9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Size 15.3MB
Sample260910-ffsayaybme
SHA256 9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d
MD5 76ac0f3d091b6dd243e31c12ea13c689
SHA1 9cbc7779b38c3062b37280bacf736997df00b4ee
SHA512 97ee5a7f37d381e05be3aa096fffc71fcc1432a1be20df7791af7c2204e27793377b8f15c0caae43611cc09cc570b91b613ce822fb275b2171cd66aea4d40508
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+E0:W
TLSH
T116F61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
1896	svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
2188	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCAAABBCCCCBABBCCCABBBAACCABCAACABCBBAAABCCBBACAABAABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe"	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCCBACCAAABABCABACBBBCCCCCACACACABCACACCCBCBACCACBCBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe"	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3764	sc.exe
3032	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe
4172	cmd.exe
4748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
1896	svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
1896	svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
2188	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
2188	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
Token: SeDebugPrivilege	3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
Token: SeDebugPrivilege	1896	svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
Token: SeDebugPrivilege	2188	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2940	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4748	2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe	96
PID 4748 wrote to memory of 4016	4748	cmd.exe	98
PID 3312 wrote to memory of 2084	3312	svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe	99
PID 2084 wrote to memory of 4556	2084	notepad.exe	101
PID 2832 wrote to memory of 5112	2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe	105
PID 5112 wrote to memory of 3032	5112	cmd.exe	107
PID 2832 wrote to memory of 4172	2832	2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe	108
PID 4172 wrote to memory of 3764	4172	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_76ac0f3d091b6dd243e31c12ea13c689_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBBBAAABACBBCAAABACAABBCCBACCABBBAAAABAABACBACCBCBBCCABBCCBCABBBBBCBABBBCABACABCACCACCCBBCBCBBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABBBBAAABACBBCAAABACAABBCCBACCABBBAAAABAABACBACCBCBBCCABBCCBCABBBBBCBABBBCABACABCACCACCCBBCBCBBCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe" start= auto displayName= "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe" start= auto displayName= "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAABCACAAABBCABBACAAAAACAABAACABCBBAAABBBAAABBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4556

