b2bc677e630c7acc3f0439916f940126ad65d56fa98ddeb819b8673ee002c118

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
Size 4.4MB
Sample260827-x3xmlszfph
SHA256 b2bc677e630c7acc3f0439916f940126ad65d56fa98ddeb819b8673ee002c118
MD5 3befa168b554b220b373f4882651f7b3
SHA1 8b77ddd0a57e2209b0164ac07bb34d6dd616709c
SHA512 99b933480fd10c40538fc3792d6386b82ff5d24d2492785a204fc0e74bd520c74f8e81058ccf4b54046a8d845bc0c49fbaaff8922d2a7aef676194936ec51de6
SSDEEP 49152:U+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5H:W5z5z5z5z5z5z5z5z5H
TLSH
T17626095967FA1284F6B3AB7498B5C2B26D36BC205B30C7EF1500B51C1D26AD0ED39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
2960	svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe
4908	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBACABCBBBCBACCBAABABCCABACBAAACABBACCCAAACAAACCAABBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe"	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABABBBBBBCBACCACBBBBABCBCBBAACAACABCCBCBBAACABABBBCBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe"	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1084	sc.exe
1660	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
1284	cmd.exe
3820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
4908	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
4908	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
2960	svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe
2960	svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
Token: SeDebugPrivilege	4908	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
Token: SeDebugPrivilege	2960	svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1508	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3364	1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe	100
PID 3364 wrote to memory of 452	3364	cmd.exe	102
PID 4444 wrote to memory of 3680	4444	svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe	103
PID 3680 wrote to memory of 932	3680	notepad.exe	104
PID 1584 wrote to memory of 1284	1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe	108
PID 1284 wrote to memory of 1084	1284	cmd.exe	110
PID 1584 wrote to memory of 3820	1584	2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe	111
PID 3820 wrote to memory of 1660	3820	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_3befa168b554b220b373f4882651f7b3_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCBAAABCCBCABCABABAABCBBAABBACCCBBCCCCCCAACBABAAAAABACBCACCACAABACAAAABCCCCCBABCCAAAAABCBCCAACBBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBCBAAABCCBCABCABABAABCBBAABBACCCBBCCCCCCAACBABAAAAABACBCACCACAABACAAAABCCCCCBABCCAAAAABCBCCAACBBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe" start= auto displayName= "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe" start= auto displayName= "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBACACCBBACBCBACABABBBBBBCACBBAABCBCBBBACCABCAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:932

