c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Size 4.0MB
Sample260910-28tkcsfa57
SHA256 c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe
MD5 cf3e9d0a527e0b5ec641daa7fd7a36b1
SHA1 286f72754b52d2c9883264ea9ecb6d1f2faae5c7
SHA512 59cdec593f12c2fea6464cb6f31d3f74f013ee09d5ebdf583e9fa0f34c7a825fc38ead4db76ba77efe0242d8272534bf88882a3e13ed54b7f5099ca4810e5ce7
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ee:Z
TLSH
T15D163B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
2908	svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe
1820	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBBABBBCABBCACBCCBCABCACACCBCBBAAAACABBBBBBBABACABAABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe"	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCAAABCAACACBCAAACAABCBBBCBAABCABBACCAABBACAAABACCACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe"	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3232	sc.exe
4796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2160	cmd.exe
4992	cmd.exe
4884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
2908	svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe
2908	svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Token: SeDebugPrivilege	2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
Token: SeDebugPrivilege	2908	svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4052	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2160	3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	101
PID 2160 wrote to memory of 1860	2160	cmd.exe	103
PID 2688 wrote to memory of 4272	2688	svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe	104
PID 4272 wrote to memory of 1284	4272	notepad.exe	105
PID 3308 wrote to memory of 4992	3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	109
PID 4992 wrote to memory of 3232	4992	cmd.exe	111
PID 3308 wrote to memory of 4884	3308	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	112
PID 4884 wrote to memory of 4796	4884	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAAAABCABACBAAACCBBBAABCCBBBCCCCABBBACBABBCCACBCACBBACCCBCBAABBABBABAAACACBBACBCBABAACACBABBBAABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCAAAABCABACBAAACCBBBAABCCBBBCCCCABBBACBABBCCACBCACBBACCCBCBAABBABBABAAACACBBACBCBABAACACBABBBAABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe" start= auto displayName= "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe" start= auto displayName= "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACAACBABBCBABAACBACCBACBABACCCCBACACBBBAAAAABBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1284

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABAABCBCBABAACABAACACCCBBAABABBCBBCBCBACCABABBACCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
1⤵
- Executes dropped EXE
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49db6350f1691ec9b622f86b245b8db7eae976b5a0785bcf32b2b23f385fa97d
MD5 5e115f83216e22cf0365362db9ad24a8
SHA1 a41150e0b8a459f18c64eedb4fa1d60ca2a5c4ba
SHA512 8be71513695146e1b2c6aafe7c97ceed56542dfbc616da9f1827a9296a5f75f8320c7ef13889d7a1356bbd32d18d73ac4773c08d69575fd972b61869daaa7e44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33d6da3f30c62f64c70d63cc0376693edc21e0235db7ff34d096f24dc101005e
MD5 d08ad819d769d3b3c3bbe1f86810cee2
SHA1 a70762351cbd25a777dbd39aa2501f72aa1e0c68
SHA512 9db928cb4896c340822da5dd8a2b2017cd4305877a4243508729e9b5026e5c7b7242c80908223d73201ca889ab261cf0175445968b76b0068be5d75941bca64e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 629bf68d2bcb9c4e02c6ab336c0767b33520e4202aebeb01504dcc31a66cd408
MD5 1033afe4b005e42d0056f3d3b573e0ca
SHA1 de7a2f60d1f580d3fb78b1029b5787c4a129c946
SHA512 752806f85746afe9210062af4dbe9ac67547b570d2c5d928bf741c89922d736c55d476e95ca0d2c825b02c66704982af44b8de903db017c50b7362a9033327fe
MD5 SHA1 SHA512