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCCBBBCABCBCBCBCBBBAACCAAACCACABBAACBCBACBAACCACCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3b7469f4fdcc3922153f26e2c7f4f0d986c25ab9ebc28bbbd530fa58b490ae8e
MD5 bc45ced618d9bb1106cc4e875fb34a81
SHA1 7d812cdb7817a08cff52ed9c6f76447f2488736b
SHA512 ae978b3f8374c6d604435a3056e2df8091ea49ff0b8c55bd68ae4d032f8b5bee16828db2bfeda084d58ae3d07512e788644278df0ce4e85723d42bd9eb00c450
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 0edda4a1c6a4bea2e04078bddabc4ac58a8c2ee0a58ad8bf482a64bae7a2f790
MD5 b1324ada4774325be1eb61ab9bbfabd3
SHA1 014d99b9f071778f008c59cac541c687ef7070a4
SHA512 cac0f12b7e698aac46b400df99202da54e77f27d5aad38eb8b045afe107ce19c6bf7530545b9a9071ae5ab87130a1cc6226b253d231e246779c1d95236d46027
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\az-Latn-AZ\qap`g`v~dtlq
Size 10B
SHA256 be869bd804aa67df38fe65f10e075d85cae912cd81620f0b40725acf13604bdc
MD5 96039a4225a7d9cf0fbe5496e6f6d659
SHA1 65b573a189a407a43879afc6446afa0f45f6c8a0
SHA512 f3e64129248a421d2801937f1dc285f2b30862a30353a904cae38e24e18c56741bff56c6d9e64583c414d01a3e8b305014c005c98ee8be667ce5bc28c3b6519c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2362823990f0a3a0a8612779376177df889e96e7725e8c2bc5a1c3bc92b77b75
MD5 b50c88cdc6df7ac9f4ff05f97c29f169
SHA1 3bfbdf0d7b6d2892fa950ac39996e40a10d15918
SHA512 f3bd28a3193d53a87c3f20baaf845e617a26fe2ed6649617635dc53c8785c6a92411677d05c36039b554cc1710bc094f2e74fe9ef2f1ef23ecc1029febe46d40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 90ec7cba14650640526339359ffacfd0507a46b8723518ab27fe3a68a78dce90
MD5 963d826a37799590dac4d2e7e524a74c
SHA1 0ca1175a4c67a0d95d8b9eb42561156db03392a9
SHA512 ca8691703f17c5bbdb2d0fe3ab7793dce1d4eae0ea2b224f676ac5315115ca074d58b7263b5b2df9efd4066b2da980e8fa861318d3da9fc0d7e867523ec79366
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f6d06b119272a108f8e7c5e025b863f7439aad43ef2edc39eb383b62020e588
MD5 f3766c916795da3d62a097f0a0758af0
SHA1 55e51f58bc1329f38d30da197b1ac91a4afa2b3e
SHA512 e8749ebdf24f0c8fba3f98cf59f4719ba2249d9c135dc000b0404458156c6b6d3a8c0a571dfd87f92cd5a6876490c5ffe6d2ec8db196d0caa54156f5d00ed0fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17cc2cb7b786bb56f708a3b2b8e7962d3708b1418fb696c6ed64345961e2e008
MD5 43888d359f9391cb7ee44dd843996385
SHA1 f0063dbb705dee3ee4b6bcba068560af43725261
SHA512 98114749c604800390e8927267ab4cea2b5a7954f091f753f62a33cceea7d3689fe5a7ad57877428df35ba9ec4308de24f6e38badbcf5e9a66d54dea6f4ff5e7
MD5 SHA1 SHA512

Submit Download

ReceiveDismount.exe

Path C:\Users\Admin\Downloads\ReceiveDismount.exe
Size 30.8MB
SHA256 55d7f9f2f043c8eb179eaf0c47695c69dde3393ebfbcc14e69168d29482e81c2
MD5 3a7e90a9f19e8dbb50748752ef3893a5
SHA1 23428f6f9f3c65bf4d38054ccfe5b856f294f5bf
SHA512 a64845eb61ece09679cc4de600f9f7e7abd502e83f3914e854100579f906b32edec31452b924ba65fad61c45b63f03cbb08e43e5a83befbd527463550a9ede5e
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Eb:4z/oj
TLSH
T171671A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReceiveDismount.exe

Path C:\Users\Admin\Downloads\ReceiveDismount.exe
Size 91.9MB
SHA256 f9312d23a12a8ca6dc2d3ecc520cdccad16c2f32f84027eb9c7b733aa25b9474
MD5 8abb40f7b12251188895a9e63c5c04d7
SHA1 df45e4fa73ae528e0cbb8b14fe1ea368735fc1b9
SHA512 390234202bc9d66f5a8245b093d17ae387b2e2ad0a945b2e09bc35d726fda63a8099d38e06aea1f0f6e24656db686bda6027eaeaf403b547e39ca7ffa656f541
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+E1:Iz/o9
TLSH
T1FD281A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchPublish.exe

