a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Size 7.3MB
Sample260905-m7bwladd55
SHA256 a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082
MD5 4f992ac3ce91eb26badbbb9e7a14d4e3
SHA1 22c29d84c62091752482e986f2f88a81d79727b7
SHA512 219cebb4eaa56bd86e62e0576b333791a3dd893f7c99d92f833925d1199343551b4fde17fe33b746927c7d9c58252cdea02618dac7b99e70360ba0dbd8a4e160
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmF:G
TLSH
T14E762B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
2900	svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe
3628	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACBCACACBCBCAAAACCCBCBACCBCAABBCACCAAAAABBBBABBAACCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe"	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBAAABCACAACCCBBACCCCCAABBAABBACCCBCAACABACACAABABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe"	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3232	sc.exe
5752	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2224	cmd.exe
4344	cmd.exe
5788	cmd.exe
4256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1480	schtasks.exe
3392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
3628	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
3628	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
2900	svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe
2900	svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
Token: SeDebugPrivilege	3628	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
Token: SeDebugPrivilege	2900	svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 4344	2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	95
PID 4344 wrote to memory of 1480	4344	cmd.exe	97
PID 4204 wrote to memory of 4320	4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe	99
PID 2760 wrote to memory of 5788	2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	103
PID 5788 wrote to memory of 3232	5788	cmd.exe	105
PID 2760 wrote to memory of 4256	2760	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	106
PID 4256 wrote to memory of 5752	4256	cmd.exe	108
PID 4204 wrote to memory of 2224	4204	svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe	111
PID 2224 wrote to memory of 3392	2224	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACABBBCBACBCCAAACCACCCBBBABBABAACCABAACAABBAAAABACBBBBAABCCBBBBCCBBBCBACCBCCBBBBBACBCCBCBACCCCCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBACABBBCBACBCCAAACCACCCBBBABBABAACCABAACAABBAAAABACBBBBAABCCBBBBCCBBBCBACCBCCBBBBBACBCCBCBACCCCCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe" start= auto displayName= "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe" start= auto displayName= "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBABACCABCACBBCBCCBABCAABBABBCBCCBBBAABBCCBBCBABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCCCBCABCCBBCCCCACACCBCBBAABCAACBBBBACBCABABCCCAABCCBCCCCCCBBACCACBAAACACACCBCCACABBACACCABABBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCCCCBCABCCBBCCCCACACCBCBBAABCAACBBBBACBCABABCCCAABCCBCCCCCCBBACCACBAAACACACCBCCACABBACACCABABBBBBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCACACCCBCBABABCBACBCAAAABABBCBCACCBCACBAAAACCBCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d1efc0e68f7bf3ca0d7c3967731dfed656311e601faf68f6e96b06becbc74d6d
