8ca08700ebe2addf72b396342fe241ba69a8873df7011d67df2ac25129bd8cb3

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
Size 2.1MB
Sample260831-c5hagstemf
SHA256 8ca08700ebe2addf72b396342fe241ba69a8873df7011d67df2ac25129bd8cb3
MD5 e04d638cfecf0afa6d3d2f1e8afad720
SHA1 18f6fe51957d8b33b58965e2d1f0df9bdd71eeec
SHA512 544b8c6b45832e6159ba261b1bbfc5fbca8e0a06b847ee9b37f62e34aa3b63d772923269710fefd656c2b74271ff1f81c4651d475f5b36b90e8965ffbb522dbd
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+EA:T
TLSH
T1DEA52B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
2532	svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
636	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCAACBAABACBCACCBBABCBCACBCCCACABCCABBACBACABABCCABBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe"	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACAACACAABACCAAAABACCABBCBCBBACABCBAAABCBABACAACCACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe"	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1744	sc.exe
3020	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2856	cmd.exe
3640	cmd.exe
1284	cmd.exe
4532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2768	schtasks.exe
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
2532	svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
2532	svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
636	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
636	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
Token: SeDebugPrivilege	1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
Token: SeDebugPrivilege	2532	svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
Token: SeDebugPrivilege	636	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4336	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2856	4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe	100
PID 2856 wrote to memory of 2768	2856	cmd.exe	102
PID 1960 wrote to memory of 1644	1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe	104
PID 1644 wrote to memory of 1620	1644	notepad.exe	105
PID 4432 wrote to memory of 3640	4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe	110
PID 3640 wrote to memory of 3020	3640	cmd.exe	112
PID 4432 wrote to memory of 1284	4432	2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe	113
PID 1284 wrote to memory of 1744	1284	cmd.exe	115
PID 1960 wrote to memory of 4532	1960	svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe	118
PID 4532 wrote to memory of 4228	4532	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_e04d638cfecf0afa6d3d2f1e8afad720_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABACCBBABBCCBACAABABABAACCAAACABAACBCCCACCABABABBBCCBCCACBBBCBBCBACBCACAABACCBCABCACCCCBCCAACAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACAAABACCBBABBCCBACAABABABAACCAAACABAACBCCCACCABABABBBCCBCCACBBBCBBCBACBCACAABACCBCABCACCCCBCCAACAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe" start= auto displayName= "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe" start= auto displayName= "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABABCBCACCBBAACBAACCABABCABACCACACAABCBABBBBCCACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCBAACAAACBAACBCBABAAABBCBBBACCBBACAABCACACACAACABCABABAABCAABCAABBACAACCABACBCCCBBABBBACAAAACBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBCBAACAAACBAACBCBABAAABBCBBBACCBBACAABCACACACAACABCABABAABCAABCAABBACAACCABACBCCCBBABBBACAAAACBABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4336

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBACABBCBCBACCAABBBCCACABBBCAAABACCABAAABBACCACACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 667ea0265930baeb8581c534ea85d885c5103a294ced6d5c5cf6810719e113f7
MD5 e7c4918f1732e07c876327a845a24269
SHA1 fe5e5f440cc2c2b390a8c60e139015488d8a7a75
SHA512 689f1555bcf8cb79a4adc7bfb1b3a8d0c0e437236728eda3a2d96658198e6c90cb5daf9dde1f016665b69f75857d8aa46d982fd2779626dd9861f36b7467cb33
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 07b40e6b37c4ea621a0d46d7b57d5b791264222658c9cb2b302ded691387c793
MD5 d3c72795b122d77f77fe0d89182d94cc
SHA1 a7319479736409ab514d60f9655250945318a96f
SHA512 429a8a2d1ac2a5f2c7ff1c9d6306ae302ac4d76cae8402bbb782f6ddf28df2ac4a6d2963b5f1c0f144fec300d776732475faff2fae31d6d378589240e14f9fb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\qap`g`v~dtlq
Size 10B
SHA256 d087a103989b77af57a8c958cdf004f2973ba577d0fdf8f46855c4e4184bc5ba
MD5 c8a6cae18f88704aaf492c3be9aeb08b
SHA1 9f8e743337d9f38eff7739e90e49cb8448cfa218
SHA512 97077f00d5ec403d6205fcca1b0f56d71ae36afd8b347d4c551e1e48ed52ff9b54351349340501006db5f411fb5cf3d4fc0fecbcc32dbdd83d3065ab1f907240
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\qap`g`v~dtlq
Size 10B
SHA256 e8c971d5df7dcf364453566672cefe34d1d95369974f7697d89e7fe269903696
MD5 7b71070f3a2ac931f6904e3712345701
SHA1 5b74c26dfe2e9bc31d8ce44adc06d8f1dffdf19f
SHA512 20ac4be2fa67cab0f4beaab7239ba409cea751c8d8938e09b228e2cedda7345d9a72d25274549e117d3654d26c6863ef72b7f03dd9eb397049ffb19910e3094e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BUL36GM7\qap`g`v~dtlq
Size 10B
SHA256 5a3daae603c0c66b60e89570c7c595a7fb74e8f3c3babc7d159490d2442a8f00
MD5 fe46c226e54281301ff9687fe3b56dce
SHA1 2bd0a79c6307f6bb57cdc1a53303e3fa7f0f05ac
SHA512 50a39048b6ff2c5a44911902c412d596eba10adaa3a893f0423017d4f00d742216cb1794f1181c1a57105aae490c27d02ffe483eed1a098c2add2aa600835f50
MD5 SHA1 SHA512

