6231540247ffc5658c9d01a9ea9c969872de6640cc060a80b6274bedbe416fa0

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
Size 1.0MB
Sample260831-g4wtpsyvay
SHA256 6231540247ffc5658c9d01a9ea9c969872de6640cc060a80b6274bedbe416fa0
MD5 b3972c2f7260d4fe514a9c50cfebc5c3
SHA1 4dec9b4c1d05bf1d2df7a06152c45fafa9279cda
SHA512 eab4ce1c080903c1d953c690fc677a07853024a33af6e2c9cf434ba1514d7b1ff188a20c0f37dfaec76db24534df07f1448cc74f2163abf9ac0ce7c9cf491851
SSDEEP 24576:m9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+x:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Exm
TLSH
T181351B0AF98740B1E93B51B00CCBE3BF8660BB2585128E7BFB4EC75FB932B515819255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
4248	svchost_CCBBACAAACCBBCBCAACAAACAABBBCAABCBABACACBCCBCBBACCACACA.exe
3380	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCABAABCCCCBCABAABABBCCAAABACBBCBAACCBAAABACBBCABACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe"	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACABBAABCCCCBCCCACBCACBBACACBABABBBCCABCACBBAABACBCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBACAAACCBBCBCAACAAACAABBBCAABCBABACACBCCBCBBACCACACA.exe"	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4128	sc.exe
2408	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
1144	cmd.exe
5016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBACAAACCBBCBCAACAAACAABBBCAABCBABACACBCCBCBBACCACACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
3380	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
3380	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
Token: SeDebugPrivilege	4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
Token: SeDebugPrivilege	3380	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5088	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3084	4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe	97
PID 3084 wrote to memory of 3536	3084	cmd.exe	99
PID 4656 wrote to memory of 3940	4656	svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe	100
PID 3940 wrote to memory of 4768	3940	notepad.exe	101
PID 4236 wrote to memory of 1144	4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe	105
PID 1144 wrote to memory of 4128	1144	cmd.exe	107
PID 4236 wrote to memory of 5016	4236	2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe	108
PID 5016 wrote to memory of 2408	5016	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_b3972c2f7260d4fe514a9c50cfebc5c3_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBCACAABCABCCCABBBAACCCCCACBABCBABBBBBBAAAAABCBBCCCAABBBCBACACCBCAACBCCBCCCAABABCCCCCBACCBBBCBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBCACAABCABCCCABBBAACCCCCACBABCBABBBBBBAAAAABCBBCCCAABBBCBACACCBCAACBCCBCCCAABABCCCCCBACCBBBCBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe" start= auto displayName= "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe" start= auto displayName= "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAAAACAACABBABAACCBACBCCAACBABABBABBCBBAACCACABACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBACAAACCBBCBCAACAAACAABBBCAABCBABACACBCCBCBBACCACACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBACAAACCBBCBCAACAAACAABBBCAABCBABACACBCCBCBBACCACACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9a2c4b90bd2a6129bf3f3b3b3b5d20a3570c15827a8d60694b411b3505c282cd
MD5 bda133a5da4245151b95300692503f89
SHA1 c790489a0b0d2c2a56d0b90e799170f5e4f1c45e
SHA512 bfb40fb8c7657855ea9c4ce834392039b863968e6b54e01f32ccde965c1ac982e12a2bc8f3026f406e0a8c0e735346769fc6fe9ad679d0a3c07e4fb52fd86756
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.5MB
SHA256 e972208c11aa1e4d9de66162b828d72069e3fa622d77c099b69d96fdab8c47d0
MD5 db80cf3aa9514a1ceb18893606005237
SHA1 2d427580263481a00f6c059235896ac137eead30
SHA512 ee13acf9702bf7b33473004ea95b887255e709ce8d291454e761c715757b3123155b80cdf0ee73fe276acadf15715fd6c46b286a269910df9eaef612c0ccf18f
SSDEEP 24576:m9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+2:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Exv
TLSH
T1AF654C06FAD64071F97752704DEBD2BE4A71BE218832CE6FF749871F6832B509824762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 da8f2e34ccc89d4ae31298cbf021464f6b28ccd7f33e8d66b64fa967383da757
MD5 9c09bb13b381ae8b1cf5f0e2a8c92ec1
SHA1 4c0a21cbc32338e22e5f3087fa2269b8226dc24c
SHA512 243871a16ceefbe3af556334b4fcaf3d0463d2f16fa74f8984509293ab4b0d2a85d71ffbf841c23edc6aed8802e5aad21805a1e34bc08b92ffc94c15e0aeeb34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 3a1969bdfe5e094a2df811a2c56d7b093aaecf5188959c7ad0967680597ad1bd
MD5 09254becd398b722d2359495de4b7ab5
SHA1 c1e45b54ac89e58981803e9f44e75d4447f01de4
SHA512 64fc509200b27f5562c2f23f145bf0d9b58e122c64d6ff0e62978e5281ac95754554142c133875597d2a7029a36c12b2c45162515adb4b1f6b680d0f4626c3db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.HEIFImageExtension_8wekyb3d8bbwe\Settings\qap`g`v~dtlq
Size 10B
SHA256 0b485af63c55f6f911927cad3b05b138e54a277e19b07468529bdd8cf69f99f1
MD5 8158f9a6d41c12854b5ca313789181e7
SHA1 cdd46fdbf629b47a9734fae7105a3adebaea3652
SHA512 c3a35556056347cf3f5cf3530ae607f594d662b4e79a2eb38d44c42bd7016c57329ea855c8cac98d6cd21fba456b6baa125b53c950fd21e4f54a90ff54133665
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf1e5fcbb3c4a5c0f048c49f1f18ad2b54bab4ee4e9e623430c253727e1a5d4e
MD5 d94fab220d7c2b0bbd415665087b4512
SHA1 5344131e414f18edc1eb96daf5190b1a18ea2d0e
SHA512 dc7df55eb05a0eeba76a961ac8411cf35ddb3f6591cbec93e518a76156729b449cf35abd6e6dafae63cf9d83e322fec81ae1b6f4dbbc25dc09c8a922034d8ebe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 022e35692ebaa9fcc25f9969db8ee74c7629b4ac156d397d529a6a4f63c4bd8c
MD5 fbba77da565500989b6dd4cb84df46ae
SHA1 df755f6a41bcb74bb914e6062e80f413b19f7b74
SHA512 013bcb016d8afaa0d8c1e897f23503d147d61a940c569f9c30bf5e18985ae17509e3f227da50f392315494378bf6c68b8ad09894f03404ff532c2e99573315ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 609ca2c131381db0e001517052ed8be0fd70beec495884a36d282becf383a29d
MD5 0ba54ac88abfe7ad00e0c91dfd93235a
SHA1 9b6d596c17c652ba1eecd081bbf34a60fc79faba
SHA512 3aef35bd52fbe5ea831af4aefc8b23c1cd492043ee427d7e0a70e0f0d77d608860c1fc7e33b6396aba9b2c2affde08363db00eb86524d9e7708fef9fb25bab7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfc1b983bee79f1d629dc87a74ed90e540a5678b8e2edd50fdec50fdad2fdfdc
MD5 5f8459c73ed2f1e6ebb167fcbc1c72ad
SHA1 77f9e60c06e748d1aeef16f7b19729cc2de586b7
SHA512 4ad0074008de74d8675a945dcc2b004e49794a61fbb199dbd19bd7374d362a86f0bfcf743db2b47a51a59e6cf17a24671d4b8cda51c6fce73658a9613a785caa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27e78032111be74d29f7e9c724a0d2e3a946ae6cdd36a4e685de2140de931e51
MD5 05593d0f2c2ce923528b754c6aed33d7
SHA1 ea17b5cb7617c6afbc187b69655bcacc01772753
SHA512 125476a1cea054292513dcda16304269b13eb7244da17ee677323b0d0be832a0fc0e3a3fff4b249f2814d4f4eeb6bdfa30328aa277717e1bad0cd0444edbf759
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 741f400bc2a483a1edd3fd23667c07de5ce8bca77275c5431d364e6d12b85303
MD5 0a969b2e032f44e1811105b5aded5bf3
SHA1 c5bb6fa57ad858781ac58c49ba380cd7f4f9bcf0
SHA512 1792273b7b0f99278225d118c6087fd2203f86311d6ffd66fc519fae6a5c768ae116082d1f89628be9081e74d0af9be8fe9e275804b00d02f49b5c46d3f2ecc7
MD5 SHA1 SHA512