MD5 07dbdc8891317e0abca1ec77d395c0de
SHA1 2b3790f3c7b0a6ff2bcd3f5be36c2d35a75232b4
SHA512 d4b7d805b1661e627f049559f8006aa3776f86e8f9bf1fa3983b9c30e0ef4de0f99afddb1ba0ec2c6db21f7a18adb802e8b03bd786c9a01983185dc5bfcaaf82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 98eb3f037314f23c7aa92569405dc8db97b78f4965992863237ae62b6581c9b7
MD5 1e6cca0173b64d758306f5e89e705f34
SHA1 bf4b0803eb458ad47ded97059ed3137af123b646
SHA512 7eaf59aa93f4f8e4797456e6fda24ef8323614429fe508620333fe4779012d81399ff0962c5a6df62e2e6a1e91fb188ca27415b046bb6f2b68e1ac37615e214e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 d2c3f06d0a2192a78dc90fb9895b10d56e28b52b92f1701e493480b3c7659351
MD5 d0d7c2360b9c06a953354aa08f1a8813
SHA1 ba08cc9bd59da32539724495b3dfd6c1e567ef8b
SHA512 03e183e47e79844551662e78113a6650ffeb4395109f1b67fcbedb936894dfaf97e6849d558f51c253da64fb152f87d886e0bb884f1fab1802b9a9c3d433d440
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 1580185da2744cdce4cd2b43915a0e2f5cf3414889501df42519440f067f5120
MD5 b4bb0fc051b3ff979f700e1185a7d281
SHA1 385d91f68fdf19c68a543d5a2a35802263533eae
SHA512 893b5c2c06ba18683cbc269c2656176ca74ddd205dc7b72b8205a8b3e9f29fd248ebb6c20238215742beb94756ef44aebdc3bec4c0c345d28e95c93ecee73b17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a8076cc0c494146906c3d189c1cdc8068bff8f79c0e1e9896ef9384503dd3b6c
MD5 3a7fb587609c8affa05ede97857811f8
SHA1 5e87fce507be3f104c1545b3a568839dd94c438f
SHA512 5838e1e8233e7caef024c3316ad3928e181afe4619a42afec74c947bfc5658c01c95d318bc6cf99f810825511b8b8ef6bd975f9539a9f19a15ae7a55a183a445
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\qap`g`v~dtlq
Size 10B
SHA256 9cc41b33a2108a3e87cbc06bfcaff17bede94f7288ce050481ba689361d98bb5
MD5 4e7ce69a4845debcbb98b43401b5e76f
SHA1 c23975bd834491ee9a406e45c7d263cc79c23d39
SHA512 e069afd332ad1cddaa1ae883e5922d983db0a2fcfd735d5d1f9b3ea213a350fb9e4445b3f6b9c24716a2597a1d26a346729dfbd7cc51de136246b9c5ccacac4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\tn-ZA\qap`g`v~dtlq
Size 10B
SHA256 3bc8496c394ab6196edf5634ea34c99214cef9233f82475fcbe883472cee6e6c
MD5 a5f3828679d7b4bb28bad5560851d44d
SHA1 4f7cc3a20bd370c15d620b78ca7a5c3b91933331
SHA512 2f994371391c35066c1fb0f143cc3c5d8ab5745c22ee10a02a80c5e2e0c040f3365c9a45985137cfcba1329898a44f1cb0c19fc842cdbcfb9e3bdd231b1cf5a6
MD5 SHA1 SHA512

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 22.4MB
SHA256 459c42581db298787bf00271949875ae9ee9eca560042ad206682c94ead6a397
MD5 08ec43626d154fe37162b88815da7d29
SHA1 b3fad3933f345a4c75ed80a8fe75d8f7ec7376b3
SHA512 e93120800cbdf6364c8fdbcbaa3b748caeeca2414b3fc6a742a2bb3749c3b383651292789b3113a883d96637f73cc9cc1824a28790e4ec126f13d0bf24c5cb0b
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmT:2oj8sl/rQ
TLSH
T131372B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 36.9MB
SHA256 5dfee2ba20b47d015d586b70143bebe56814754e6d036b2acc09510c5f1aaa14
MD5 06635f108af0a3b248cce2e3822846b4
SHA1 adf1133c73091a864b8a1fe9506f6e48b95e9103
SHA512 27f01023e42acb56cfbccb6487adf1db2b793d3c6f514986e0f13dc8e5a063335442332bf25fabf6ebf59c828ea4ebb22ccc8ea4d1cb3e3cbfb35b1983227358
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmm:Aoj8sl/rf
TLSH
T157872B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 320KB
SHA256 5fa572543cc215b1fcc7ddb2d2c394736751946d2a706d73baf45f81d7572e6f
