532fbc6647edd9bc01a07c601114a503f
SSDEEP 49152:U+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+Ex:rf5mf5mf5mf5mf5mf5mf5mf5mf5x
TLSH
T1AF36199977EA5215F6B357B58CB9C2E66D71BC204F30C3AF2600B21C1E369D0D63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
1704	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
4312	svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCCBAABCAABBCABACBCACBCCCAAACCCACAAAABAABCBABBCBCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe"	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBCAABBBBCCCBBCAABAAAAAACBAACBAACAACCABBCBCBCCBACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe"	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3676	sc.exe
2928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4988	cmd.exe
2308	cmd.exe
5760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
4312	svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe
4312	svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
Token: SeDebugPrivilege	4312	svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 4988	3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe	96
PID 4988 wrote to memory of 1444	4988	cmd.exe	98
PID 2956 wrote to memory of 3820	2956	svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe	101
PID 3464 wrote to memory of 2308	3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe	102
PID 2308 wrote to memory of 3676	2308	cmd.exe	104
PID 3464 wrote to memory of 5760	3464	2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe	105
PID 5760 wrote to memory of 2928	5760	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_9546dd4171a47c7b5cba27676b301aef_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBABCBACABBAAABAACCBCCBCCAACBCABAAAABBBCABBAACBCBCAACCBACCCBCBACCBCCAACBCBCBAABBCACAACCAACABAAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCACBABCBACABBAAABAACCBCCBCCAACBCABAAAABBBCABBAACBCBCAACCBACCCBCBACCBCCAACBCBCBAABBCACAACCAACABAAABCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe" start= auto displayName= "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe" start= auto displayName= "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBAABCABCCBBCBABABABCBCBACAABABBCCBBBCABBCCBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
1⤵
- Executes dropped EXE
PID:1704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABABBAACAACAABAABCCBBABCCBBCBABCCABABBBACBCABCBCAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 15.4MB
SHA256 a08381a279cdafc528c2f63d2ffd5c76ee15f809632b6d295ef12baec2e74a20
MD5 09b0729c9b252ff26e22aee484900790
SHA1 025057af62cacccd7d64ac51a83e3d0b57aa625e
SHA512 7ce9962770cd0fcad4c1ff0dd656e41c3152cb1fdcc2708147a51cc78bc9785b7f4c4fa513b2afe624c84aced95346eec3ed3e9e85eaaa80649034ee40f57343
SSDEEP 393216:T5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5i:T5e5e5e5e5e5e5e5e5B5e5e5e5e5e5ey
TLSH
T136F6199977EA5215F6B357B58CB9C2E66D717C204F30C3AF2600B21C1E369D0E63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 768KB
SHA256 7ea1af377d3e6b294a46ed154744d19a39bf055370718dba8438842c62807851
MD5 d1d21d2b98641e378c2c85e5a1f98bdd
SHA1 dc6b19982e3606803b0d7f395bf51d86568497dc
SHA512 669a4f9ec0744b161ee88ff672a208e2754975bb141ef2be933fbf7fb28073ee496529d37b3921107a9cf7f9ac974eb032a2720a33c24d3ad9d5bce5a09380c4
SSDEEP 12288:mgUFgEsnojAbk+BeDuUlEqatglW0rclln5XgUFgEsnojAbk+BeDuUlt:m9+EM0bExqatglzrCn5X9+EM0bEg
TLSH
T16BF4F8597BEA5211FAB356748CAAC2F66D317C204F3087EF6640B32D1D326D0D63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 35.3MB
SHA256 606e5f05281cbb3f9f0c830656a847c541864d7eb9268bbd42de539e517f4337
MD5 9d1250b026ec3fc1c1fe904a0e48800a
SHA1 4959341d8558c22e32ce957317ad72fab789f96c
SHA512 ee564ef19a6f2c473c8284b76fa3edb7b98b0e223e1176f2be41e4902aaef64813900a334982034ae1b78b16077613b271436a6525bfb5998cc373ad26c99547
SSDEEP 786432:T5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5es:U
TLSH
T1EF87199977EA5215F6B357B58CB9C2E66D717C204F30C3AF2600B21C1E369D0E63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 40.3MB
SHA256 1fb84a1e287277cc5abcb4856ba2c3f461d4a1ee39ea777c1e9bd86a4e2e9e1a
MD5 edf59793c5a40036045a6f1426d875a0
SHA1 a304799f7176e4187e8f20da31d79cb88d131f48
SHA512 947c8a0056938bdbb68846545249cbd8ae0a202999d9951ba0549404b0b4f5cbb441d3c790906b3d15df8372f31b847d6cc80225f293273663c65dd68a819755
SSDEEP 786432:T5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5eD:b
TLSH
T1A697199977EA5215F6B357B58CB9C2E66D717C204F30C3AF2600B21C1E369D0E63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 45.3MB
SHA256 2622f8e0d81fa3cbb10e14ee1aea7ea25d8cf03a683fa1ca8cf40d530f2ed871
MD5 5e91330265c4b9238f5e446ffaaf4db9
SHA1 1e5f71afc56bfebdb3fee6b40d431f19b507bc44
