be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Size 2.4MB
Sample260831-e46ykavcme
SHA256 be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff
MD5 ca0386fac54c08f06e0e1e984ddf41ef
SHA1 352e7ef8a5c1867a228c932633c5cff2764be482
SHA512 908ee91c27d0caac5f7b158ccc47464d07ef5b6f294531281666ed33f0ca0af02460f3226f0f3a40ac673be077be7ceb3f9673db1e07d2abea579ba389785a7c
SSDEEP 49152:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IUhabas4f7f:KO4q75Av7fbUhabgf
TLSH
T1E9C53B2CFD9541B2D436867088D7F6FEEA317912A6004F9FA5D6434F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
2936	svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
4192	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBBCAACACCCCABBAACCAACAABBCCBCBCCACCBBACACACCABCABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe"	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCAAACCABBCABCCABBBAABBBABABCACCBCBCCBABBACCBACABCABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe"	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3924	sc.exe
2760	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5788	cmd.exe
3000	cmd.exe
5140	cmd.exe
2604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1132	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
2936	svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
2936	svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
4192	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
4192	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
Token: SeDebugPrivilege	2936	svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
Token: SeDebugPrivilege	4192	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2604	3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe	92
PID 2604 wrote to memory of 1132	2604	cmd.exe	94
PID 1936 wrote to memory of 1932	1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe	95
PID 3664 wrote to memory of 5788	3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe	98
PID 5788 wrote to memory of 3924	5788	cmd.exe	100
PID 3664 wrote to memory of 3000	3664	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe	101
PID 3000 wrote to memory of 2760	3000	cmd.exe	103
PID 1936 wrote to memory of 5140	1936	svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe	106
PID 5140 wrote to memory of 1044	5140	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBACCCCAABACCBBBCBBBCACACCBCCBCCBBBCACCCBABCAACBCBBCCBCABCACCAACBCACCCBBACCACCCABBAAAAACACBBACCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBACCCCAABACCBBBCBBBCACACCBCCBCCBBBCACCCBABCAACBCBBCCBCABCACCAACBCACCCBBACCACCCABBAAAAACACBBACCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe" start= auto displayName= "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe" start= auto displayName= "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBAAACCCACAAAABAABBAACCACBCACCAACABCBCACABCCCBAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACBBBBCBACACBACBACABBBCACAABABCBBACACBACCBBBCCAABACAACBCBCBAACCACACACCBACBBAACABBCCBCBBCBACBCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAACBBBBCBACACBACBACABBBCACAABABCBBACACBACCBBBCCAABACAACBCBCBAACCACACACCBACBBAACABBCCBCBBCBACBCAACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBAABCABAAABCCCACABBCACCACBCCCCBBCABCACAABBAABABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 ce0970b2fac3fc5931459025e53cfee03707d79a3b8fe2ea0d75ac3800296694
MD5 91ac11e3580e4f7f0f7e1e67f9ad0768
SHA1 daaecdd0bff2e0468cc94b792428d117626d8c03
SHA512 66f58c6b1db9518d562801c0303526f11a8f054467326da20a77e6bfe034a696682c7bea7b036ae45f75300b5767e8a55e07fdd4216fe4a326a65a3025df8d81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Families\qap`g`v~dtlq
Size 10B
SHA256 c043f7fa9599b7d30b71811a98754af034402ca65bb0b50aa037cd79f21056df
MD5 bd97fa158d0da65cddb7e35969481eb6
SHA1 accabdb10262d78ab5fc0629cbf67daab7364a34
SHA512 414ca2accd0f81c0a9b3b4de622f3d4c6767cf2be2b2e4f16dc0b2600c9a11dca942cf907032cf43008ab5ab8f82144c41acf7a6ca01519a768109acdd4d4e12
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 3.0MB
SHA256 60ab5998f85b4d896e6a67be11ce4b58fac41f0b1f82bdb61ac33a222cdaaa73
MD5 f495c6dee25f9785e43b452c96efc494
SHA1 bcb9dfa8b8f33af1b439aa6064fe6bb36cb39afe
SHA512 67fa92cf76ac93896e469dc9dc417f702c44602f2446325a29a565e392abc232d54924949f71df3b4b4356d49fd5ef54a4117e1a287864a90b6afc27e086cd28
SSDEEP 49152:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IUhabas4f7l:KO4q75Av7fbUhabgSgZ2Hb9t+2xQ
TLSH
T15FE56C2CFC9540B2D572827188D6E6FEEA31791267004EDFA6D5830F1D3BB926C71E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 ccc2afdff828290a55f2c8cf7089ceef9f6a24de78554aa0808244c5cdfd0934
MD5 8a32032a544ec107cf27895a59ea71c0
SHA1 9c0acec11ad0fa513c7ae7a240a00ed47583ec13
SHA512 164ccc2666036c95d781a9011dfc2e6eef6a2cc05c69bc609193e3f8e030e410f578a7965f9f26c9215e7ee51679b736ca511b9a5cb890a02f45916b791411cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 309f1fee7e07e18a2b9ff3b56157fb149b46b18975bb308f18b0034f118a8550
MD5 9e18d3484b61b0bd08e934eefe923965
SHA1 4c3477f561e2e1535d8fa20b6f99fff4fe89426f
SHA512 8151ea6d4b303cb732f27ae6559b2f36dd0585746f1428fe530b85fd5f880cb2a965250054118d3cb329e1f5735b77437607d6a2616c42140caa8bc8d2ad1f07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 64d0f8f21f179a70c303bd120f2b2306158abb0f7ce78e7ad967a6bc1ee337c4
MD5 1388df3173bb5e8231721024dc1d1742
SHA1 d2f4dcf5d9e332de377030a93d19357f54c8a96c
SHA512 ae26ce1187971524feb55b962b261ccf74c76f0c8be654cdb4add1572e9d9e62d77d477f2513ba895ce673a4dd84a2b3898f116f370d55048b237b43b0cfc65c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c8cae9730b631dbc346f911cc3cb59af7d5973773090c5918fca33a61f4f998f
MD5 a0047248021b1b09f1b58b12a1ae6160
SHA1 ab2ff1512bb94993ae80c74e6f08ebbe7f4f3b02
SHA512 c883d305a0edbe941a9afc0106c0453f0055c6363ee953e4215e2e8673a3f70a795f33d83c4b1d827421851138927e826e996944a1c859aea2994cd1100c9cfd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d00a3f10be7eebddf853e0256b5643a83fc05ed7677e6eb6686dd43906a7f007
MD5 119a011211ad30ba5eecd2fb811150d7
SHA1 045a743a1c9a0b4e69b4e0799ba52d5474282fb1
SHA512 b787e1ee72425f0163f69f45b670915f2e8ef202d5599d4002f95f5eb5ed34ce7396ab5b95b5b9cd700817f095f45699ac76592b9762f29a8a90af41572b033e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d61b72c167c7a709f3ae8029312300847929052f9f65174ccce6e27ef50e6d0f
MD5 d0ecf39d7b6d2ea61c78a7e51fb1c816
SHA1 a875d505c3fdf592c55cf2426925e457ee07d82d
SHA512 46283312dd510c0c0f998a4b9ae6ef20afc8ae0c35a973dd56611398a27de5a23e9b75113385d710030c99c95531d6d06dfc6c7c7f6f95089ab252206b564185
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 0c3b0ddb204995caf973ff23af18fab15b4912b1dee6395259a47314dd7e4bbb
MD5 7dccceb6a33bd7747210d857aff95561
SHA1 a5f7eb05b3435a6aa90efef0facafe25a875ad14
SHA512 97cc25089d9d99dcf35ea0b32aefa4f99f71ed01c85f356c0730cafe9fc7bbb60bd62e1c71a9a1af885797a60a6b5481843611e70b8e3986928d5b15333d47ab
MD5 SHA1 SHA512

