2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Size 855KB
Sample260813-a6vabsgr21
SHA256 2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f
MD5 7d39a17472ca36074583dd9d27576d05
SHA1 2840a589d1c5d6900f47403068580f1edf03587c
SHA512 2295220e47200113a67b127508dd83bf26d408306fbe64f814637a951ddab0c81dae72c68e2ec9de8c59ee224795136fe78f3ec02c975d2a9a66fccb8804fd30
SSDEEP 24576:m9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0Y:U+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+EC
TLSH
T10F152A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
3424	svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe
3768	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCCACABCACBCABCBBBBABCCABAACAABAABBBBBCCBBBBBBACAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe"	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBCBCBCBBACBCCCAABAAACCCACCAABABBACBCAABABCCBABCBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe"	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3976	sc.exe
3732	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe
5692	cmd.exe
4472	cmd.exe
4452	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5536	schtasks.exe
5236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
3768	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
3768	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
3424	svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe
3424	svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
Token: SeDebugPrivilege	820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
Token: SeDebugPrivilege	3768	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
Token: SeDebugPrivilege	3424	svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4452	1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	91
PID 4452 wrote to memory of 5536	4452	cmd.exe	93
PID 820 wrote to memory of 5104	820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe	94
PID 1844 wrote to memory of 1924	1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	97
PID 1924 wrote to memory of 3976	1924	cmd.exe	99
PID 1844 wrote to memory of 5692	1844	2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe	100
PID 5692 wrote to memory of 3732	5692	cmd.exe	102
PID 820 wrote to memory of 4472	820	svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe	105
PID 4472 wrote to memory of 5236	4472	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_7d39a17472ca36074583dd9d27576d05_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACCBABBCCABCCCCCACBCBCBACCBBACABBBBABCABCAACCCAACACBABCBABCABBBBCCABCCBABBBBAABAAABAACABCBABAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAACCBABBCCABCCCCCACBCBCBACCBBACABBBBABCABCAACCCAACACBABCBABCABBBBCCABCCBABBBBAABAAABAACABCBABAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe" start= auto displayName= "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe" start= auto displayName= "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCBCBABABAACABCBCCBBACCBBBBACBBCBCCBCAACCBAABCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACCABCACABAABBBBBAAAAAAAACCABACBBCCBCBBABCCABBCCACCCBCBCACCCCAACBACBAACABCBCBABCCBCCCCAAAACAACAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACCABCACABAABBBBBAAAAAAAACCABACBBCCBCBBABCCABBCCACCCBCBCACCCCAACBACBAACABCBCBABCCBCCCCAAAACAACAABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAABCAABACCBBCCCBACABABCBACCCBBABBCAACBACCBBCCCCAABACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a43f66ddab26a5f49866936893847e8109b0de98aee90409debf335703d32625
