7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Size 2.5MB
Sample260830-2nkfysdf98
SHA256 7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f
MD5 ff4ebcd9909992f090514e4fbf9168ed
SHA1 a38655b9990af551eb105b25fa3e7b98f01d0314
SHA512 bc9bdeb4295acf128c56e82605eda3e337e21e3d557e41d6593409408c8a7fd6fd5029024106c18a736d2fc0d91694643f8afbdcbf9b4c47bda04a22fece1b3f
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+EG:b
TLSH
T169C55B09F9D748B2D97B51B00CDBE3BF4971BB2580258E6AFA4EC74FB823B505419392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
3236	svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
4256	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACBACBCACCBBABCCBBCAABBABCCCABBACAABABBAABBCAABABCCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe"	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBCBCACAACCCBCABCBACCCCACACACAACABAAABACCCAABCCABBAABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe"	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1988	sc.exe
4204	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
4596	cmd.exe
2292	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
3236	svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
3236	svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
4256	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
4256	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Token: SeDebugPrivilege	4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
Token: SeDebugPrivilege	3236	svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
Token: SeDebugPrivilege	4256	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2292	3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	95
PID 2292 wrote to memory of 960	2292	cmd.exe	97
PID 4560 wrote to memory of 2200	4560	svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe	98
PID 2200 wrote to memory of 3040	2200	notepad.exe	99
PID 3912 wrote to memory of 3084	3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	103
PID 3084 wrote to memory of 1988	3084	cmd.exe	105
PID 3912 wrote to memory of 4596	3912	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	106
PID 4596 wrote to memory of 4204	4596	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACBCCACBACBAAAABCCCCBBABCACABABBBBCCBCCAACBBACBBACCCBCBCBBABBABCACCBBCBBBCAABABCBBBCABCCACBCCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACBCCACBACBAAAABCCCCBBABCACABABBBBCCBCCAACBBACBBACCCBCBCBBABBABCACCBBCBBBCAABABCBBBCABCCACBCCBBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe" start= auto displayName= "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe" start= auto displayName= "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBCBCABCBCBBBABCCBBCABCBABCABCBBCCACAACBAACBBCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCABBCBAABABABABBCBAAABAAACBCAACBBABCBCCACCAABCACCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ccd7961da99c1450668eae3638817ed295d360f09e3dafecc86dc10b98fab634
MD5 3c55b48b7a1f9083f66ae7f1d6bd9a4e
SHA1 9059aa57154b8985fa71c864a2283963af89694e
SHA512 192eea4f6237b161a2c8265df5a8cd9e500b46c1da457cc09690206926ec9c811b03bb682eebe3555b2724544101d883ca364d700d1825fe9fa1dee867a3027a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 2.9MB
SHA256 bc485ff14a689e12cf44914387a66ba10f47be0bdc6a9095facda59a9714d9ee
MD5 64dd01ca99b890de8b82479573933002
SHA1 d7d3d6f3fea92eca39e4412bd6e70b0883cece1c
SHA512 3db80df85ffb3d0ab86650dcee7d0c81db16ee7fe48c71f59318af13f47204bb647179c1065e07b9fe88f5455f0b805539c46a765fec6d63aabc9e7dca00b384
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+E9:Qpiu
TLSH
T1DAE57C05FAD64472E57B12B00DEBE3BE4971BF268431CE6AFB4D870F6832B505825762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 c8e524ed26227d05144f38982baee80e52a166207a2fc741dbe0564d6aaee824
MD5 e30ab2863bdb24ac4c7d354e03027306
SHA1 f78dc179ae288d05e8a1c349f9a28a907eee37ea
SHA512 1f5c0e0fb55e48a8f790c261164ea5a067fb424bd93605b3dbcb913fc3f33da6084691c5c8ae52b3f2b4a71f32fd332f290dc53d06bf713b88901781d41a5d96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\qap`g`v~dtlq
Size 10B
SHA256 727052ded891f282bd82ada8980040e3368d336c66bfbc78b0f47de277834d02
MD5 53e853cfbabaf9382ab7eb249936e45c
SHA1 0b53ff4133652a0367da2db2e825511fca06bab3
SHA512 d547ebe76432ee21a80b028b9ff3e29ea5441d46f1ee62b2f64d02c1d8df5a3b06980c9fe0e33b025634821621db81e94708fec454226e7db89afb49f1c6e181
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\qap`g`v~dtlq
Size 10B
SHA256 2af88551fa191194f984c74cca7a4152c546cb7b29c123b4935da801cf921299
MD5 19562a19d3a59e460d2aa2b39560928b
SHA1 4c98f8ca7ac21be0671b95f369296bacee07c193
SHA512 c9d0060d42ce0c5791ef33eb8c561015e100187685ad24e9a4728089b675f01ead7c892c620e7ab1690434bfc8b72bd772589ec377520d6d4266146029bca70b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Advertising.Xaml_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 e52696361f0fd13c05e0e588ddaf22c7429bd16693fc8be6ed4dddcce01ee23f
MD5 f1fbc674ba18dc35cd9f62865e1ecf4a
SHA1 a3ec844d765ed535e81de554aabf70327b92945e
SHA512 a87327d7725a532d0dbf57524895ad2509203e744001fc791b7d3775ac25dea2e051c573d8f8e7ec689e87273e8385b27e283af78d42609a63a1db7a17935e00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99ca3f8062e92bf0c58ae0be2e20c0f0f4a6932d83586bc8b8634d4a722e1913
MD5 fedf422d606e3711e43c065eb6abbbcb
SHA1 71da36ee08403c9c1b812a6a5385658ce19e4ab6
SHA512 a75e2c3b7c1397e4727670f859a76e9b7ec841b7822f0904b976db8e1d1e259199f87dcdc56df168ddeee10ceb1d34eb655bc64506b3179d2808719d51a5fb4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 417bc94ff76532cac7686c7837e5609591decdf3bb213c12386df488f3b162c8
MD5 f098c85545160b38505b85e0c7272762
SHA1 8a66b33dece33476423bdea8eaf1cb3a9303f8e5
SHA512 c4a40b71fea0ae30c4aa425db1e612972402c77dfbb2129459a9e9239159203c5132e35fad5eff8e6fdfb249c6eb555610b913a9a90a1c4a100743986857b6f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bfb0ec596c10ed3a4faa71e0cf39cf1640f72d8acf7a3c88f763ed2c59bb021
MD5 7a0cbc70423a514458a9f5b80d410dbd
SHA1 605b92cdb4c7b51d9914c0bb07a2242fb7c3d9b9
SHA512 95536a6a64d147513b73b2645870d7f36bd63f66ba180fd5619c3f3de7ad385ad54a50a7e1de67f1f4094e472386150c903fa2a5b4a7d273ac1fcded16dbea6a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ad90f0ee091c19029258631670f4fd837c22354b330f48c49e0c175c59678d7d
MD5 851b2519eccdc83ed08ba35b772459c4
SHA1 22e22ba98f2f9aec2121528f0cbd3a05841ef95a
SHA512 11abc5e3f2d13ab6ce277cdf55ea2e2029dc4134dcaf5c30a246079892bb6f00b6a5a23a4a743e1f685079f1ce4920d3c02fb2ecf76a1fcfde3dff9dc216b07e
MD5 SHA1 SHA512

