bf2be0c7041f92a22f37be381ea130453ffd563b29e701071943305efe5cc063

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
Size 10.9MB
Sample260814-d9e7csbr91
SHA256 bf2be0c7041f92a22f37be381ea130453ffd563b29e701071943305efe5cc063
MD5 9b6d766d702dc3f80fb0537a16b2c697
SHA1 50ee6568dc02fc967db1d950c0b57a4d4266660b
SHA512 c601b74cb49ea73721cfe9e517499140f59fd3a0d7500210d44f8c40c05bdf7352b2a4a81603027f01a197bb1625ada708a3929876c187ae863b44cad6f9528c
SSDEEP 49152:U+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+ED:InZnZnZnZnZnZnZnZnZnv
TLSH
T13CB64B0CF69700E5E977517089AB827AC93279314721CAEFE6C8C57E9E23BD4A934F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
4484	svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
3156	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBBCABABCABBBBABBAABCCABAAACCACBCACCBBCABBCBBABAACBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe"	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCABBBBBCBBACBBCCCCABABCABCBBCABBACCACACABAABBABCCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe"	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4564	sc.exe
2324	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5192	cmd.exe
2588	cmd.exe
3944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1332	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
4484	svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
4484	svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
3156	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
3156	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
Token: SeDebugPrivilege	4484	svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
Token: SeDebugPrivilege	3156	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4268	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 5192	3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe	106
PID 5192 wrote to memory of 1332	5192	cmd.exe	108
PID 5616 wrote to memory of 2444	5616	svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe	111
PID 2444 wrote to memory of 5872	2444	notepad.exe	112
PID 3116 wrote to memory of 2588	3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe	116
PID 2588 wrote to memory of 4564	2588	cmd.exe	118
PID 3116 wrote to memory of 3944	3116	2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe	119
PID 3944 wrote to memory of 2324	3944	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9b6d766d702dc3f80fb0537a16b2c697_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBCCABBBCABBCCBBBACCABBCBCCBBCBBBCABCBCCBABCBCABCABBBBBBABBBAABBCABACABCCACBCCBCCCABABCBACACCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABBCCABBBCABBCCBBBACCABBCBCCBBCBBBCABCBCCBABCBCABCABBBBBBABBBAABBCABACABCCACBCCBCCCABABCBACACCCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe" start= auto displayName= "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe" start= auto displayName= "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCBBBBCAAACAABACCCBAABABCCBBBBBCBCCAACBBCABCBBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2324