Path C:\Users\Admin\Downloads\WatchPublish.exe
Size 91.8MB
SHA256 50f4512fb6f78a926a1349d46d9fce1c83678b0ce3d8053202453e16eb12059c
MD5 149eff5a4d25494057933808c796532b
SHA1 12e799394eba5a411017cebca35e4e82d6c54853
SHA512 d2f282b3966ebfce7463d708eb248610c176b5d2d216244a48e94d1718de9ff8145ba1517c382d102749993f40f1a589f6a292d2c14a455ed5d6a87602dfd914
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+ES:nL4
TLSH
T12E281A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c7dd551b8e5f37465d7e7f251466fc39e1ba496eb28f99b9ad09368bc9307221
MD5 98900ea4ae52efebe9f94a9efb0f0979
SHA1 92809c741b4fc3d7f145f437e859bca5aedb845b
SHA512 ff052bd7bc9b8abd192a465a6990d360f7da576d8b9d4612b6c47ef3c2ac3371487feaadbbb5d1d2b29368521d4f246953b06fe14b4b3dfc41755e36c42c65c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3098c48c6a9ffc8b91f72223b98ff4f7c6cdc7d18d0fb81e50c46aebb644ce6
MD5 a97e65ec51ec2f2283adeb1dd895bddb
SHA1 8494c9a01e658f118e7bb08163fd0be30cb97dfb
SHA512 b91efaa874cf3a96abe72658f0b20ea66d606517278873b198ad4c400493df676bdf96c5e24213457f7995557df31f764a7bd1bf2da10f23851c5cda157e8540
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 694b10549bc58fca86761f4ff533e2fa3a3fc6b4cec49ac594db51f2446feca9
MD5 016cf3b6ae42d4932e8d5233ec3afbde
SHA1 10028aa7df4e826a3f69cd57a35b2f30dcae9386
SHA512 fc4db151625f06680ea755d9fb80bb5632f5deadbf593af5b3d63623ca4567ded54e78a14cb6a1ac03853f8c9d23ce2758a72274ad5f40db18a589dcc6cd467e
MD5 SHA1 SHA512

Submit Download

svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACABCBBAABACABACBBCCBACCCBCAAABCACABBBCBBBBAAACABBC.exe
Size 15.3MB
SHA256 9fbc522dff1519d87c92a2476fc818ebfb97ce382bb11d75ef0e943865fbbd6d
MD5 76ac0f3d091b6dd243e31c12ea13c689
SHA1 9cbc7779b38c3062b37280bacf736997df00b4ee
SHA512 97ee5a7f37d381e05be3aa096fffc71fcc1432a1be20df7791af7c2204e27793377b8f15c0caae43611cc09cc570b91b613ce822fb275b2171cd66aea4d40508
SSDEEP 49152:U+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+Et+ES+ES+Ek+ES+ES+E2+ES+ES+Ey+ES+E0:W
TLSH
T116F61A09F94340B1D92B51F04DCFE3BF8A60BB2586128DF7FB4ECB5BA523B616428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 302318cdb593fbfaba8bd5b815272fcf9a724bf905f4a635ea1f0b127874180f
MD5 20e50618cb3f70b8c2c2b4618ae0ffca
SHA1 6a7c2d87bd24d804ac5ebc986aeecde3ff9fb47b
SHA512 7b2e488fbca4f3a1ace4461eaccdec2efca5ddc0cbc248c2a232187e9d12381aba316b8b12508f09f3b7340d07b8252c085ae967063cb9f32e31bf693c1b8b0f
TLSH
T18911BF40F479D823F12169DA46299BEB1CA4379F7858AB05238C8219BB19D39CD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4c9b47a7199af586b9e9d6ebb5db9c15567ae0d67bb206b7d892c5300d306be5
MD5 16410eb5c04b1a90df1de50b8f91de63
SHA1 57716f93399c5e7fe359e59ed41d210ba7c2c631
SHA512 b78a00a491878d19c84ec570c391e48159dc405735449474ed8b0256c171bd3b5342913bd96f78d4f2f0a918ba84bbba0afff5ba4740fdb2335a045082d2f754
TLSH
T13D21CF40F475D823F12269CB5225DBEB18A4379F7858AB0423884219BB59D3ACD594E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-104-0x00000000001C0000-0x00000000001E1000-memory.dmp

Download

memory/2084-96-0x0000000002A90000-0x0000000002A91000-memory.dmp

Download

memory/2188-126-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2832-124-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2832-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2832-93-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2832-65-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2832-31-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2832-15-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/3312-115-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3312-84-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3312-63-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download