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBAABBCAAAAABABBBCBCAABABABBBABAAABCACCBCAACBABBBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 030cd9e300f1b623c5f1bf47a8bfcec20b4747d4232e8bfefee5315290bf4dac
MD5 2aa77d33942461533717cfebb502ddd3
SHA1 d818eca464f2bdaabf9d60f2a8d30c2b595d9e22
SHA512 d4262a999d509b8c247167b3727bf04b6f18871019af1ece892e7754b6b3dba56d07c8a887109ad4d2c3cae28ac61881596c51891fd658742904e978a869bfb3
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 4.8MB
SHA256 d40eedfda71bf654a70d24cb7fff0d3631ab0cecc28b1979af6ebcb8c4631b4e
MD5 2aceb23d1cfc4e7a0fd74c7a904b87ab
SHA1 2c68fbbc9c266f1eed373a0bc7d6b9a8af0311fb
SHA512 c837e569bc426b5e9d04dfa26f124a97eeae8a21d599363069a33c2a1beb26a747d1d55ac9b97ff1548224fecbfbead9a90ab5456052ba18c334a40afc096475
SSDEEP 49152:U+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5a:W5z5z5z5z5z5z5z5z5MpiU
TLSH
T157360A5977FA1285F6B39B7098B5C2B26D36BC205B30C7AF1600B51C1D36AD0E939B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.AsyncTextService_10.0.19041.1023_neutral__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 ee9ed2d6154e46c41660da68e948188bce55344a300c7d18277107f4d6c9d27a
MD5 56daa073cfdc52616c83e91477e69b3a
SHA1 5b4f951d039df8536718170b201030cd4f80c308
SHA512 701fc87744db270e67cf9679c3cc1fc344ba140475db0fcb24f85ea086d17aa988cbce1c1a17d1635d7edac0700e2118495b80c86a1f644caef10dcc2b6fb228
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 105bb18d7ebcdca8016105f49ee21c592a354a624489f657cad806b5dc188795
MD5 c5c4fca8c0ab210561fe8eeef9a38788
SHA1 ab4319b8624ecccfa965372c940b702b1d9a8dc5
SHA512 bc8c2f2f900f8b606f3543c51eeac56f3fe7d657dc5116ce1e1f93e8dc1cb91d3ae9ae0f39c86f86c2296cbce3a3ede3d0bcd963a6d8b90b5b8b660cc7a489b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ne-NP\qap`g`v~dtlq
Size 10B
SHA256 c13ab0d962bd074fcd46d444b4a37ef910bc7c23bc08b7e1f29e0e41df726a97
MD5 9bcecb4701eec23e2451a24a37b0b559
SHA1 47e80157bb4b22ca01b19a3911d61e1e35b12714
SHA512 fdb15ff344d02ae76ae7b8353ee956dcdd6b49aad17507d2f29a3518be127e1a765191db403901a33f54dc598f485f8db3c771c8f910066b74d05eb1d5f11ba0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 958836fd42cdc4fa6362c7067ad2c991937eee626554ee6f7e18bc7d755daf11
MD5 bd7956c34647f5c7104fecad81bd45b1
SHA1 542809ec3b378174e851c0cc06047f8fee8458cc
SHA512 2fbee0cccdd61526b514fe99d533289d4665fc1d904c7558dee4cb0ed7501c523cae37e02dbb80d6140aa528996c0ce02a0d4d2452d46cd8e372e81a59065ff0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8fe48e94a7ea87bf0a4de7510c6497ec2c724a14915996354c6d6aed2cad7f1
MD5 f3d1f39b87d3f29ec87022cbb5decd52
SHA1 739c511450ec8cd8ff3f6da959d5884b5daad22c
SHA512 b6a715e5cbaea7c8d13aa5125be742a3d7e5c56ea8666fabca360c4635e36cb4643b4554ced03a3cb043d788313bce158fa405ecdc7ba7544d7525cbd68f342a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f062ba68b595fb6a23bbfdf0907a0e7600804d452ec73eebbda6ab238294183b
MD5 1a85058e012d9e9007e590d17307049b
SHA1 4fa37de9e8e15624dd8e94e46ef10bd160dd9d67
SHA512 74df6c8026ce11303d1e07ae5d68c1996d5ff6b14f0eb455b9ad7c8e8bd3469b16d5e188991df7ddeeb10ef6f9dd2bd0189ac2e0af4a821a8ce34dc75c8117de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 538a343d06477b6809d4af1bb9a1fc266d77ac6dcb34856c87ae00854c2e1222
MD5 6fcd462b4cb5bc8a9ee1d518c8df518e
SHA1 82ac09951d65568842651b18e40d8ab081430dba
SHA512 42d9a20b16dd39c6fdb013817273f35da71888c147b23bdca91c4610f3365e85903dd847117a93249bdb080e7840e7b50cc15af15659dff6655e53872e6a676c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 736d6f35b49c735945b063fef551aa8dbcb4128489fbbacd6499aeae39c8f77b
MD5 31e8be25331181347c7a01c53c555d2a
SHA1 9aaa2bce31b0cbd637782574d658181a296be5f6
SHA512 b572e9a0d3d6647ea44e7bce4e28119b5c119b40398cd5d9deff488ffcc51973f6a4cab30337941aa356d4c9a4966aa0fbf617515a2a275fa065458a28a26177
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 63ce1fe9433d2d5f1150c8025893ceccd67599c6dbe7a00d1adae94b7982ad1b
MD5 f70ecac86f998d7d6a0198182cc966c2
SHA1 a48e06a6e2f42c2a85c8e2ffe6cdbb3dfb0d126f
SHA512 d6706743b54ff79eca381290bcae1a7d27c2e26a69898895f75441ec6dbeeafe80c778dda0e8e44dca00b66b982964abf4aceee13c47be6177286d2028a437aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1813e17d1007646e49fd7712351869b38c374a4317e1b5bbbb414c1d4ee9fe12
MD5 737bef5f054bf614168899c0a4bb8931
SHA1 c9cee4aebd0508f0a259adfbdc2fad58ddd6ee55
SHA512 a44e719d6a0334964cad30be073f7a018854cb28a0a1ff6061040ff62e9e28d55e749ec8cccbb1fd0f962b9abed1df0d383af11c2e47d0366fd4191801fef255
MD5 SHA1 SHA512

Submit Download

svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBABCBAACBBBAABCBCACBAAAACCCAACCCBCBBAABCBCCBABBAAAB.exe
Size 4.4MB
SHA256 b2bc677e630c7acc3f0439916f940126ad65d56fa98ddeb819b8673ee002c118
MD5 3befa168b554b220b373f4882651f7b3
SHA1 8b77ddd0a57e2209b0164ac07bb34d6dd616709c
SHA512 99b933480fd10c40538fc3792d6386b82ff5d24d2492785a204fc0e74bd520c74f8e81058ccf4b54046a8d845bc0c49fbaaff8922d2a7aef676194936ec51de6
SSDEEP 49152:U+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5t+EWXC5H:W5z5z5z5z5z5z5z5z5H
TLSH
T17626095967FA1284F6B3AB7498B5C2B26D36BC205B30C7EF1500B51C1D26AD0ED39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a6111d362633a71f0d0c13705804389f7f2e08efce9f36a2845051d644909c1f
MD5 6b46832cd91a21c4d5198d69a2124c05
SHA1 abf44008f7e8c516452421a5e6aff256fd95d44c
SHA512 607e159e67a360f6fc91d0c177db486557db3ad79963fa6c81df39350a2c9c7addb0aa882e6cfbb51096dbcc7412ae7bac27302ee56bb070d4b49b9c11ab3790
TLSH
T18F21DA61A0FAC85BE53328CB9321E9D21C9436CB5D2C5A90230A5518EBD9D30CD578F3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 331fdb68b404fe4a089b300bc5e851f170e00e2c77355147e6ff33d6cd43cca5
MD5 e55da541f9bbff3a85bd9d90b9b9f349
SHA1 da6eaae2ee623797019b4b2563105a9035c38702
SHA512 182870c6b8bc33581bbca52d971996db687e4648ac3f6ff71ebd0e2f6049115e91773b8e4b242a79b30ffe70ffca7d5f87e85763f0a5af3d3d8e750c3554a7a9
TLSH
T154110860B0FAD85BE53328CB9221E9D21CD436CB5D2C5E80230A5608EBD9D30CD578F3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-6-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/2960-77-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/3680-58-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Download

memory/4444-26-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4444-36-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4908-80-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download