2a5a2e4028e80a46dfdcbefb209441c82978876cbb36e6e6ee3c99e6d53995b5

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
Size 36.2MB
Sample260828-cecbjsem4t
SHA256 2a5a2e4028e80a46dfdcbefb209441c82978876cbb36e6e6ee3c99e6d53995b5
MD5 f1f4774b46c8933b5e1ef06794e29c62
SHA1 2b789032e147710cf485e01ab71779d2168f3044
SHA512 33718ea7aab2c720662069cfbfd6e208fd42f8f137826e598c7faa33f5569e2c48edf2dd58f561f751001c32325c78cf1b4cd7f48d9b875e242b8351b1c6886e
SSDEEP 98304:xK7K7K7K7K777K7K7K7K7K7K7K7K7jK7K7K7K7K777K7K7K7K7K7K7K7K7rp7U:DU
TLSH
T125872909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x002100000001c520-19.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x00080000000182bd-397.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
5480	svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
3172	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACBCABABABABAACAAAABAAACAAAAAACACCCCBCBBABCBACBACACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe"	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACBAACBCCABCBAACAACBCBCCCBABCACBCBCABACBCAABCBCCBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe"	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4728	sc.exe
2576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
3224	cmd.exe
1700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
5480	svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
5480	svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
3172	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
3172	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
Token: SeDebugPrivilege	5480	svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
Token: SeDebugPrivilege	3172	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4588	4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe	91
PID 4588 wrote to memory of 6096	4588	cmd.exe	93
PID 2604 wrote to memory of 5968	2604	svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe	94
PID 4148 wrote to memory of 3224	4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe	97
PID 3224 wrote to memory of 4728	3224	cmd.exe	99
PID 4148 wrote to memory of 1700	4148	2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe	100
PID 1700 wrote to memory of 2576	1700	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f1f4774b46c8933b5e1ef06794e29c62_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCABCBACABABBCCABCCAAACCCBAAACACCCCCBBABBCBCBCAAACBCBBCBCCACABACBAABCBCCCCCBACCCCBCABBAABAAACAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACCCABCBACABABBCCABCCAAACCCBAAACACCCCCBBABBCBCBCAAACBCBBCBCCACABACBAABCBCCCCCBACCCCBCABBAABAAACAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe" start= auto displayName= "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe" start= auto displayName= "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABABAACBBCABABBBAACACBABAAABCACABCBCCAABACCCACCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABACABBAACACBBBABABACAABBCACCBACBABBCBABBBCBCBACACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a0f52029585925227eb39afa330fed70481d9b74265132e478b195c3d25f85c6
MD5 de6f2de9d5d6e1c0fc7cef8a02e53881
SHA1 b4b215167b3d414c79ef8c5ae7bf622f93db263b
SHA512 9b86a594c78b2b6415ced2f80216649f515b70ac0ca912b744479f91968d193d96c98c04e95efd80e883fdab7892d3f28ea77411028cef3c18450fa2e4968ce3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\qap`g`v~dtlq
Size 10B
SHA256 2114b64c0de5a96fde134592fdf0eba4dd9209a87c4748916a688a0a79c63d79
MD5 12a75c1923fdc4b2283a9320f7e061f2
SHA1 1ade53636e2db4d86155c71648b1caeb5efe9be5
SHA512 9311f96b2386920a76b4f9cc50a5de040a07f85003c1e2d0e4be765252d55182a0e4f8cdfd7fdb80736651f352174f41e54d2ee6be3c01b8615c42f5184a3baf
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 36.3MB
SHA256 30f02a2f239462731dad1b28071778990a301e8754d6a4ea229497152d67fe6a
MD5 7cb4b797e831d5ea4d5f6710d12a75ed
SHA1 8c1744adcf23c34050f9c510cc7607eb7a1cbcab
SHA512 720206ccb514b33eb8330c94d258c723fd575b9385a809602b798a2e217ddb8b2dbf1956f94e25543a0205818a99ccf17396ac34d566584bb32821eed44426ca
SSDEEP 98304:xK7K7K7K7K777K7K7K7K7K7K7K7K7jK7K7K7K7K777K7K7K7K7K7K7K7K7rp7zg9:DzgZ3
TLSH
T14C872909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 c0d013e5fa1d139c3bb643bca515cc8bf404d37805336d30698554acfe6494cc
MD5 683fea147f894476c771950f66629bdd
SHA1 4da6b79110dccdd24ea018051abe38354aa3bff1
SHA512 6ddfcec6972f0c375bcf4841ea233f9044469964b41d846ef4a928308b2386d8540b3ea1965128de454d14e53f7aa93e5c278bc5974a838b92b1f93422e4ca52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\qap`g`v~dtlq
Size 10B
SHA256 08c3db44c0b5e729cc159f33b11aafb0612411457aca024de7cdb37adc53b0fe
MD5 412fd1311014a28664776c85098ae663
SHA1 931e9abc0d944caffcfb3471df9be5d54ba577b1
SHA512 d75d817d002a7e6c1bce08542b78eb8fa98960b8212a8c939746cd7dc4885e2ffb2c56711ff30d90a384a93007526bb942bb1d77f2d60fb2d81c7642802dfe4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 0987bbda7dd9ba22f616b495c8d764d7dee31173709332d3b20de82f827702a7
MD5 9a54c62fe09173822176b75e9b9408a0
SHA1 df3d109082a0496c10a5299744c7f5b6b7412830
SHA512 c4cfd6975fed3c50b9010f1e5f6716917d61e5b2c5a45eda2b5b4e7aaa26fbd2a8158ad7f797472193a0ad926e5376e643dd44e5e720c2ef23f3d1be7c390f0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba4235c90de0624f073ffb1193515f756b007da65bff352e405cb332c95aacb2
MD5 8851501457caaa2bfdd679fd56536ea0
SHA1 c8debb457081de6d883b9e0263f2bb97dbf471bb
SHA512 fba75c45f5994981dab9f5eef302df7b358b0e8eef0211e0631583b4264d39c0c2f52a7b9fdfb4cf0b5d286fb5ea84f96a02a68bf662166034cbf888f0e39144
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ee16b4cbb315288935857554a9f719012f3406ff02d0fc8c19c0893c4ee594b
MD5 73e992634bb4b566c746e1b0f26bebc9
SHA1 50b98b2da4acacfa99ca00e86aea76c0e14910b3
SHA512 910898e296954ce427f9e7394025c2e077145f3f748b7a7845cbec887e103e7a70f10e6c6f158da33f48da0858f127f5e138613d0d9e25caecdddb52c61443f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ca97d6db1a0f80e3297e7670410aedda8aba06792f82473e881c62035f4b3dc
MD5 2ad69653009652c7ff8e08907f41b0e7
SHA1 53d9552b839d54483f3968968fb303da7ca3f39b
SHA512 c16e13dbc865242fd34afacffd1bde3ebec919a6a357f88bb3810e712b0f21277246f829926cf965f4b8e2f31fdfbcbda6d524021ad6f9970749b42a52f413f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34a10eed2593d0a52e98e39ef15f785822ce1df8e3ed0845cc42e14a6075e830
MD5 eaf69c0bc992ca4408aa64d1638e80fc
SHA1 ac59087f7c79fdb1259d7a5e8f8d9d688cf96da9
SHA512 ebf4abf68f6a54e4a7869f6a35a2a0329cfb1377998e0c7f171cd7f5f58d99a83bcb6d527609636f4849e643dc45b2507829fb55af8899f6e05c50d0cea1e857
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e25d6b5e010e2affd0adb324edfbc460e42dd5c8ff48e94af487a6108b8904f
MD5 012696aea21b825816beec86ed2d0ee5
SHA1 392cbbc7ba88cde64360d1d5772fbd067a346873
SHA512 29316e58da53a4531fee25c04137517f5e5cb2637aec5b64dcf734da4a11c1f3d0bded3f891428fc6c9ef119b02c4712fc1ef02dd3332693fbd856364bd7a82b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f2cd38fbf6995075ddf0ce613bd0fa7086a0d652dcfefe420d9cb382d6dcfa9
MD5 0d557f9a445c583079a04e188198b274
SHA1 dd0404cfd3a7994d0de0e6dbc6b64afeeb779fcd
SHA512 625207a8f05f7fd3dcde674c6dcad4720a6916844515b455b75103af79c87f6fc6e6a3f0688478131686e3d38f21466497c8895dd1210f746b170aaf8844bf37
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c3a134c8d3f18e4b66b2f7cf99730ebfb33f1dc8514a8b8b39260fcd536a131
MD5 66758559b10e7c24e87f682cb91e38d6
SHA1 2c93d84ea1aa515318970ed079753c5ccd44ac67
SHA512 41b5cce209de6d57c535d5a19af98b36b689a462cf8ea6515d17c8a114a5759635bfd958c52d3f76d6edaee3d0f704482dc5ed344a99cc73af8bba067074658f
MD5 SHA1 SHA512