Submit Download

svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBACCBACCAAAAABBBCAACACCCACBCAAABBAACCCCCCACAAACCAC.exe
Size 2.5MB
SHA256 7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f
MD5 ff4ebcd9909992f090514e4fbf9168ed
SHA1 a38655b9990af551eb105b25fa3e7b98f01d0314
SHA512 bc9bdeb4295acf128c56e82605eda3e337e21e3d557e41d6593409408c8a7fd6fd5029024106c18a736d2fc0d91694643f8afbdcbf9b4c47bda04a22fece1b3f
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+EG:b
TLSH
T169C55B09F9D748B2D97B51B00CDBE3BF4971BB2580258E6AFA4EC74FB823B505419392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9302249bc6533103435a367543182daf1a40b938a2556e5c2ca0ef2a899983ed
MD5 4682a69303317027027a640bad126cb8
SHA1 381a0f8ac7839d411b6fc17e2c2bdab4657461d6
SHA512 42e1d77d3391f61e5b40f29a89522820b4de9d5e8b2cda30edbd8061f8a5717f34c128a5b6eb5a4464214f0d19ccf0a2422240a7768af64226d7417f9fbccac4
TLSH
T16A110820E0F9DC93F43278CB961989960CE435CBAC5CAA482329860977D8831CD5D8FA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8a531d934577fd58fea631fb99f806fdd631da4800ca370f9d468377b17f52de
MD5 d9763f86516f678917c08be6092fa262
SHA1 b4e0c90369ada90aab95e1d1a65b9df47a0949e4
SHA512 bf8b13832b523389499589c62f9e751c1da874a57a72074dd4094b51290da4258c7043c8f8d27c24acbdf6015ac1c0a5d24594b71bea595954aff2205941bd19
TLSH
T1F321D760D0F9CC93F43278CB96199D960CE435CBAC58AA582329861977D8831CD5D8FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-58-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/3236-86-0x0000000000EA0000-0x0000000000EC1000-memory.dmp

Download

memory/3912-0-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/3912-7-0x0000000000C30000-0x0000000000C51000-memory.dmp

Download

memory/4256-2848-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/4560-34-0x0000000000920000-0x0000000000941000-memory.dmp

Download