MD5 f6d1ea45a30a725b24f08207f7187601
SHA1 0d13e46232dda971ab5731ba6fb57ff8d8b7cef3
SHA512 073f8bb5956e158e3e378272ff305c0364e4cde6924eb28a2dddfeffeda8b84cf14748bb5ae1961996ac316fa185b55626ea670b05a9c29a2950ed79908502c3
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFC+dTTUFgEs3XojAdP+dTTUFgEs3XojAdP+d5:mgUFgEsnojA9gUFCgUFgEsnojA9gUFgm
TLSH
T1B7640909F94340B1DD2B50F04DCFE3BF8A60BB2586128DF7EB4DCB5BA923BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FormatDismount.exe

Path C:\Users\Admin\Desktop\FormatDismount.exe
Size 51.4MB
SHA256 57339f657d3a13504e300a670a0f3e31b6aae38cf84ad816ffa5afab4aa576fb
MD5 3c177e6ed0fbd2a8dd5780dbd5bf8872
SHA1 4828451b39eac1429ec008f1822684bc231d3b14
SHA512 c0e94686ab1260829a16906197676d58adeb64c512250f7d010fb3315e7efe5d4fd81c7badc673669502ccaf44b113c660531ef762ce181ef3b34d986fd15808
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmb:6oj8sl/rA
TLSH
T17FC72B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3ccda15b791a78f78cb8cef80506811cde2884865e4fc375a5e940a7db5ebc1
MD5 e6608a60ffc555d37f892f2c98410b6c
SHA1 15e183082352fbc75912a6db2de920b924f53cad
SHA512 97e5e77896c530c8ae8894ad08a09a4c62f7a4745bce4696f841a7f76c4028a5234b9fcee0602a7a63f218063e168a453bb8c2e1aa0153c3ec19aaf030055172
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 baa0e843368dd75f08ad820b6f385b237df587f9bb6e47c2f3b8c19329c9bbbc
MD5 833dba71b7e0c455d8e9408b9413bddd
SHA1 926afea1ca4165723862ae41a72a403a7700e0c1
SHA512 62ff029fbaffe4226e6d2429358c477da486eb7f8901197553f432b209ac3865ed0d7f70d3c4592ec6fddbaaabe463f1b9a3d663a11a5e1951165dfd63d13b22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 afea51fb857acda1c60685a44227c8a6615c747cf79bf4cda225bee46386892d
MD5 fbadee202232d0f0dfd334f7a8233335
SHA1 7b04ba5684b82940a2e4b099ba3ca634d5bb0451
SHA512 b92e0b7ddfb6c72a90420a97163b7067984b981a0ab3c82d253b986c5c8165d67a00d8ceb5239b9eb7668427e1dfe4437d7931a0bac08519f4c0fcb0bca10882
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b43262d6f3552a3548582ba07342fd4e1a90043525269f053f8555f40dd710f3
MD5 41164f79ac3c4c08720858f0546733b1
SHA1 92382800c9a99e7f6fffe9bbbef1eecd86839a51
SHA512 705f98432a9693d5bef514a842534a06bebed4e0169b1f65f2e089d81f7d137c2c053e4eec28a9669aa9d58ecd2016420e1e37b2977d2d1a99cf94bb6dee7fde
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5726bbf19799f8a29476078ee2eef0713788c9cf9539046b3072a4279e248ab4
MD5 e8d9c855c1c2ba423261225e0a397012
SHA1 502bab9c8b25ba95903a172b5d5b93494c787c16
SHA512 95b17420102991e8d279248feb248c6fc6e87463f12d527813856bc47dace43cdf5180579160ac9beaae67bf3a34587cacd8d2a528f5e327df351d0b483291b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75a726d5833a1505f4af71f19c21e579e39ef1a9cefe508bababb1a1e84bde23
MD5 e6767a7ca02597b8e23992f5fe5c63f1
SHA1 5b92bb1a18f32fd997341da501991e4800fa48e1
SHA512 5427efe401aef26c5af1469db6d854f16e6867e40cdeb301371cf3af2ac05b6905db3c67a346778bd922ac7e808c73761751df8b384155d03547fd80d135260c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 461b8c8c39cab13dcd3d1c282f64d38058af4bb6b1dcd5be0b8e7f33b6401c5d
MD5 ee433bf9fdaa7ef8d53ae140bac88b42
SHA1 e138770a8ff9a5019f444d73251422f4a4f81a7e
SHA512 5dec551a86d8a7b2ff0a20d5ca46d7e30edb26f1fbf8b1625d80923bd2b24ba146aec3a68dccfa08c9dfa1e02bc4b6aeff88cae29adb88ea3036bd94c2d92fa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f761b6341be99a98db8d6d98c34b24b7de9977d9430c75e37c630d015e9a5a13