SHA512 34ac6a53bef5f3c719bb75169071908bfd22ff06e646835cf49732685e5f67f90dd2ccb51212f59e3e69bedee039e837540a242d52323347afd5747937c1d130
SSDEEP 786432:T5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5e5e5e5e5e5B5e5e5e5ey:K
TLSH
T157A7199977EA5215F6B357B58CB9C2E66D717C204F30C3AF2600B21C1E369D0E63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 1.9MB
SHA256 84cddf4f6f7b760fb6563024af346826602259812ca80cb41b97766ed6f302dc
MD5 2e26b3600d23924d37b5d7cb8d6302ca
SHA1 4047d3e70290636a572557e143e9b4639fa3815b
SHA512 4e2a995417758adf9d9bb36f1f48af043c33b36a1238814e74359b8cc37b368ae5e54d3d87513ea0caecb32d28138f7d57125ccd57600a2320ed3d995cec8d21
SSDEEP 49152:U+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+Ekqatgl:rf5mf5mf5m
TLSH
T10795299977E95211F6B356B58CBAC2E66D71BC204F30C3AF2640B31C1E326D0D63A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ecf076590729e9e8bfcacfa8648fb8f0b9bb25414a0c76361c7a1b134a35aea7
MD5 146d16abe5e5a3f436efe39795ee669b
SHA1 7d7469862fe36f8f38218905fe9cf795858a181b
SHA512 df68cef1342841b697a0631b216a10f54b9e44d4c996cd314aeb4cc2b4f03e5f61ba95ff7dfb50e7a5bafcbab0ecf5ad4f84d1de8f39de84fb029c47ceb794b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bad41eb13a8757731c80a856036d2609b55067e58a33524d5549f8c06f6eb7b5
MD5 a1d57f3f890bd04ffea607d2e24db9b5
SHA1 d5f454b2af9ce018d67b41e97b93efebc48ef8b6
SHA512 763a2b1a47217934879aabcca6f2f03b3bf00429644e9eb2256e9b7a660eee2ebaba3a490bab6ff9d41f6119b87b832bd784eb861e875bac990920bc1598e5fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8cfd5f786d9b9a2ec4a2e35adb0cc99eb790acb3a50c6db1b107d9854425c6c3
MD5 bd9eb0314fc339046d637244ce9ad021
SHA1 cca3542effc4754f858b27f75b1c938c09152a7e
SHA512 26fd9ae52ea6fedd2d9544bdd464479b2d3966766303863f73368148b72ffc28bc5410362bc926a86ef107a5581342e509904423a52990d8ff4a7c15a8e01837
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6be633cf244fe15099cccf5b6cee3ec67b2c67dc222673679ec309e946133b5
MD5 5234ef324505d11b148856d8e0866f9a
SHA1 4ec01847424f1baaf5c416e8627d854d1193dee1
SHA512 b944531736ac3e1f5f97c856646bdf8bad90d62da9cb4f98957befc8a599ac50be83a667ee1f4231c4c9645817cb1f4f35e2bc4010f782a7a27edac9c2f413a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2864c841ed0e6382135404c407245014ea716550440114ea5dd07e10a7de49ca
MD5 226202c650b19a1aeeace5818843aad4
SHA1 cd58127c09947edb5be00970a88349bb6947e721
SHA512 b3ec8bc1300cd5de2466f3c39c51c520b3418f2d513273aa7ee39c5dae2c033b8dd801ff8060b6d21e78b0e47d0b56dac5289def0a487df578b69d934562e83e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0ea2890d6faff33f9810ec0cdc79cd03afdb7c49c1046b7dc073dac826ac805
MD5 61109654dfe92f41b2ffbd9b7516cca6
SHA1 69f631f79edf67593da216d7c491cc5bb2e33ae3
SHA512 3da8851c74d10191c0f59d7bed234c919568754f0f938b3740f357aa2ff26ab4e10f08bed27e5fa2415a3f6673e915ecbd0726b0877f5cb767b97eb1d517b1b9
MD5 SHA1 SHA512

Submit Download

svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBBACAAACBBBACCBBCBAACCBCCAABACACBCCCCCCABAAAABBC.exe
Size 5.0MB
SHA256 03d37111e805479d4c13367bf633f4c541cc72e4658d640c10a34e616e4d39a1
MD5 9546dd4171a47c7b5cba27676b301aef
SHA1 b19b5657a994700b2bfe50289fc3bf75e1c38079
SHA512 fb56bda957e0f88b2e9250d859465ba38f13bb45dfff075f70f9b4c4e211894878a2c3324be345a44f5abc46d1a2775532fbc6647edd9bc01a07c601114a503f
SSDEEP 49152:U+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+EkqatglPC5t+Ex:rf5mf5mf5mf5mf5mf5mf5mf5mf5x
TLSH
T1AF36199977EA5215F6B357B58CB9C2E66D71BC204F30C3AF2600B21C1E369D0D63A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 19f80edf6624949c9c71ff5347128084629c360aa88d8888d97268869e288bf4
MD5 3d567009a1c603855dea036a4820337f
SHA1 f26c72586b1e6aaabf727799e0fee3eb25c811d9
SHA512 86d7831698c43a252c3d56915da7b9366cd520a56b966d9030bf0ec4b9f746d33259e32686d150b44ef05237c9b0aa40737112f60e39eb11b4dc8d49a1438c3a
TLSH
T16A112B72F4EACC13FC32288B63299B834DA5629B586C6A05530E9118BB99D34CE250F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1704-102-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/2956-51-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/2956-33-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/2956-72-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/3464-60-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3464-86-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3464-0-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3464-34-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3464-22-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3464-11-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/4312-109-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download