Submit Download

svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBCBBCCACACACABCBAAAABAAAACCCCCBCABBAABABBBCCBCACA.exe
Size 36.2MB
SHA256 2a5a2e4028e80a46dfdcbefb209441c82978876cbb36e6e6ee3c99e6d53995b5
MD5 f1f4774b46c8933b5e1ef06794e29c62
SHA1 2b789032e147710cf485e01ab71779d2168f3044
SHA512 33718ea7aab2c720662069cfbfd6e208fd42f8f137826e598c7faa33f5569e2c48edf2dd58f561f751001c32325c78cf1b4cd7f48d9b875e242b8351b1c6886e
SSDEEP 98304:xK7K7K7K7K777K7K7K7K7K7K7K7K7jK7K7K7K7K777K7K7K7K7K7K7K7K7rp7U:DU
TLSH
T125872909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9c4dc517e0fec4c863c4fc5ff12a2fcd1febd437cec05cc248ae4ad2200e31fc
MD5 7d8815ae017457907315fc1445097de9
SHA1 d905ba6c17ffc4810330f0c7ed26e4e18c5c6123
SHA512 00a9ef27c8bbc28392b81e0524b2aafc5f417844c216e2a23b6b6bd66982bdebeb87f727de70abcdcbe38a52fea4b0ce6614241cd4cb94a0d203fd7378a7bb47
TLSH
T13211E769B1F5D853E433A4CBE212DBC35CE4769F686CAA15530D8218BBC9C35CD590A3
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c594d249aad0cd744ca5143de0c25ea6588ff72b35cc4a9184a178137c25d9f8
MD5 0a5e2092fbabbbfdad842022d6bfb08e
SHA1 4cdb327af7c6a8bf5f8639ba92a1d4e4ab614077
SHA512 673d7a885a02468bdf9d5cbd95413e07db352c4c03d82df2115339156ad50956301fa67dc5aa04aa89277213aa1bf2a8da916fa34a5286a6218f6c845517b904
TLSH
T17721C669B1F5C853E433A4CBD212DBC35CE4779FAC6CAA55530D8218BB89C35CD590A3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2604-33-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/3172-116-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4148-0-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/4148-7-0x0000000000630000-0x0000000000651000-memory.dmp

Download

memory/5480-73-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download