MD5 41eedf18f9ee8d3ba1174ae4989266d3
SHA1 1d3a81056e1247ffc1dd7cc29032a2757fb32aa6
SHA512 81abb8ee5cb5c63f18b19506163013cbdb5ec11cd05372ed26d776addd4943b2d7e0c71fb00f800de28dc966b449c9afb6f6bb67f1b323a18627e7e716ed8959
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Downloads\qap`g`v~dtlq
Size 10B
SHA256 40d75099d8e5bb9b4dc5a1e0fbb6efd9f534607ac250466771fae305183d270b
MD5 364c8dd22533cd5525e7af47adfbadf4
SHA1 2978be9bda13b6e25af67f507589f55c8c5f1a9f
SHA512 869ce7a6de43ac4df13e34e9716bada3b6b8b87dc8f53016a1cadbbe57c5df9688373f4dab104a32f43d58dd10d27a2b92eacaccd2719c4f6433f92982dbca4c
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCABACBBABBCACCCAACBBCAAACCBCACBCCCCCABBBCBBCBBBACAC.exe
Size 7.3MB
SHA256 a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082
MD5 4f992ac3ce91eb26badbbb9e7a14d4e3
SHA1 22c29d84c62091752482e986f2f88a81d79727b7
SHA512 219cebb4eaa56bd86e62e0576b333791a3dd893f7c99d92f833925d1199343551b4fde17fe33b746927c7d9c58252cdea02618dac7b99e70360ba0dbd8a4e160
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmF:G
TLSH
T14E762B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 81ac26f9c0230d8a2a7af7547298752e8a9f30950ff3afd6be26c2cbd4bd8f3a
MD5 a4182db6e821919108b8b29cff8168d9
SHA1 6a19c94d4668f75b895442038d3ceded7b4255ae
SHA512 3c2d13404b9a83359b8ab88a0aa727a4e544add55bea6960f8a6226b7495fa6f80437a6d3dd263bbf69eb1bb945bac47820d9dfab5de693012187dcc2ea0bfbb
TLSH
T1602138B3F0B4C893E132A8C757159AE74D983BDFAC5CAB041309431C7749C35AD158DA
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 faf4c538cccf5f4664a6c2bfaa25a1a5af75282091ec77f56f6f92a050ff7e83
MD5 d95ccc8a54d99c32afcafe5f413fa8d5
SHA1 254d0de4eefb521fb273fc86c513a92d51beeeb9
SHA512 d91a9b35a11f23c3c3b322de99e73bf9e264bae2332104346842d07df8ce60cb25fdb114c91ff6900e26ee5ab72e4f79d831730240b4503b06308666beb9e1f6
TLSH
T1E121F376F0A48893E232A8CB56259AE74D983BEF9C5CAB04130943187749C35ED158D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d790b91ba13cb7e73049e43b461a25aa3e4a9676aa94134fc50e11d775457874
MD5 641c325a77b8c7dbb405ba04b1e28447
SHA1 98fe3f068659b08b9b69f53875a325657c44a8e8
SHA512 2e1c989853063847a0213ba19e602a97972b0cc58be2a25a9597b5dcbe8ef0c13187807de1659d821bd1eaff0737f30d2865c9cd33dcdc1057f276946da3028f
TLSH
T1531127A3F0A58893E132A8C757159AE74D943BAFAC58AB041309431CB705C35AD158DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2760-0-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-70-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-65-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-48-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-1520-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-22-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2760-11-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2900-83-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/2900-3957-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/3628-2327-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/4204-88-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/4204-69-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download

memory/4204-47-0x0000000000B40000-0x0000000000B61000-memory.dmp

Download