1619343149f88ce22f9394bb802461f7830f55767102af5d92bd56d59f42b864

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
Size 6.0MB
Sample260814-eap3ystgld
SHA256 1619343149f88ce22f9394bb802461f7830f55767102af5d92bd56d59f42b864
MD5 9805d843b1aa687da84cdcec495ebe28
SHA1 4b5a6fdc4a1b378fb7c6e505d11363d3cf7716f3
SHA512 9d3eb80ca203675f5178963077d002e152533f843619641705a7c8c668fd51868339d55103450ab6cbf56967e520430ff98449c7b48023d11bca9d79d3a8f26c
SSDEEP 49152:U+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EU:K5V5V5V5V5V5V5V5V5o
TLSH
T15956E81977FD1504F6B3A67488B5C2A6AD727C605B31C3DF1640A62C1E37AE0EC39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
536	svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
1772	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBABAABCBABCCBBBCABBBCABCBCBACACABCACACABCAAACCAABBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe"	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACBCCCABBCCBABBBBBABCCCCCBABBAAACAABBACBCCACBCBACBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe"	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4312	sc.exe
1560	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3992	cmd.exe
4832	cmd.exe
1796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
536	svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
536	svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
1772	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1772	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
Token: SeDebugPrivilege	536	svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
Token: SeDebugPrivilege	1772	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2240	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3992	1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe	105
PID 3992 wrote to memory of 3608	3992	cmd.exe	107
PID 1044 wrote to memory of 4164	1044	svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe	108
PID 4164 wrote to memory of 4220	4164	notepad.exe	109
PID 1956 wrote to memory of 4832	1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe	113
PID 4832 wrote to memory of 4312	4832	cmd.exe	115
PID 1956 wrote to memory of 1796	1956	2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe	116
PID 1796 wrote to memory of 1560	1796	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9805d843b1aa687da84cdcec495ebe28_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCAAABACABCACCCBAAAAACABBACBBBCABCABAABABCCCAACCACABABCABAAABBCCACBCACBBBABCAAAAAABBABCCBBBBBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBCAAABACABCACCCBAAAAACABBACBBBCABCABAABABCCCAACCACABABCABAAABBCCACBCACBBBABCAAAAAABBABCCBBBBBBCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe" start= auto displayName= "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe" start= auto displayName= "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCABAACBABBBACBCBAABBBBBBABCACBCCABBAAAACBBAABBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAABCCAAAACCBBCAABCCBCABACCCACBBACCABBCCABAAACAAABACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 30c1f7938569fbd94efae963f093b4dca049271717f65fa4a10a39d12c72eb43
MD5 dbb08a6c5fd9f4577a82306367973c97
SHA1 fcd36aacfb173bc860829113b9d7543533a74be3
SHA512 824842e4a85c30714c8df3d7aa5ef02fa5af4bfb6fc202e1df520bb2cd466b8b8296cb6fdd24ab0b8d9411b31f1239563bb82226f719b93cd683702ecd16961c
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 6.5MB
SHA256 d059b87603875605a367945d1e253592272d7e875b605cd926f635f67e2cb867
MD5 4cda025f791913ac749bc52e741c282e
SHA1 694285a7e0451b57a5bffb2f36b5551475526a99
SHA512 12aa22d76be1d5c544333411c51408f50977ef0e7a1bc8ee471467cfbab5ddff5044f15f3918c0a982a30768abdb96ea19b364fedbba25625b137d639ff71163
SSDEEP 49152:U+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+ET:K5V5V5V5V5V5V5V5V5rpis
TLSH
T14F66F81977FD1514F6F3A67488B582A6AE727C605B31C3DF1240A62C1E37AD0EC39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\it-IT\qap`g`v~dtlq
Size 10B
SHA256 e91f144d8a266490dac5d18f260f11c47bf260d171ba6a285ae5e13afd54f88c
MD5 a77827054320c3a9ba29bc94fc565c71
SHA1 517a6d3cb7817e5b5b90b2d79433bdcb8a844bfb
SHA512 e423c59c5be0e4a952af0a4ed6a2f6d54895dad0ad07fa63716d0adca58cc97b9ab83c1ad873c34272442d9241d53ca4ce5219bca6e2edfb822cd2c2d7cdf9f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DiagnosticLogCSP\Channels\qap`g`v~dtlq
Size 10B
SHA256 13e7792321ed5b9bdc3037ee41616c6a76d6a6ff8e02a7f97cffb423a281864f
MD5 6b5127b0cb6c5a40bd101465667330d5
SHA1 aa5afdb1cb98556de3ad8f4daf2ee002f1fee9ce
SHA512 39381cb2edd4b4badea4fad544af5f712732bb856f489441824adc754515955aaa5f1dc005d4eb31abba67fb10a819670e4af91c8a01c848e7a3c7b2ffb66659
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\cs\qap`g`v~dtlq
Size 10B
SHA256 10e992275cb57a90728da8238ad1657621f00bcebc3edb11e8f44eedbc19f5e2
MD5 7d0e4a1500cb1b45aa053c940a32669b
SHA1 23502b1d8a8cc092ecacf2a69f40e1faa3c8d828
SHA512 90cb58dde116b46e91d19a3917b7e3a0c1d13dd0c4c35939f40fd29d1cadd3e387898d5f3628ace76fd31776a2472e36b2e03a739f39a1a7ffa953a38eddc1c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 1d35dcc4d91d517d7cefd0a4aac58893e82cfc3c287a5bf6f9676af3922ac1ae
MD5 bfa61a1a714e585cb592d518b65d18ac
SHA1 f1fc89826959e1b8abf10c0528a101c011e0697e
SHA512 c3477ef2b2a7168b87e326e20097ef93a9b3bde54f765c03232299c1002bad0c3255af50e6e83cfc477ce86c6822e1170970a3370da76bc63d8b7a87aed2ab74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93b838a404022ad9ec017d075ae24e655e1ecc59b45fa91c15c4399990b25220
MD5 ceacc6272a70856e2060faa13c1c198c
SHA1 64c23bf1557ef78273a420dcf9570aae43055a05
SHA512 b3445614489068a56cc826382e8360d990b2d809167e957861e67bed928c8e0a32ec005638cd03156147987628a32c1c59c5e2a84e3a1e25808ffd6b12484d8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b04a4a945ff580836193a184825d32125bb8ae679fbb60d2f2bfab2d2c0b156f
MD5 be00c216b62b38aab8cadc9a43eeb921
SHA1 a1991935b4510a08325495b993366e2205952205
SHA512 e73963518c617c640878e3f3deeb50c1c5d8bcde52665c0289476ff73b3717d261dbb678c9603fb9f6ec92c2cc9eba2b4fb1f8d71708713c946f799afeb75e9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07a603679887f38e927b6ec7bc7ab5f6550779570542790b14fd68dcc18ff38a
MD5 8825b2af26fa74d61f9ae34759c450dc
SHA1 6eb25c50d860063ea41fad72b530809b43f8e170
SHA512 e733c055e8cc22fe7287446e85bea59f839e7df0ac55f6b0a96249e542bf198c6c358e567553d3953016759a8d4d08b6c4ca33b8b084780f58e16898a3f96d96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99c41dc6ac10225eafd640207988e27dd22862a24268a19d45b1ef2680dc6c9f
MD5 f6c6db26905d47a54b63c04e8620c9fa
SHA1 81b61607da10f9a4492428363efac715b9f3042b
SHA512 2d876a7d52d8d8c8b834deaead5c9d2d066db45662589a6ca1f363cd78ac4e1c6d2ab288a18e8286583c8e99812fdc4fe3f87cadbff9acdd3b3c00cf95036bca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 404a739d26ad4ff0fc21ec0c4eb10f0f70381f292ceb6433e4694c63ea764f57
MD5 007a78d0c30e1d349d591f9c826ddab3
SHA1 140b64e9cc4b991121da8b3262d5e78c48353526
SHA512 74fe486b5da5d59e3cb73dea7bcfbf283b810068d7d432c669f653cc8585a83377d5ed83bffaf42a64a828dcd940118673e4d3fca0e9e95e35717919b3865a7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 707bbf1881e265093af587e3ef3b6c8b702b29595c4491049cd140cb01a578a6
MD5 bc179d5d8a071a09b25f1bc4a29647c3
SHA1 26c3a5c035d7dd44802a7dd6cb0df9a320fef369
SHA512 efbca0ba702ad92bc8f27ad6909acd8c70e907e4086fdf12bcc95310294c6011e64945c67cac1b246e6d7d402c038234607c6ae47c935e417a280b2857cae707
MD5 SHA1 SHA512