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 44.6MB
SHA256 20f0966a1b0a6f521838f77a885e1c13dba002e3f297b9b67a2263c756700ddc
MD5 d61751d37c269127be77dcd8b33e9f97
SHA1 605f2de0a4d20b4585f9e00e045d50ca22af4082
SHA512 0ee9dfd26064becec3399aa842730296489969f25b8e961aa87aaadb3ddc37c8a7f773c37d6d17c8c4d52ba6dcd264e976452a963480e4e245bf161af33be3a3
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+E5:Y
TLSH
T15DA73B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 24.7MB
SHA256 11288f9e6f3987cbdef6594681bea7c8f196a1ae7fac35ace3c5d119e9996cce
MD5 9c61f1f5f17921b4a896ee8db4583879
SHA1 643bbd3a4b3af06e3e0af9bf4972d8a04b456521
SHA512 83a113184ed875b09ff4dc72bf5d5d7874b76158667538b2a5e786bb5b7375f59cb36da4337fbadd2460eb9f2884df19d3a709fc0220ff5863dc952e84800899
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ei:DI8AXupH
TLSH
T1C6474B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 28.7MB
SHA256 abd5e20d67ecd67ec7b347488dc00e44b4bb5708d9d76d64670b98f121d7ba7f
MD5 6e71f29dd48d5bf0b265d9de5706fef2
SHA1 cc4b18a344c342bc892d04e9e13860e7bfe2aa35
SHA512 f1f8a75dc397f9b5a8aac345b4a7925732afe8b51eb5305784b46b6a7a89e2b948d7d385e61a652ca68991a69a6e0b892d75fbf0250bf78f67c65793048ad79a
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EZ:ZI8AXupA
TLSH
T1CC674B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 32.8MB
SHA256 77db977e6e5eca87d8bc5b120a9c51a130d3de046e9aaa31ba5a460399cbf32a
MD5 5efbd39b12b26d99e9df44d9ff5e71bc
SHA1 35de9b806792a0e75e7676308ddcd17eb61c1091
SHA512 acff94fe8a07d35b7396c047bf7e90c4819d2494f9d8ada473e0f579213d1c5753c67bb193ea812eb9b9e4332328e3b866f092fc503b65aa0ac43d8f96653990
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+ET:vI8AXupC
TLSH
T127774B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 192KB
SHA256 16d4f1daa4eba9a7d0f57961f87193cc5b92f310bf374c3de0d081f15edbe792
MD5 91b048bf4eae652fbeb7be6c1fedab53
SHA1 3bc6885d60508dd91f8ef2659e4a6872491ad504
SHA512 0a4d7107d4c0afba832aece4adf60c8b0ff9b6c3bd7d12df586b25be11622a3f3be8078de48ad2d0a5979785ace70cc01ce36e5c4a723de1a285a1ed05019a9f
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoKdtpUtI9vTTLoFpmEY13XojAdoKdtU:m+dTTUFgEs3XojAdc+dTTUFgEs3XojAo
TLSH
T1F5142B09F94344B1DD2B50B04DCFE2BF8A60BB25C6124DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeStop.exe

Path C:\Users\Admin\Downloads\OptimizeStop.exe
Size 31.9MB
SHA256 df0e5a179c614aa832418196bc2b3329f3885f9d29d9e04bac32e0694b289875
MD5 3ef2c9d3805437ad2947c82b961a39e5
SHA1 8e45a6b93829e1a54ec5aad0cac1d1ae2674853a
SHA512 efaa51cc58434e6472cb97e0dec74c174eeb7164e8d4dd9be992075a4a85dafc7d02c923d5ee9d632d6faa6e92a16b7f93da5e9960c51e80b0061f4fcd611149
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ep:A
TLSH
T113773B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 359b8ac1045d828a614c338aed764a74ed7f27e53ef1781dd768042b3ca67336
MD5 4635fe8a1f8c6843dd5ccd065c258e3e
SHA1 1f4c30e5f33a5406ea4cd7867e45d129f1bff37a
SHA512 be66bfa47d58d30ac4e632449fa2c6988a83cffebc119d0048e2a85a8bfae426d10a81cdfdb37e14f2fdd555dad5013d1e19a5203804bbf5d26b862cd643ddfb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ad3d730dbbc21c44c8d9eea8980d85994043732c8c1afc1610cdfcdafb2dbd66
MD5 192cffc47693ad9cdb8984044f5fdc4c
SHA1 28cce99b8560ca0b067f410a1a84c09243e49136
SHA512 d7b7ef0d9e1cd560178298246d79b83448d986702ba2a72efc9b358b494b46284185562b0df6f5f0a8fb09d627b7feebd7f0199732788f97ba871a319b1689ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d82647989fb50995bf9944c6e8e1176a4f3dd27543aed92428b26272819e8b11
MD5 15e298d1d3a2d9335ac2410db69b1cd3
SHA1 0cefaeb9556e60dab71bbec5323fc9997e502d27
SHA512 9372bccb7580fedcec37f7f1d099ce63f66dfee5535475a66f91616face9372b04839f6b98e43831a8e53016fa2237e5657148e49807668fec2cc4af1698af6b
MD5 SHA1 SHA512

Submit Download

svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBBACABBAABCBCCACCAAAACCCAAABAACCBAABCBCBCAAAABABABA.exe
Size 4.0MB
SHA256 c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe
MD5 cf3e9d0a527e0b5ec641daa7fd7a36b1
SHA1 286f72754b52d2c9883264ea9ecb6d1f2faae5c7
SHA512 59cdec593f12c2fea6464cb6f31d3f74f013ee09d5ebdf583e9fa0f34c7a825fc38ead4db76ba77efe0242d8272534bf88882a3e13ed54b7f5099ca4810e5ce7
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ee:Z
TLSH
T15D163B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 bedd64422a95ac08d5483c836578fd8a59c398fa5d880ed554a8f47a591dbc24
MD5 b67f1cc7203c2dec031d46d7f4228bda
SHA1 a4474a615d7910aca9f6271872d5be7a06d028cb
SHA512 f56212fb785bcdb45c37ad63d131d0f0d60814f80d8e888f99ccc9ac48d06b5149d9da4dcf776f36876a0524f3407b52b20b3f02bba13ba7a26d877808d77984
TLSH
T1CD11E37190F5D893F23268C7C5369FDB0DE43687A8BCAB04631E4619E7A9C34CE114B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2688-37-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2688-76-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2688-52-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/2908-101-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3308-75-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/3308-25-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/3308-51-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/3308-12-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/3308-0-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/4272-78-0x0000000005100000-0x0000000005101000-memory.dmp

Download