Submit Download

svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCBBBBAACBCCBACAABCBBACAABBCCCBACBABACACACBCBCABBBCB.exe
Size 2.4MB
SHA256 be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff
MD5 ca0386fac54c08f06e0e1e984ddf41ef
SHA1 352e7ef8a5c1867a228c932633c5cff2764be482
SHA512 908ee91c27d0caac5f7b158ccc47464d07ef5b6f294531281666ed33f0ca0af02460f3226f0f3a40ac673be077be7ceb3f9673db1e07d2abea579ba389785a7c
SSDEEP 49152:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IUhabas4f7f:KO4q75Av7fbUhabgf
TLSH
T1E9C53B2CFD9541B2D436867088D7F6FEEA317912A6004F9FA5D6434F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 dab8614639d009c410679d1a6fdd8311f8a8fb148268bba24fdea98408ab8eb9
MD5 8ca9f4e31c203563998c1da0766eca87
SHA1 f95bfb22af44bc505a6e92d516ea69053ad15c8c
SHA512 db0b6ea38605b3e453e143c9a7f7a6749d9e34c878f5fbdc433d4ac19db02e2e01e2e550bcdccf829e138aefd1e115b6ee4c5be8ef0c135cd4b22c3492e92123
TLSH
T17D219161F0E5CCA3E53268CBE525EB9708A437DBE89C9A4017188619BBD5C328D150E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cfc17d58ecdc7b24fe32bec6f829ee32292f39099eb6565403ac0a3a6b2a8a78
MD5 c75e038354805825cafea564021110bc
SHA1 607dc7f5f8fda24869eaa4d0ac0402c91d60d80e
SHA512 c33db7d139a54925605ce8d13133bda43063a9d5640bbbc415fc699d49d0356d5e7842ff545b531b00a905a39e6a07ad24ae9b411d599081a9b0444dfb18646c
TLSH
T11011C161E0F5D8A3E43368CBE126EA9718E437EBD89CAE5417188219ABD5C31CD250F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3cd35c16b4a42f7de1aba88299fe3dd483f0af01f0948b8a0cb8cbe2f716eed8
MD5 e937dc02a6a76e7da2c64584625e6c33
SHA1 2a889ad70fa07e21876d5d994a20934a5738a059
SHA512 5fa9c32d213421967e526a818cbf7d6f63f5e43618d2ef7dea4a2132a4981ac75f998bf7b6bcfdcab30ea6212b8541e330703a65884a97d930714172a541677d
TLSH
T19721D861E0F5CCA3E43368CBE126EA9718E537DBE89CAE5417188519BBD5C31CD150F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1936-33-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download

memory/2936-80-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3664-6-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/4192-1922-0x0000000000C40000-0x0000000000C61000-memory.dmp

Download