MD5 90e0a2227847ab6cd60fe3309ec42803
SHA1 114559c3c1ef44dd4e401dbc748d5b3b9174f1ce
SHA512 d9e756e89e05d32c78e59af1ce4bd4d38280045d601bf100d97e584b083b119fbec215b683d34092946927334c7761b06d6eb77e8562edf92469709affad4f9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\ClickToRun\MachineData\qap`g`v~dtlq
Size 10B
SHA256 3ae94c851801195d066a6fbc8d0b53b4c79020fe12d03d1111f3e6eba7208e0b
MD5 e8009f5654f2d2bfd525615703d1685d
SHA1 34e408268638fc6064896c5c1dc9ca14b64b0107
SHA512 78f25c9a0c1cf5fd62d1560e9502909d69dbc7396c52e96a92dfd1cb94ee3c073dc3953ccd803bfb431d677dbc0a3eaeb82b4d8940686859ab56fe346dbccb83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\Install\qap`g`v~dtlq
Size 10B
SHA256 a37e5f9d5bf99b899338f0f352faf55f8a3e72f432f26ef838037d7444491be3
MD5 44dc30578a0697dd7faadd84c89d9968
SHA1 9dd8deb7cfc4ea26581f57ff7c787361f4e93204
SHA512 1af33f990eeb1a30fbe2770c589d52ec9d94f8b15909fc9959f97655232c3542430aaf7b7f5a1bff746a61c8a953fbb33ae066782ffd505fa97e917714e499f4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 37205b59a7e5c03ea00b30a6272dff5c68b28565d247248d5c3a254e490df004
MD5 46da949ac59e792c0ff1852ee65a01b3
SHA1 51558bbe850ce5b95bf4b50914605354386c4e14
SHA512 e196ecd22c58297f75ae55771750e099f501a9cda0a1746af5ae8fe2d11252fd4ed1ab0622657e51eb78043e90756abd0a3832669860e4516928f498baf5ba5b
SSDEEP 24576:m9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0Xm37:U+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+EF2
TLSH
T19B657D15F8434072E97B01B14CDBD27E4E24B72483128DFBFB8DCA1F7932AA1657A256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 29d952dbe52ec3ee93be8bbdbbf896f9d923ceae86485fdeba5aa25d30da6a06
MD5 41a962bd7014174af6dcdabd68175d87
SHA1 79956d13529246049431f7fdd7df5e0e028873c0
SHA512 a025b943b9bd59b4d23efe5bf6aff93c8e9a88b58f005e28b0f7a030ac8d47c9fdbfdf4bb87a4fe559f055b39a77d1078606b277e900769ad06c47ea4146310b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\qap`g`v~dtlq
Size 10B
SHA256 dc9edffbe4156ae6c17795ab9258c151c1c108afd9c132faf3248f6a0b6eb21a
MD5 15ed25e8b61e2b7b9cdd23a664aa83a7
SHA1 344b826bbbc7c0f8e09a245b4ab15238b5142b54
SHA512 1b60dd751164e8c6505ed6d5beb24b06412ecad6d55ee1f6940d5c56fd94ee0538f6dd56c0ded338387feb826f33f35528a2bd85ce6d648ef0ae55fe81995dfa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 377cac2e1d67a237d732d7ebf4bb5358d7706bca8f4ab55e2dd84b50b404756b
MD5 fd5003dfd75af2d472e077042cd2dc8f
SHA1 68ce082ec06e319d93b59ebeec0bebc243d16f10
SHA512 24924fc961fb3f76fba94c200eb6657957ab5014de10eb95cf8363c5a8b8a951ea7fae71013454399fb55178ad6ede1df7baf435a7d535f46f5d2a9f79205919
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WYOFISML\qap`g`v~dtlq
Size 10B
SHA256 10b01b68d90e0fdb8fdf5853761900c2c665fce8c40b3fc8d299b86533ee6a34
MD5 028258e2ebc41cee9e3779efd79f384a
SHA1 38cda6aa4baf5e5418156bd3d9565b046e3a1a63
SHA512 cbf98464829a3b1789f89a7a605bc8e709e884375a500a65eeb0bc3e23dff0de19dfbc23f8675c693f7670cd7cc87c808a58d12e73d061584a2da38c8b5ae57b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\qap`g`v~dtlq
Size 10B
SHA256 37c07fb78b23e8a6108d387c2f96eb6d2dd54faaae4de59cedbfb1bc5d28c063
MD5 9e9a2ecca698ff472e96cc578d54276a
SHA1 728206b7688fd293fc932bac2191811abe04116c
SHA512 8b60b6f22db960e060cf82b62974873db1ee92d06d395682ca60508c7d7d809169c336d494d54fc71420400a6d6734d5aeb467ff609ca202c7f8c5547cc769de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79376366290bb1490b2d0de48ecffe02f4eaaf3a9eab69380536b4278ab81426
MD5 4ae08f67a0641a9d195d7e8fc4984bfd
