4558556e9c432202b128ebf29273f6c19c06f608565548a57b322d179736f8a5

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
Size 22.0MB
Sample260810-b7cbksyenh
SHA256 4558556e9c432202b128ebf29273f6c19c06f608565548a57b322d179736f8a5
MD5 ebc6505230ef6c952cfe1d8a9fe6e9c5
SHA1 3dff434cb751177b8f2da6ffca513409d0c47486
SHA512 00ffcbab66492d7cf2d43c19cfb51a72241fbc24a3a4dad4ee9b3f4691fc72a3cf6da446250970df09e12e5614541ea7b029c75ecfa2ba4d54921c34806fd27c
SSDEEP 196608:vBBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBBq:C
TLSH
T1C1378C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
5100	svchost_CABBABBACAABBBCBBABABCCCCCABBBBABABCACCACABACBBACAAAAAA.exe
3084	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBABCCBBABCCBACCBAACBBCBABBBBBAABCBCAABBCBABBACBCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe"	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCCBACCBAABACAABAAAABBCCCACBABCBCCACAAABABBBCABCAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBABBACAABBBCBBABABCCCCCABBBBABABCACCACABACBBACAAAAAA.exe"	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
716	sc.exe
3412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1284	cmd.exe
6076	cmd.exe
1212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBABBACAABBBCBBABABCCCCCABBBBABABCACCACABACBBACAAAAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
3084	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
3084	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
Token: SeDebugPrivilege	1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
Token: SeDebugPrivilege	3084	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1284	4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe	95
PID 1284 wrote to memory of 4848	1284	cmd.exe	97
PID 1680 wrote to memory of 2456	1680	svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe	99
PID 4556 wrote to memory of 6076	4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe	102
PID 6076 wrote to memory of 716	6076	cmd.exe	104
PID 4556 wrote to memory of 1212	4556	2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe	105
PID 1212 wrote to memory of 3412	1212	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ebc6505230ef6c952cfe1d8a9fe6e9c5_elex_stop_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCCBBBBCBCBCACCBBBCACAACCAACCBCABBBBBABBAAABCBCAABAABACABCBCACABAAAABACABBCBBCBACCBCCCCBAACACACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCCBBBBCBCBCACCBBBCACAACCAACCBCABBBBBABBAAABCBCAABAABACABCBCACABAAAABACABBCBBCBACCBCCCCBAACACACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe" start= auto displayName= "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe" start= auto displayName= "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBCBAABCCAACBCAABBACACACABACBBBABBBACCAACBBCABCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2456

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABBACAABBBCBBABABCCCCCABBBBABABCACCACABACBBACAAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBABBACAABBBCBBABABCCCCCABBBBABABCACCACABACBBACAAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 38a4150c276749c8f82ecf5325dbe68a276810867bf40ba027a78cac7b7c1b2b
MD5 bca05030342b83320dbba6d6e65ad572
SHA1 68a8f4db358badbb0605c175f358864d50ade671
SHA512 2b4800a47339489a4bec0b50db01bac6289aa66ba3a8ccc54a70d9f8073d59fa51b4e5b911ec50c7c5ed4d86d6441709de28ad3317502db11eba3849de3616d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\qap`g`v~dtlq
Size 10B
SHA256 d1291c139f53b856465699277da15db5a49880cdfaa9dadbab86f44c2c1ae971
MD5 b20b7c29f30a7aba39eb8b0717330721
SHA1 bd4b7381d1f97e0c4ef300b8b3df22eef44b344b
SHA512 9825388dbb74854053041bbadfae0fcdb06bf9550ce975440daafe91be2bfb56dae565fd764961c7182c54d7cd8301047db2914991d2e2dfd2f327a4af5ca738
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\System Volume Information\ClientRecoveryPasswordRotation\qap`g`v~dtlq
Size 10B
SHA256 72e4202982da0d3bd0049a59ee1fc253ae58f1f2fb0031b2c734bbc2e85ac51c
MD5 882e3f1bcf50be6f03e7d520833c5aae
SHA1 5c95ef9dade32f45bc2e1572f902ae0a4973e988
SHA512 1e90cd6acfbf971b2f5142c2fa5e548b22f99a1e4654184b1e802ca758d9f823c226748c88038342cf5f0cbc1e6a2ae02982508f61f4c6319fbca57076aac455
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\qap`g`v~dtlq
Size 10B
SHA256 2c49a9860746e987d996125cbf6cb14828e51b4ab2c0ff964d791dd778242442
MD5 ae6ee521d6f5f043f62c400d0a5936e5
SHA1 2eca06c88a5e754096fc46df1bc1eb83be8842a0
SHA512 17089084f2b1ca278452d81cc77af57ebea39df8cb364f13fa02634e70d17fee4482241639aad164b446d79accbb9a113c391c57d61ef4af4bc52849a05b2d7e
MD5 SHA1 SHA512

