0825a35f809fa4181c09156387e9a882ee4459e014db51a3b7c08e0a40b75381

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
Size 7.6MB
Sample260814-c7cssatala
SHA256 0825a35f809fa4181c09156387e9a882ee4459e014db51a3b7c08e0a40b75381
MD5 fbb7e054b8a81c59309568e66c8e0b0c
SHA1 887bb768dd32f551c454295dcdfec910f6d70aca
SHA512 4b19c00c50466fde5ef4a2d798157caaf52214d88e50c56980c38df50b149ec61ea66f227123b237c0dc2c02a230962dc7e285056fae5155134051bb1953466b
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+m:AKaKaKaKaKaKaKaKX
TLSH
T109867E05F94344B1DE6B20B04DCBD3BF8A74AB2187118DEBF74DCB1B6A32B916439259
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
4380	svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
1616	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACABCCBCBBCCACBACCBBACBBCBCBACBCABABBBABABBBACCBCBBBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe"	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBABBBCABCABCCCBCAAABCBCCBBCBABBCAAACABAACBBCACABBBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe"	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4716	sc.exe
1440	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3684	cmd.exe
3312	cmd.exe
2512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
4380	svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
4380	svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
1616	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
1616	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
Token: SeDebugPrivilege	4380	svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
Token: SeDebugPrivilege	1616	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3684	5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe	106
PID 3684 wrote to memory of 3116	3684	cmd.exe	108
PID 412 wrote to memory of 4444	412	svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe	109
PID 4444 wrote to memory of 3868	4444	notepad.exe	110
PID 5084 wrote to memory of 3312	5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe	116
PID 3312 wrote to memory of 4716	3312	cmd.exe	118
PID 5084 wrote to memory of 2512	5084	2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe	119
PID 2512 wrote to memory of 1440	2512	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fbb7e054b8a81c59309568e66c8e0b0c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACABBCBBAAAAABACCCABAABACAAAABBBCACBACBAAACBACCBBCACBBBBBCBBBBABABBABBAAACBCABACBCCBCACCAABBBBCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACABBCBBAAAAABACCCABAABACAAAABBBCACBACBAAACBACCBBCACBBBBBCBBBBABABBABBAAACBCABACBCCBCACCAABBBBCBABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe" start= auto displayName= "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe" start= auto displayName= "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABCAAABBBACAACBCCACACBBBBAACBCBCAAAAACAACBBBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBBABABCAAAACBBABCCABABAABBCACACAAAAABBAAAACCABCAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a80f8d2b54375d9ff05e39f8a2d92f5e7c9cebd5492fc95b7c0b5cf0697ab9f6
MD5 77af2e462524f386072ca31fd246551e
SHA1 173e464f50877ea6c21d8ef6f217913f705161dd
SHA512 d4e0f505a7b59597fb91b7b4eb92a2331bce5557158f959d931dd8d73cb4e346b5b182f725b022735adba2609c78c6fbd63475586f21b65c158f9b87165c35b7
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.0MB
SHA256 ceffb4ad2db42f1341507c378e72a63ed82780cd1f7dfb1b9354501a87d252f6
MD5 f25ef591e09458e4aa86b7767803d097
SHA1 19d74724b6308b4b6ee01649758c847ea57556d2
SHA512 d0117eccfc267e39f48b211b1ee0734d64dbe2d882450322d1120f93000b9c7284f9e4adde3bccc3c3238e1c262535187e1f00cf8c8920ad2b0543409178aa67
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+W:AKaKaKaKaKaKaKaKcpiF
TLSH
T13E867E05F98344B1D97B20B04DDBD3BF8A74BB2187218DEBF74D8A1B6932B916438359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Windows.CBSPreview_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 0c794f7f01cb96b386bb65dbe3945425a1e3bb6c97e1273344a7477077c6727b
MD5 c8b0c10089b734434143503ee46aea17
SHA1 eabf79d53f1805fda6770dc465798a54bd0a9c42
SHA512 175afbb8823a40065a515a8d89203d227016b1ff2b1847609101a1da06f27867c4245e47716a6e34f383fa0b29af05c4f4aac3a6144d1e55f9bd951277a70b39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ml-IN\qap`g`v~dtlq
Size 10B
SHA256 6a17a8664bae15a0e26c58cdb9149a87a8e98d2d1f0856ca4357c2f155ead1da
MD5 49b47ee650d7e227ee9482f29cee3509
SHA1 c7b523015bcbfb01c2773994b8f39870e14a7e59
SHA512 f57e05df268eec99edd20354683912e3ce4f2ce7be5b238e0e375db202d5799291e422abcc25817c57d57e743b95a772f6df87f37d941f31de100298c7853033
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 d33f3c70c4ec08998ed1918ef9a40238a78252872af5ce80da122f86902e815a
MD5 2823cd7d5f1d124dadb80a828a462a56
SHA1 da1d327c47c9123af5fe5f5dcd7e6036ffdf8fa6
SHA512 7e769bb5d775f99082476da590ed18245de79a3099fe63722700ffa3ec013eec6492d6ec3de0ef8567b0b6839954a8eef96570c7c5aa13c18f8ab251ee4ab28d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d3f39955d6041656c85f6b761d129cb8e43ae7261a0e8f5e8f12681af8cf54a
MD5 9bb0f12923f6e44908d2f7c013e82166
SHA1 5750b32342cc4a7755fc60eeae55d6c6dd6067bc
SHA512 fb9b29141ad047f559c691834b06de5ef44226c34fc0ec6c4f0c6e84775bdb3558c6700b9b7e038f5a361b84733f7ee3c6abfec94ccf64e3450e6a3ea6c86bfc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 966dbec184969026300d69d15e6e46862e2f5af6e204152cd74a761de9661aa2
MD5 af58da2c16b93891dca30bc95a536ee9
SHA1 4fa20a683bb95d50dfb94d30de4c337d80065b9a
SHA512 9fe77e168d10d947217f558477874a15a0957568bfa4384bee4362c9fcaec6140f7c4b3ec7775d305e021327123e18a519a290f89bcd57e77386e9ce4a16496a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c518c27a114e7ba764234673c33156e5da42875315a778be3ec9748b28fbebff
MD5 27ae43119dfc3494c7081f7232f7766c
SHA1 9fb71aaf99311eb9b4a6cb5b156586cd12274683
SHA512 18344210b46d6ba8a7c2bb7e77c2863b4ab7cad2740e0d72afd6bba3c0e7d4c95454a517b587e428ced209c0eba2820839d2cb561ca5de56fe4ec4995d0cb9b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0ffa46f7d5fa00d9cd33c531cb85b80429f395101badf03f8232f4e61a367ffd
MD5 65de0614343360b008747fe324489ada
SHA1 35290e4ac4d72a5b62a8975b6811dd18ba36c4c2
SHA512 78c302b4946719ad7da9ec649c6d442d7d9015e70a527b8707daaa1de8f3f53da30728319bd29e037e8de6b9583cb3d14a4d4d53b32382711a3193c6a2b74fc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a1767f781bbfc87af89a48fb8eca7bf99828a1e9f858f77826bb48360b73762f
MD5 47cee785e4e52bb8fc1909f2e79d2bf4
SHA1 3c9df4397680ffa2b7142dd1a45fd8a4bf2b4dde
SHA512 726f64a53b0dc03b6ba47ed923db4d5086820339bce36ecd5a307d9cd5dc9a94e5d9e8b8d60a210c359e7217b3d244b743e9997aee2aa0ef080e4db0f499e819
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0782c2f9a6f0ef791df22f5b19099b78904610a411f34d2ff3e50a6c396ae953
MD5 2dcbd1677b80594e3549ed038dd663b2
SHA1 d835f8915c5ea4d69c154f459ebc093e2eef5435
SHA512 72398a31d00bc69245c196acd689366ca5e4922cee2c6a8292ee993091dfef78f971ba62cba409c22502e25b5959776dc2f003d170b91520823b213752ad4e31
MD5 SHA1 SHA512