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACAACABCBBCBACCCAACAABACBCCCABACCCACBBBCACCACCBBACACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ae565da0a0a7b42ae6ebd71dd2583e4bbd7b424d96c4646a9f25cf2d1fc20398
MD5 5eec75743b9f1f6238178db60aaaa17a
SHA1 f3da76bfe3f5e14d86e156a73f6cfe47382df412
SHA512 6dc3dedb519d4ec0fbb8e89d58e0dccaf8db87b86e06232b69787a0551d217170430219c82fac5939e07f8426144d63e84e0d9d23f25a4f045a76afd24e6a3e3
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.3MB
SHA256 f098467107ca79a25d55c2bf1da81f872c59363dd163695880b2422331e52c97
MD5 fe3b92ea62a2942e0a798b15ba74afcf
SHA1 de10d90e74cb184d33dde8ece3eb7a25e09b1f56
SHA512 45f37a52c471d6eda23e4a6a813dc4b9dccdc4bf19765d97df5a384f7ccad6540f8d2d23312e8f5bb72cbea87abca1975a87a98af49b969aa11f45d824814c9c
SSDEEP 49152:U+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+Ez:InZnZnZnZnZnZnZnZnZn0pix
TLSH
T14CC64B09F6D700A5E977557089AB827A8932B9314721CAEFE2C4C53E9E33BD4B934F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.CapturePicker_10.0.19041.1023_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 0a2d4cc5629f433f811c2350e57819049762cc02afa215ac5f88fb374c15cdea
MD5 365a0f9388771e1e42c9d6daa6c49436
SHA1 38e68d8ff8426a276df713640ebb760e9098d2e5
SHA512 96693ea343067af305fab0c022c8ace40a00029d5f71a4d098b9b41f241e26864401b56eb8fa39582c597192e0b980acf15f01b95e4dac32e506c337a74de0cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 cf7eae9810aa3b9fdc3fcd581aac1fc3570144ec61b3eae1a5aa286822dc6253
MD5 d226f0cfd06fdd2ec78ba19ea9cc90e9
SHA1 6f1eb84d902660800918ff8d9871250ac2d57d02
SHA512 1c76a0e23174746948295a51e583c425baadcfd8b91b4c415414db28efa7a80002c7d680933a9b322fa2015059427977c656da2fee9bd40fbca7397dfa13cefd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\pt-BR\qap`g`v~dtlq
Size 10B
SHA256 280884f04f6ec7d6e093f97b18f524ad3254a8cd8556d61606305b839e90c857
MD5 7bea3df631666406902f8aa293e85e62
SHA1 8bbde123de27318db550b972ec77db3512bf6898
SHA512 a6429b1dfc9a0b58ca9065309628d7012c1b8144c1bba592e72efcd4a56692becca56eb1b898a528378458d2de1ac21c3950b37223a887d462d85b93d5ca6b07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\ha-Latn-NG\qap`g`v~dtlq
Size 10B
SHA256 4677c4108484f479314e1c19e5a04c58b9ba495b155a4b7858859120e7dfd970
MD5 54ec897f8dcd5166dbe22ca15f7d8774
SHA1 dc3a3958a2dfba2444a04e8f6ee9dda313dd346c
SHA512 6fefd93070726fba8e5a8e2df553ab68e4447149936ac898605d8c0edc7563b069cf6e7eea9137778da8a73a85928443736a4f678b1e2cef366b08c2755156d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 494300da709b8560313924632999c53bc760e13b06450c6ed16e588baf864d88
MD5 0ce95adea5235f606f1e05c3d7c8ab43
SHA1 c680ab7f4c06106f4f0aff3d090a903419876cac
SHA512 01afd4985d728b3413cd8c04f9b7c62cdef2260a2496dafe6a0b4c1d185fe8f431de5782843b17ea8440d029c955a2be1be67a92aaa6a40681bf6bbb24d6e77b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 caa19a12b534211d5eec798a4bfa41433c8edc48397dcf8945476bada50d5708
MD5 e1339643b5f148eafeb131bc48f75614
SHA1 81366d5c76921990464f9ad683a73eb0a99ccd87
SHA512 f9973036a47fe5b7382fc3d0c16bfafbc2560014045324ea447921988fd2127965d729de93cb62e2615f3ed87c503b139a6f82c19b75100b2cacdd4462bb1170
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e09a9ab5c4bcca5ccc8dc0014740c8f80d8acfc7a3445ecd1bd8e42a9d7b09e
MD5 517b58bb07c0c93349078bf764ad2aef
SHA1 dd841459962e83547834a1c9e19d0f1980e4f435
SHA512 d9c966918c7913e6ddba86f77590058af3417b5fa1d732004f9663fe03645b4cf4e980ae80c4a04bcd07489f2146b01810a410a57324ae1b4c31b0b96f0c9cdf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f430b062059803b2376369648aaf09d46c363df4b743d54c2dcf67675e149f18
MD5 ef128b16db926f4047fa557596654053
SHA1 f3ab3965c058e1ec484b13b662f8b0cc9a6bee0b
SHA512 94b5f043eac2f20b6b336b4260045e9a30ea1407d7f71a55b06de836bed67906f29f1a0a6655a35078561df11f9acbcc94410bdb4f7d6606b96e5e000f75e86d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f11e5b48b99f3b2e5416bb78fa6f83909c1f2142ac0eac338da3cd295857b83
MD5 85892681f6c37597ae2270441159843d
SHA1 18147a2b9a09fcff6887443e4ad27854c51ac0b3
SHA512 e4dfe474ec3162cca01167ad6fcffa9e3d9075b3bdbf612652f7e1168426b65900a627e2043f1305d1c49921b4e3a1cfe442587fee7a8bc83ed089480768ac6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e9f35e6cb8d9bd88d99e69b1b838ac016bca07e5cc6a5554ca66205b01a820d
MD5 149304f7281d1698d8f01a4b26bbd20f
SHA1 71e01600912ea83c60c3535b78a13f7206181db9
SHA512 2976e9debd95642413cf4a8b0df616550e7abe9f1cea71776a0db470ac5bb2ba5edd4113f018c9d14c74b913e5a18a21f9140f6fc14740826b767035c96606eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3fc21b279c050490c1c87c0fa47268d3fa3e6e174705d394abe4a6741bcb15b
MD5 e48975b58e80959364fda6d628c29395
SHA1 2e45ada4778ccfbf135bb5e35e22780326e57998
SHA512 d02b8135fe73d7417a3b8f272eaee52b3ae7ac8b97fc980f00ed55f25c32bbae92f2f24a198e2921ceb2824b140ae2e9fda2f7686ad8acbe50b6adedf11a7f9b
MD5 SHA1 SHA512

Submit Download

svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABABACCCBACBBBBBABBBBBAAACCAACBAABCCCCBCBCBBCABACCBB.exe
Size 10.9MB
SHA256 bf2be0c7041f92a22f37be381ea130453ffd563b29e701071943305efe5cc063
MD5 9b6d766d702dc3f80fb0537a16b2c697
SHA1 50ee6568dc02fc967db1d950c0b57a4d4266660b
SHA512 c601b74cb49ea73721cfe9e517499140f59fd3a0d7500210d44f8c40c05bdf7352b2a4a81603027f01a197bb1625ada708a3929876c187ae863b44cad6f9528c
SSDEEP 49152:U+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+ES+ES+EFhO0+ES+ES+EFhOU+ED:InZnZnZnZnZnZnZnZnZnv
TLSH
T13CB64B0CF69700E5E977517089AB827AC93279314721CAEFE6C8C57E9E23BD4A934F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 6f8e58d44cfa0d73542d57d39926caf44f5165ac2ee3380f7e844a99c851408d
MD5 520e0625e89890bb8d836848c92b653f
SHA1 b7ca4e2e87938abb68733532e3fbdf1fcdc3560a
SHA512 1fc3e4b8e5ee65e11ece6c9b570040042626f563a37b90bab6e75b252f96fff709dc59152005ad09398d80865876a08fdc0df51064e50a3658a896f15b13d5c4
TLSH
T14E112E51E4F5DC53EA3324CE561EAB920CF47B5FAC5C6A551208822C7F45C338D190E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a5c52f859c544b753a0754c811ca4f9a56e27c84edc14708424ac16a3d1c9a91
MD5 80fd3753bffb380577ef236936353743
SHA1 d439e646f815634a63029aa8680049ed73b910bd
SHA512 df2d243279fdd5cc39277ecb29e31fdbc8a9dc2d6f282d2331ff158d2796284d6f9553d2552f7e70a82280b7baae0d7c5d9a232910771de003d9a46970ff713e
TLSH
T1E421FC50E4F5C853EA3328CE962EABD208F87B5FAC5C6A65120942287F55C338E1D4E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2444-57-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download

memory/3116-6-0x0000000000FF0000-0x0000000001011000-memory.dmp

Download

memory/3156-90-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4484-77-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4484-89-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/5616-34-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download