6cbde6b63e5816c302081ab36f403f2f43445d3d85388f042965281a1e909e38

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
Size 1.7MB
Sample260830-3wdttasbpd
SHA256 6cbde6b63e5816c302081ab36f403f2f43445d3d85388f042965281a1e909e38
MD5 fe6db7cb33f8003a6313b3733770cbd5
SHA1 326fdc9babeebc554483287214539db8fed0163e
SHA512 403489229201aa04ae8cf02daa01661f91a573ed63e731a4ec2cbc8373b97edd198d13383cfd8a93b2a4b97854286d7d269cebf3908857b26c3844be7c74e8c7
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EKW1PszNsQd:nW1PszZ
TLSH
T10D856E06FA8700B1EA7B25700CDBE3BE49757B218431CE7EE74D8A1F6A33B51581935A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
5520	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
4352	svchost_ABBBCBBBBABACCABBBCACBCBCBBCCAABCBABBCBBABAAACBBCCAACBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBAACCCAABBACBCAAABAAAAAABBCBBBAABCBCBCAAACABABCACCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe"	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCCCACCAABACBACAACCACACACBCCCBBAABBCBACABCACABBBCABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCBBBBABACCABBBCACBCBCBBCCAABCBABBCBBABAAACBBCCAACBB.exe"	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
668	sc.exe
3576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1100	cmd.exe
1536	cmd.exe
1328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBBBBABACCABBBCACBCBCBBCCAABCBABBCBBABAAACBBCCAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
5520	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
5520	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
Token: SeDebugPrivilege	3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
Token: SeDebugPrivilege	5520	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1100	4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe	91
PID 1100 wrote to memory of 3176	1100	cmd.exe	93
PID 3512 wrote to memory of 3136	3512	svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe	94
PID 4288 wrote to memory of 1536	4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe	95
PID 1536 wrote to memory of 668	1536	cmd.exe	97
PID 4288 wrote to memory of 1328	4288	2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe	98
PID 1328 wrote to memory of 3576	1328	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_fe6db7cb33f8003a6313b3733770cbd5_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACACAACBACCBACABCCABCBABCACBCABCCBCCBACCACABCBAAAACCBACBABABCACAAABABBACAAACACBBBABBAACBBCCCABBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACACAACBACCBACABCCABCBABCACBCABCCBCCBACCACABCBAAAACCBACBABABCACAAABABBACAAACACBBBABBAACBBCCCABBBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe" start= auto displayName= "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe" start= auto displayName= "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAABABBACAABABBCABBABAABAABCABCCBACCACCCACABBBCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBBABACCABBBCACBCBCBBCCAABCBABBCBBABAAACBBCCAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBBABACCABBBCACBCBCBBCCAABCBABBCBBABAAACBBCCAACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 fac94f52d23f44de141b2b96b48f7aa15c7875e6cc023bbde7849edf3bc98c4e
MD5 7e0df52479b7055caf51c39b9fa2eabd
SHA1 05406f965486703da4113c5e70ccbaf98512d25e
SHA512 d726940b420933cf339a5fc9e5f138220d893ac721b9d27b30ce57ea23275c9b768a9e59da1d1c1eec07faaabea3f8b8301eb35049674d597bf23f691990e63d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\qap`g`v~dtlq
Size 10B
SHA256 7c818afd76f58f0f72907aee0c6f5f932f6f3b2bd88a30be96bf6297657e1070
MD5 871bcb0f0201fb382a1b265dadec7b16
SHA1 0ac8b33f4b4676734c98954ca5f5f343297c9f65
SHA512 c88a437fcffd6de8dcfc844ce8d1685180e567ea8b73bedc6d6a5c785edc3b59096ea01998b7318d7ce5f21f0b2fa51534645d58d56dcd77033b835e6c4c0286
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.3MB
SHA256 e4d6a2e52ebaf2f7c66b21120252ac9c153891aa043694a38bca694555480c75
MD5 12e5e7db4832093768e1a19a8508b1a1
SHA1 2e7c103f1bcb48501104fcfe97e0cf7d0d6c5a89
SHA512 08284d491d8a6359068583d03fc9666b078a84d801579661d54644482e01eb8d76b15641e5aa5283a333a0030c39bbb3e7e74437ae39f85092fc4dee9544f050
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EKW1PszNsQMgZ2HbbZt+jqpQ0K:nW1Psz4gZ2Hb9t+2xI
TLSH
T1D7B59D12FA830071EA7711B14CEBE27A4E75B7218531CD6EE78CCA1F6A33A51583A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6dee1746f9f7a4faaa4d17fa1ec516a6e32a905fb9a3d08daec7f4d1b354512d
MD5 614ce5237e9b8ce0fc38246c7550b20b
SHA1 9cfabc729fbe3e671518c9f0f2f2f81ee2a83386
SHA512 d38a1ae8c03e92752c7bd4d337709916963a5bf3e8cae7c710c5108ea4c5bc442ae33d1bfac0baef80d2fa3a5ee2a26a2192454bb8cf9397999f55960fc4123a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\qap`g`v~dtlq
Size 10B
SHA256 fbdaff6504d04396d2e12b57cd25590143a233e8e458d7371c5780081025f714
MD5 18c52dcaf89bec1a3373cdcc3e529811
SHA1 966e464efa7067c955b3602d7da7e51c06ede197
SHA512 3855af6af0eecafac06bacd7667e861927c998e0f6f2e48c937deef4b5820a308953f451112cfbd35ce484cad96230b84f6211a16f231ddecff83fe14c6e2cb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0684c94e84fb7d144f77f36061b8e9843e052ac20ce83ffa5e54f8b8a2b07e38
MD5 8c444d6765c6e34867aecc64e97af1db
SHA1 509dc752681f184a670becc33574295b12c6f5cb
SHA512 bedc67811ff4b585a71686facbd6c306276edf78b6df57fbf73c0519e2471ed5836bbba7bb6cfa1b45a345110a288a12e0b5e2618ffa280417fa72acd7313b32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f592c24cf23616074d2bf43c10b74fe44c7310beb6e44819e48ea2718e99f791
MD5 4fc72630728aa11234074c3232b3154b
SHA1 e04878bdba4e59bb2ca2bfe427bdff9a2410c282
SHA512 b65b1021dfbe2bfce7aa7ffb0d6a4cdb50f49aa352399bf2ef71e677c7e0da24d18a3d1c4adc465537d28f966d9166a43b5a7ac0b051ccabfc45b017619c58d3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c783deff7decf3647254ad67d4a1f0543b32f14fab9f3deab92106770ca24a82
MD5 f423b976edbbd38380fb2c4b14c52f5e
SHA1 9989a5e3f10c95dd9294582874a00c94dcd3875e
SHA512 8fafadf87780ff92e44f14547d2f10a710890ca5054e4902c90cfbf00ae222e878c0c0f8db3ba1706523ee1fb07654d52bde0f2ed3693102296b7e21e60c0516
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1532b49072a7518a8caba0dc622e41a6ff857d6e776206b5880bbf98e2f53df
MD5 c00cb6e59e9b3f820021d89cfff30215
SHA1 ffbf5328abd8b3484a0f8518bdb40b6b55837b31
SHA512 b744b41887e38e9b08a7ffd69688aa4887405221e7545934730e9558f7e9007a7138d02beae3822d6e5d18b4e09890f5ee022e8990960641dcee48ec4d03cdc8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 19ae13e26a2fe0983179a645146d23ef92930c34126c4ec08c210af86c1ebbbe
MD5 fe785d0d927b4b5ee24479029fa177e3
SHA1 155216ce3d2c80758da0b29bc7d306848349505e
SHA512 f956b45076c964a897bcb23f6785a6223debd344c955b495b611d839ee42a1939435e29de7bb2862e46e292fce5a253e250402aae7387d73bc6f86e18f1ab3c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Roaming\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 af87584d1cda5d6bd13c2b7bf2191be32b2e43982490a0faa5a94912f72c43a6
MD5 9e6d4f64d595c09be5d6ce4cee056d9a
SHA1 3412a9feffb166d7902864c16b25a7b465e83e47
SHA512 e83fb199e4e951cba46e8e9d84ce9e50d1d7f70a3c24954121784f1a75f4cc2f46261834f4d3f4036b63ba3fd18f65727d88e3773314673838d610da610e4f11
MD5 SHA1 SHA512