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 25.6MB
SHA256 f7a7c7ef8eb1a4d9414e74b865e586b98d0588ac2a9d80e124a7663d25b6a416
MD5 f7d44e20e5585ed11d2f34e397e1b277
SHA1 6199109aa6e4077e12941d6c85cb1768aaa58937
SHA512 e2b7ba97f79084ce23e189888b41ad5dfe5f7b8c3e6535976a0de87e32ded41181c473dae0d4dd30a610dda06c7ceaf6019de335d2aa17bf5a3ff4d3d6078c1e
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+EL:rDvJC
TLSH
T10E472B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 6.7MB
SHA256 c8fb18f0cff420a6965d9a3f0f510f5eb6abafb6bbd85fef01b19b0ba51ada07
MD5 8f5fcfa4960ba3c1c0554e0cbd4a28d7
SHA1 54c1345c3a09311c133d12872969260256fbc483
SHA512 3fc6c5f386f4753fc2f658c45eb1415fc7e5f7d7a51c3b6355fc8537575ec2e35934607a9d205bf41ed9fb7c5b99df678dfc0e2bf630248bfef634aa54b15111
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ec:vDvJl
TLSH
T149663B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 27.7MB
SHA256 4a07638d2a25dd8ce16c42e49ec0bb8b32e5c6ee4f79461ded508f809b7a3787
MD5 c8044459837d19e3577e67d2e2a465cd
SHA1 6a099f73032a7aabcd551447714888860cdf44ca
SHA512 6cc57baeb8f117462894ac036d19ebb6188cfc61e250404611e41fa3ca8a7cca4225066cf0b59b47418d3e18ac998c1751b84ea0a59b8293010f2a0d74556e3a
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+E8:XDvJj
TLSH
T159572B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 13.0MB
SHA256 3948bdbb1cfbc545376aaafde5c048efe5888c846abf4d553a919332f92c58d2
MD5 5d570c055a11c5138021ec6a6f7757f0
SHA1 77384443274169b12497803f509a8d8fad7aeab1
SHA512 56b9a18f1316184fd6ccb2b52cf6e32b490a0adde3153cad0da5815029d01522fbe91c2c56b49396d677b5bb306b10155222823afbf2231b29197ea7a9110def
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ez:zDvJA
TLSH
T1E1D62B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 17.2MB
SHA256 e7a6d169a5d6a0f3fe577b6a32800bd8dc3eab1755d1cef143518778ea4d7212
MD5 302fb1e39758b7f35688f4adab4cc2eb
SHA1 1af564b14de5772cd095fb61a3b877cd961be3d9
SHA512 4d2e25b37e6a41b4ca7488b24044e42a92f128b747499c7b10d34bb77c8ed98656642dc172977ac7205b4e5ae75beb5fda00aab6aaab5c1f41891093179c5f5b
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ef:7DvJI
TLSH
T1AC072B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExportDisconnect.exe