Submit Download

svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAACBBAABAABBACCCCBBAACAABBBCCAABAABCBAAACBBBBACBCBCA.exe
Size 1.0MB
SHA256 6231540247ffc5658c9d01a9ea9c969872de6640cc060a80b6274bedbe416fa0
MD5 b3972c2f7260d4fe514a9c50cfebc5c3
SHA1 4dec9b4c1d05bf1d2df7a06152c45fafa9279cda
SHA512 eab4ce1c080903c1d953c690fc677a07853024a33af6e2c9cf434ba1514d7b1ff188a20c0f37dfaec76db24534df07f1448cc74f2163abf9ac0ce7c9cf491851
SSDEEP 24576:m9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+x:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Exm
TLSH
T181351B0AF98740B1E93B51B00CCBE3BF8660BB2585128E7BFB4EC75FB932B515819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 d4b017902375d241210984e37d1dcddcc49d99cde8c3aef84fc5456218097b05
MD5 6555200b20bfb097817ade493be5e04a
SHA1 489746600f16e5090a0dde90cb75c925634940f4
SHA512 722d2864f978070ac3cd6002dab7718e05b9c5ad0bb9bf2a0c191e7f734370443c0b0049cdcc623bb52570cf3addd4cc9fa112335f737bfbc4c9552c7424fce9
TLSH
T15C11E761E0F5E8D3F4326CCBE915EAC74CE4B6CFA89C6A84235C8218B799C714E554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3380-83-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/3940-59-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/4236-0-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4236-7-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4248-72-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/4656-36-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download