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 1024KB
SHA256 c57d5a0081ca1dac6083943f43b727964d24ad3a3ed81af9700ca392be3dd9ce
MD5 26540ea3094289482852cf92734db158
SHA1 1181f9ba9580a498a8abe4860c7f50498260766e
SHA512 f26f9bfa28f5cc84e496274e7066c31b9a6585fc7f45313e20b452053a8d0bb898f73c29cb320fdb599bf2ad1c580bf34738047366b04761a3d0d47f689215ba
SSDEEP 24576:m9+EM03afDd70iTWCa9+EM03afDd70iTWCa93:U+E6Dd79WCY+E6Dd79WCY3
TLSH
T1DA257C10B7818035F5B329724ABFE339552CB9714F698ACFE388072E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0abb62c5ad8b451f74a517a29d01bb3d0e35ab4807a13bbae6114fe7636feb9e
MD5 62846d0a8ebd9c5f2d2f5371eb0c2f4f
SHA1 932afa0fa6abb5406127acdaab4418e1206f9aa4
SHA512 bee1669c1c520bbec0c79ee8ea64cf3806cdcd9b08ad2e7e8658fb94df13f4247188586699f8e96ac8b4fff28ac89dfbdbba080a3ac9980e825a6ebca60dfef2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ae37fbb540b5c421053bb41d8b04867d9d242f27dab261fdeaf6052e67bdf68
MD5 870267a6c5a5ce8ffae64cf9b1131472
SHA1 dcac676c5409a370304c8b6377bbfc3afb184668
SHA512 3bd3526c1d296e45336123e93c54fbb6c5b05626978e260a7625ecb2d1f6b0a4070bdf28a215c101d9ef84e8154119455d5ea95e9a8e8236fb3cc04af97a39c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f00899fb39c29663807b6aec96f9b77d180507b9c7aeaa84587e02603796681
MD5 6ce025ee1cbae0837779b6687c1037f6
SHA1 aa9059b267e215c16809fffe580b26ec63f31985
SHA512 dba7cc34bfc96b58ab0c2c1c475a7392318831e45691091c6010b2677279e7d14cdd00e090a9ac14958c7663f5bd783efe5527966846d2f8ec9386ae67ea9606
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a7d5b925ce28efe2e441a71be9c412c357aeaed5729e685873290e7eeefc65e
MD5 50ca014e2b4e80a1c4b90bac355b04b9
SHA1 5af4be1e003c8db3d0ced59d919f9f6718a1fea2
SHA512 fa19d9251794d7b9dd690ddb2bcbe25a76a6fb97a912f1beee74a443727ca94e7731471b7e9856bcdf557b3ee889e8350a28881dc33fccb9ddfdafe4bc16b573
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18fc18764b082a94344a862711e267e3810587dca65ecf9f5fb90e1f8644eeee
MD5 b9d8a2578280a2cf3e2471c4f2ccbeb2
SHA1 64a2b0f53ed16501bcd127da6b51a1055a9941b2
SHA512 c960aca0d8d0827f23656d6e348106d96db163629b1ffc4722cfb1044da1094f335d029159084fa56a5b138731fc86ad1447226cc798843ad057494e41a572ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 439129efcbf37fe1bc9a5684d5b9c1702fdeb404ea088695dd49fcba53df15ee
MD5 7e8d268ad53457ceb721df04cc9d9bfe
SHA1 b2824d2bb3e010f6fdec1df69ff22c1f37079145
SHA512 c7dc2f5e85b6e2758b4fa3148aa9d6b5d67d667997a3e7350969d0939c736fe2905e1bd29e35a171c9519b2b5176deb955566de413959e23a213976efeb5c757
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d6b15e7cf7594f8b6451658d2620dd31f916a416ab02622ed5f2981646a548af
MD5 a568141a4bd3f46a709810902dde4ce8
SHA1 c98f0d8fc5d479af94d7ff62f76372dc22fa23ae
SHA512 1c29a4aa12428781188b1f4bd7611da387889257e5e29c4fa7b148cf0094171cd93f384fd7eb0d57d3bb4fa5222ae1bb16f6307a5b631fd28e5ccd01603fee51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c05811675977ba35e0c3cef7a04de1328ea45e896ca275e6affa5338e4104133
MD5 bd886572ccc3d25c4f04b29ba1d9168b
SHA1 ade881b44c1ee7df96fae9b5bac382ad156fc74c
SHA512 c02722a0684a94fae13ee6d4dcb3a2b394fe70bc86bf09e787f3681d3fbcb9c66b988745ffa6f316d3ae13e20704648ddbfbb066ed5be7c70c78539209a9a255
MD5 SHA1 SHA512

Submit Download

svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACABAABABAABACACBBBBBCCABAABBCCCCAABBBBBCCCBCCCCABCBC.exe
Size 22.0MB
SHA256 4558556e9c432202b128ebf29273f6c19c06f608565548a57b322d179736f8a5
MD5 ebc6505230ef6c952cfe1d8a9fe6e9c5
SHA1 3dff434cb751177b8f2da6ffca513409d0c47486
SHA512 00ffcbab66492d7cf2d43c19cfb51a72241fbc24a3a4dad4ee9b3f4691fc72a3cf6da446250970df09e12e5614541ea7b029c75ecfa2ba4d54921c34806fd27c
SSDEEP 196608:vBBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBB1BBBBq:C
TLSH
T1C1378C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 efc091b3ed1919eafe89a0f2b0f5d14ba3b8b6bbfea68ba0b3fc3c65adc1b621
MD5 df92189eb291f1529bcbd1907f4b18a3
SHA1 4ccd93b01a253fca7b7b1ac21318dedb67c4ad56
SHA512 d63bf38ecb7b4b8ba3f97a7a6682fb186cfe5a3a01dd6e0995d64f9793076afb2b596dea05e51eeb3c430306475f9af9dff03f0e248ee4660a0cebcfc4e58801
TLSH
T1F111A362C5ADDC57EC32649B972EDBA24CAC3797EC5CBA14530942186BCDC31CE690E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1680-94-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/1680-48-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/1680-33-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/1680-70-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/3084-95-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4556-93-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4556-69-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4556-0-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4556-47-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4556-22-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4556-11-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/5100-92-0x0000000000650000-0x0000000000671000-memory.dmp

Download