Submit Download

svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCBBBCAABBCBCCACCCAAAACCCBBACBACAACBBBCABBABBBBABCAB.exe
Size 1.7MB
SHA256 6cbde6b63e5816c302081ab36f403f2f43445d3d85388f042965281a1e909e38
MD5 fe6db7cb33f8003a6313b3733770cbd5
SHA1 326fdc9babeebc554483287214539db8fed0163e
SHA512 403489229201aa04ae8cf02daa01661f91a573ed63e731a4ec2cbc8373b97edd198d13383cfd8a93b2a4b97854286d7d269cebf3908857b26c3844be7c74e8c7
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EKW1PszNsQd:nW1PszZ
TLSH
T10D856E06FA8700B1EA7B25700CDBE3BE49757B218431CE7EE74D8A1F6A33B51581935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9de8d1257bf4a2d79edbfb33e8029ddcd58c8f25a641fb42143f911a7999c891
MD5 856d7f94fab4650109d44e483009943b
SHA1 f0a5f8b83f1b7942c600d6a221af7d4401518bd8
SHA512 5777703b61770b05761714b08437495b4d3b51d3db8f6b49f6e6588bef9a80cab07be6fb0b21bac6bbc7522a3e61f4259329798fedda6816eeb105afe75fd673
TLSH
T1D8115C51D0E9C8D7F433A88F931AD8E60CD876865CDCAA282315F12CBBC9C310E5D4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3512-35-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3512-22-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4288-6-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/4352-71-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/5520-855-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/5520-66-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download