db32ae4538718b85c8c8cd1fb34c84bada370db198b5cd4d1a43096065dbdee3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
Size 7.9MB
Sample260905-vmhgmsfa33
SHA256 db32ae4538718b85c8c8cd1fb34c84bada370db198b5cd4d1a43096065dbdee3
MD5 1bed6643824588ca4e26b4a29a637c18
SHA1 0a73fb396b54183c32a012aee403a235b10e2d76
SHA512 dd93836140550fef79a1aecc5cbe8129992dfff4345e077089ab8e6a222e378e308b5e801d9dd90bd5021e75f5ea03434dc1ae21c20ed04212f1f7c73321837c
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHPs:7p7V
TLSH
T1B686390CE6DE0074D56AA0B08987C67ED5F17821472249EFE795CB3E1E33AE5B538B48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
1220	svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe
3196	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCACBBACABABABAAACBBAAABCCCBBBCCBCCBBACACAAABACBAACCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe"	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAABBCAAAAACCCBBABACCCCACABABAABBCCABCBACBAACBCCABBBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe"	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4472	sc.exe
4696	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4016	cmd.exe
1168	cmd.exe
4328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2324	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
3196	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
3196	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
1220	svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe
1220	svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
Token: SeDebugPrivilege	3196	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
Token: SeDebugPrivilege	1220	svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4016	4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe	95
PID 4016 wrote to memory of 2324	4016	cmd.exe	97
PID 2440 wrote to memory of 1588	2440	svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe	98
PID 1588 wrote to memory of 764	1588	notepad.exe	99
PID 4840 wrote to memory of 1168	4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe	104
PID 4840 wrote to memory of 4328	4840	2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe	107
PID 4328 wrote to memory of 4696	4328	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_1bed6643824588ca4e26b4a29a637c18_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACBBAACBBCCCCBBBCCBBBCBCACABCACCBCCABCBACBCAAACBAABAABCCBCAABCCBABBACCCAACBCBCBABBBBCACBCBBCBAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACBBAACBBCCCCBBBCCBBBCBCACABCACCBCCABCBACBCAAACBAABAABCCBCAABCCBABBACCCAACBCBCBABBBBCACBCBBCBAABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe" start= auto displayName= "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1168
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe" start= auto displayName= "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCBCBBBBCCBBCAABBBAACABCAABBACCAAACBCCCCCBACBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABBCBBCACBCAAAAABBCABCBCBBBABCACBCACBAABBCCCBCCBAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f0735cfd39db7af5bd29b266ba198c5936f0a3bca08860f51ae7df40829c4e45
MD5 a45914595772718403211e5855fd1ca5
SHA1 ae7686a98de394157b47823bb540972fa8f4cb4c
SHA512 e25816a4684ad23b10cf575e9dd65155d874e70ca96b594ddaec7e24042d27b9386e3b010160cd30c316c72cae25e8a444e4cd7515aa571baaf304265f6ddcd6
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 8.4MB
SHA256 db8dab3212e27c3909c7aacbe7f8d9a7b96ac9c4c07fdc0c060151d61b31c028
MD5 da32d74a961a0b3655f5f50222fd63cf
SHA1 975a5d7a7e92cb934f0b5747d1e3a82227574560