Submit Download

svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBABBBACABABACAAACABBCBAAAACBBBABBCCABAABCCBCAAABAAB.exe
Size 6.0MB
SHA256 1619343149f88ce22f9394bb802461f7830f55767102af5d92bd56d59f42b864
MD5 9805d843b1aa687da84cdcec495ebe28
SHA1 4b5a6fdc4a1b378fb7c6e505d11363d3cf7716f3
SHA512 9d3eb80ca203675f5178963077d002e152533f843619641705a7c8c668fd51868339d55103450ab6cbf56967e520430ff98449c7b48023d11bca9d79d3a8f26c
SSDEEP 49152:U+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EPiw2nC5t+EU:K5V5V5V5V5V5V5V5V5o
TLSH
T15956E81977FD1504F6B3A67488B5C2A6AD727C605B31C3DF1640A62C1E37AE0EC39B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 be11ec9516c03c9af72d3ef565e83af2caf52a514f63b1bf5b4fa09cbe40c496
MD5 56357c1ff5934c69774988ca5618a0d4
SHA1 0ba1618c1ebc62aa1b2632fef0f0a3909a00c4b9
SHA512 a94e450bd70649f6dcdf8f55df503486788e72fa163cd764129a3a3e44b9765b30c8f7098359fcb14d2818da8e4b2c8a077cc7a2978fdbaee437b401ecf3c419
TLSH
T13A11C864A4E5D417EE232CD7552EAF820CF06BBF68985A65230482286FD5C63CE19CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ec32f56b5a2e2a4a91481ce0b2940bf2e243fdd07c408b899997caa83eb72657
MD5 2dbb03bd8b27687ba4e6c218aee0a67f
SHA1 1f2874b94ae932d7653c777f81c3a888a96b7b7d
SHA512 ad37fd34f545341d82b1e57f4b04450f2a48a0d79f3c146e87ae198da06d5059f945b2fc21c25a20a8e0d1ee3a30367535a0ccfea3d44b71d13e8bb6188a31ab
TLSH
T19B21DA64A4E5C413ED232CD7952EDF820CF06ABF68585A21230582286FD5C73CE19CE5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-85-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/1044-36-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/1772-95-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/1956-0-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/1956-7-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/4164-59-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download