Path C:\Users\Admin\Desktop\ExportDisconnect.exe
Size 21.4MB
SHA256 31a0656c8d2b7a1e5ac734cc58dc5360f6507b875d224d51411a9a1790d5d1ae
MD5 dcd28c04f348a76e3f0a8ea2dfd4529d
SHA1 5eac3d380e113f80d786bc5f0dd5a69a0eb3a4f3
SHA512 918250cc05b591c6c02a52d6b03b0644de67e06d243a3681c22bcec977e005fc9fde73c774833d25ec31e4fb16646970c1680bc6a120f0dd86217f12cc5d5ccd
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+EZ:jDvJg
TLSH
T1F4372B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e062c81a78ddc56b1dcdb0fa9baa679092e7fa53271e112707ec37f279d6601e
MD5 e3bd3b53d96f6d8819fe3991533f8148
SHA1 5d9c46bfa8b769a47fe0b781a468e2f59b2fd24c
SHA512 1797a0d08f3bc486b9a246c5e1049c1f7b248475329571ade36f6de8aa37619fa364b7971c24cacf825f9c57584a8aa0a0ef783ab8befeaaf973140800b8b374
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f41753d152502b218948c972e61e23683f1998ff9720ab9d914184454b49b94a
MD5 1ff1d35d7658d071246753795be508ca
SHA1 79f6aba33b58536f9f0e3330e011928f3092ead9
SHA512 af42d8044021e80d27d866510fcb1da6512d51312e5c3bbd484de637b3c40695f8f459fa6eabd59a39c40c0d177eb59f8d65a008d25a91a0d38feb58e9edc1b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 663dbd116fd4272bde414236a0572e85bcb4edf75f0b8051943c6dde2e51b66b
MD5 fdc1376e257f19dc54a6ff19cf10d20d
SHA1 0e64d4ccc82de38d6a88dacfe9b9adfc42a2d2d4
SHA512 a6dd24a17b5e1fda377772e99b36cc2ec2629125f6c295d2df7952971c0e7a4e5439b8b2e0781d6a6a288aaec154f2b3ecba53296bc039db5763093bc64b36eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5b63cd7667e88253f579081ca80d2537fb8233cc090d8fa920f4d8b7f8a72fb
MD5 3af2a9b5085c009bcb4d4c86acfdaf5a
SHA1 ee32e7ba96b0ef77aeeda43e2dbbe962e09f6529
SHA512 ee793bfaf644c1de0f1dc70aa189e4b5d01723d3cb2bf7999c706e00ebb7c31fa7836f340ad6850f7ddd6d7a2bc7e40120fd96f41a4fbd03928cb9fb691d21be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9d744b43224549a2104f7c351f367c7543ea18a6d2cfdbb7cd557570a44f1360
MD5 9240700f5a19cc760d85ab9b7e98e44a
SHA1 fcb6dd3426860fdbff4e86b7a219e0ff1c21282f
SHA512 4971badd52f8dd992073ec2b3c0815ae2e3aa0b6903113509594da0013468a310c470e05f7be3eec5f3828ea6ec9406eee50e17791518377a73a992ed9b4eca0
MD5 SHA1 SHA512

Submit Download

svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABCBBCCCCBBCCBBCBCCABABAABBABACBBCBCCBBBACACBCBCBBCBC.exe
Size 2.1MB
SHA256 8ca08700ebe2addf72b396342fe241ba69a8873df7011d67df2ac25129bd8cb3
MD5 e04d638cfecf0afa6d3d2f1e8afad720
SHA1 18f6fe51957d8b33b58965e2d1f0df9bdd71eeec
SHA512 544b8c6b45832e6159ba261b1bbfc5fbca8e0a06b847ee9b37f62e34aa3b63d772923269710fefd656c2b74271ff1f81c4651d475f5b36b90e8965ffbb522dbd
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+EA:T
TLSH
T1DEA52B0AF98744B1D92B51B00CCFE3BF8A60BB25C4128E76FB4ECB5FB936B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7f83c86a0846da521f8eb043b4e38c93612ef9c8e28e82fddde7db1c1d5f941b
MD5 3f2636c8da9ff84f882758f281503881
SHA1 81f400477f37485504e2f64b75f62f9c2ddfe22e
SHA512 5ef08c0810d2cf76e34d4faa4c90fcae302d2fc5b0fd90cf03975abe75d0f645e295d997bc3d5d9202ad859e510088e257a9f69248f81505ecee6fcf82b840a2
TLSH
T10121EE51D0F5DC9BE432E4CBE229DADB4CE6378BA8A85A54231CC9187BD5C31CE1D4D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1043582abd1e5c84e2fa1dab075b19b39ec69a800c50b50c94942077ffcc37de
MD5 b48f6825de997675e75e510135aa2be2
SHA1 5c7cdd05ba05fd2941f0fe87770cc95512a37e89
SHA512 ae0c2ef66e93edce345d8a6be7d675d331c9f01d3d3dc2aca906496613ce2b045a3c7c5813d1dcf54f58176ebe27ff4867679e0f41ef763925c1396957cdf4b2
TLSH
T1DB21D621D0E4CC9BE532E4CBE6299BD74CA5379FA8AC5A10531D8A087BD9C31CD194D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 e93be28e1e515e5eee3ad1dce90e418b50972c84ac013a778397df47606b889b
MD5 aeecf64c34ccfad0cbf2ca9ef979c129
SHA1 1029b6c31d7495ef096bbf228f1772864fd6e09f
SHA512 6da1992d9b64421bf98de63f1fc9dfe4823e29a258b8735fc586345d6c64d6d80371eda45ee1410442370cd7d80dafadc426edd0648210fd87dfbbdb1032eda7
TLSH
T14C11E751D0F9DC9BE432A4CBE2199ACB4CE2378BA8A86A14231CCA187BD5C31CD194D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/636-2120-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1644-77-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/1960-50-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1960-112-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1960-74-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/2532-113-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/4432-111-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4432-73-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4432-10-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4432-49-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4432-23-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download