SHA1 e9232f4ce4ec80fbd5216d5c8b1fda3f628976be
SHA512 b2d6e3a65fba3edf100f3e65c4b169249b514a98f1f7e93f8c177dec589ec2519e6bdc005ac7e9cc1561a6042e6772217784a7de41d5216644d3034fcb6d8bf1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6774559c26f95784d89645ca57634c5595e11084dc50efd828245a7602428638
MD5 9e4bfd6b6a4baed55599d3629c8de7d8
SHA1 fb0c8496688f446f50c1cd4107935216a876a3bc
SHA512 888a68fb4765d6d2c767a0045e811e619031d2b52eb09712bd7e4a714ca2020a3fdbd210b820587676e34378df07124d16dd16caebba359f493720c0bc3be661
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e62b12e0fb04bf498b8bb4d66912688ffaf0ac6fde250a5e88da19ff5205e7c
MD5 db55dfa8b572ff9c5b594d018862a87d
SHA1 3ceedc71f5853e7e2055d66ce0d48edc58d03509
SHA512 67d60b041a392e0a668a06900f53c37e9e46b883de3dad0704bfc1297276ff3568fa9f04d39317b17140e38f80f1b994fff2bb70f009da0ee467dfb18afca51b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0cfd6e90b46ffc9dfc6f51611969c18a6e74a0bff652c2c69344ab93419054db
MD5 ea24c54235f1877f113bd5bb837db430
SHA1 8128268ef4e66f5e77a9ec09bd0a6e8a27b4983b
SHA512 9e69e1a0cc7bc46e69f5ad3ac114e6948b69b55d7e8bd7db733191a1d5be0314526a0620e27fdcd7a696262edf1a6b35d0af24f90788a62b55b6cc8c97c96788
MD5 SHA1 SHA512

Submit Download

svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCCBBAABBBABCCBCCBBAACAABABCAABBBCAACAACBCBCBCCCAAA.exe
Size 855KB
SHA256 2e62b9c53afd60e4225f01e1efda375e291b0cf56afe4f2f8f98979cb2c5795f
MD5 7d39a17472ca36074583dd9d27576d05
SHA1 2840a589d1c5d6900f47403068580f1edf03587c
SHA512 2295220e47200113a67b127508dd83bf26d408306fbe64f814637a951ddab0c81dae72c68e2ec9de8c59ee224795136fe78f3ec02c975d2a9a66fccb8804fd30
SSDEEP 24576:m9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0G9+EM0Y:U+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+Eq+EC
TLSH
T10F152A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 65bbb5c0ae24723402445dc9c697773606696db622f0b60fd76f7bb68efe871c
MD5 bd11f32b6c09bc731f45708fe350a6b1
SHA1 bebcb44828e9282d2782b1a5c5708b62a6e97f0a
SHA512 e0bbb43b259164520e10d886a7219d9410d8f62f099a6a8309f7bacc4acb471e73398060cb29c6a29756891d5e52461910a99f46355d59910f21c36240d58c00
TLSH
T12F11F634E4A6CC63EA6268CF723AEB920DA4339F9C9C6A08174D4119A7D9C738D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a91fad792b380b4a498d649b4a6a4148628e67a898216393098d9a846338a061
MD5 0925a7aa99c3ba587b4ea63ca48e7dd0
SHA1 966e51c943c3ed51fe795c1c3e1a34826f12d3ba
SHA512 56f4c4d7f9a8be3ebe73347c9c8bff7fd55586b7acb7de22a09d288cc706605fe90f94169555a09e6010e49d8566a81219a6a2f4ea681d32653489e9a9515a43
TLSH
T1C5210534D4A6CC63EE6268CF723AEB9209A4379F9C9C6A08174D811DA7DDC738D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 06790450a4a0b86b6557094eda72762ee035352dcdf76fa003bf104a49ddfc6a
MD5 d2f00ec9bca30e0f6bb21476a08bfaa4
SHA1 fc74a224112d6fc72b552fce109e1633bd6f7362
SHA512 31b430197392f2ff33840a851336824294a410a0a7bb5ab755a1533e14ec0bbab4a5ee6d4072ac9c0dc97e68557468beb9f25fb459c7d938fce344443b4e6243
TLSH
T119110824D4A6CC53EE7264CF723AEF8209A1279F5C986A08174D411AB79DC738D190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-32-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/1844-6-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3424-63-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/3424-4062-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download

memory/3768-1132-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/3768-4064-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download