Submit Download

svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCACCCBABCCAAAACAABABBACCBBCBBCCBCBCBACBCCCBCBACCBBAB.exe
Size 7.6MB
SHA256 0825a35f809fa4181c09156387e9a882ee4459e014db51a3b7c08e0a40b75381
MD5 fbb7e054b8a81c59309568e66c8e0b0c
SHA1 887bb768dd32f551c454295dcdfec910f6d70aca
SHA512 4b19c00c50466fde5ef4a2d798157caaf52214d88e50c56980c38df50b149ec61ea66f227123b237c0dc2c02a230962dc7e285056fae5155134051bb1953466b
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+m:AKaKaKaKaKaKaKaKX
TLSH
T109867E05F94344B1DE6B20B04DCBD3BF8A74AB2187118DEBF74DCB1B6A32B916439259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 c4e419362b5712b66750f8a4d18e75b4d593ea870c55d07fea98583fbdf98cff
MD5 ab2779ecaa041c1af8ce665882fee713
SHA1 a3e470ee4fa4a1292a722963905d53bf70683969
SHA512 a2dda7af0f6af1482700e98dc4daf1b4ac980bc85688956b0fda1e244e969feed9ddbb3473fd65a8454827412cc09e620e71541ec11dfc792a25f794c052e684
TLSH
T17D11B671E4F5D813EA3368CB8629ABA21CF4755F6C5C9A44230642286BD9C31CD154E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 309b7829f1a983ad5f0e3d1c6cba187399d1c3e94326943736c62552b2095f30
MD5 45cca1e029ee507071de1e5d293f98fb
SHA1 9f84a8b3f67865ac277d2a5f2fdeb307208c1dd1
SHA512 b90b49d02f19406bf7ff52e70b41bd76f4c9870b9436ff636cca218ce18d27d07a2f131c8b168d2b00971a8d3ac75a89f4985f3241424a1557c357b7a6349b67
TLSH
T16821A471E4F5DC13ED3368CB8629ABA21CF4B65F6C5CAA54230A42286BDDC31CD154E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-36-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/412-26-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1616-89-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4380-78-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/4444-59-0x00000000058D0000-0x00000000058D1000-memory.dmp

Download

memory/5084-0-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/5084-7-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download