SHA512 69cf38f89baa972ce9c9e6e958d0ecdc0094a30e43d0ef5fc7b4582b076e263836231b8cc5957b4b255cb6f6fffed7ea5c5c01ef897925411941955ee7ea0e28
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+:7p7SpiD
TLSH
T12596290CE6DE0074E566A0B08987C67ED9F17821472249EFE785CB3E1E33AE5B538B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\qap`g`v~dtlq
Size 10B
SHA256 5b47fd4970452f0e12a532276d3c96ca66dcb256f533bf5f8a122aefe37d3d41
MD5 4adf6d9fcd30bb8aff49a127448272b9
SHA1 57d85f00469c9f559fbe525124f9aa8ef25f8f07
SHA512 03269ff0fe75d5b4c49efaff876aa9f8b15c1d9241ecfc6170b2dac08bf90ee87dd54a3691ea22de27d5714e6a15eeb5cef58546cd8adea7412db7e8d5de0a40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\pa\qap`g`v~dtlq
Size 10B
SHA256 d18678858b3821bac02ed5023df65eaf086ec8756d414ab40cad7a84f1041b38
MD5 e0c3c493625da99b8ff01540970b69f3
SHA1 b2feef1d62464aab62f77137729d60cf2d9b077d
SHA512 7f028b8f3749921212548264c402ab2e37b5ed878f924280ce0efb39aba5cb1fea920707605e66dbe2ccbbc5fe8cbb319c47372369b28c8e5e785bb60aa76a79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\PlayReady\qap`g`v~dtlq
Size 10B
SHA256 7f83a2945daf060ef7ae7ed78bafedcd7308947b8c49879482534d0bd218e4f8
MD5 97b4ca1ed2905fb4d368c013f964463b
SHA1 618a2a56556359c7f3e52ca5badfd7f57946987e
SHA512 911fe2798ac165f7a99eb4578e69ad88129b79576817d7411427746884d9a7f586d9ffe98aaf965f27493fcd3b8a664a14ad45afab51cab11deaeabb9328de75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 455f53f1212cdd4b669f56f782be1b852b99928c085c1429176f0d1eebff1904
MD5 1f8255fcb35cca48316488f62c03023f
SHA1 28b389c80f7a9e60edb56118b6614a3dd7e62c09
SHA512 643762190feb7813f71eb076f963bd4a23161c3af87713e072745411edc68881ccd09eaa0ad4fc7d6aceb477308bdf4c3bf1b389783aed282abdc2517634c479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c26adce35a7877ba70ca2376be8dfcb6015c5204f42bf38d8c6a2e8e3b79ccd
MD5 44e72186d042cb7e7d530076f01bb8ff
SHA1 2d9d8586086eb5e0f55f54c9420a122897a19535
SHA512 22905f3e487f315cd30eb436e095d78531a220b09d3eb1d1bbe8d30fb141f8ea638270ab2a30ebaf07b34ad335a1f924ddd44fce68f89423484f97a819cb9f31
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f076f6df8aebe82ae374e46184e86f19ebb9f65b5700bd1be1cd7db6b458fbb
MD5 7c79ae197386508f04920fae3c72cfd3
SHA1 2a5d951d691ad5bfbe406b80d174f8ab1d681254
SHA512 d79bf9db3e5fc8768859b4f12d3fca0bcf56783e6bdb309a27daf402e6182812b570aa45bbda99ff101d1e79a3acc9f168c3bfd231df45f2da4f48cfca7e945b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2c8f1f0ef05d231e93916313fa2d757dc94ab2495c3112f14afdcf4bdb4a1d87
MD5 0e1949f03ecc4497156475b259c0cd2d
SHA1 9ba05ecbae0dcf0f0697733e11bc58e20dcf76e5
SHA512 41a085ea0a7112438f92463ee0747607da6e632fc03a41b98bd71770553c3734b30296b99bdf750a15e47c614170a178d88457ed9b7a9acb93ee443de3fe5693
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4fa043698d21a105a6540a0bd02fb88eba306fb38ceb7b121ecea60b504847f7
MD5 866bf5ea2cedb131ca28ebe5e7971d41
SHA1 9398f66894be808da8cd57ef4a6b206a50447b65
SHA512 c575f5221f1eaeaa6a9d7cce52e7ecf714bb8d2c92ff42e13daaed6edcac20faabbb91b7b9518c2e73205b1f2ebb92d8b4a1a9c8dbdfb9f6c2e87436dc77b040
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 206ba93e15f186217c6bd69c3f6845f79aad98b61259674de957c0082964457a
MD5 dbe3edc494cfa0deb5d983a8e5a26647
SHA1 4734d96e68a47a0513d19c583ecf32c994c61a00
SHA512 c029630f769ce9cf55685306a5a6a6a21967c927ef0bfb47dc1dd321292b92290819dfb2cc10c01a9f0a54c15e82c840914417a50069ce383c53d0fa032c66a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7c84a80927dbfb287fa85e3506c31d45522a89477669546f43624fcacd4fb168
MD5 1c6ee7fe14dd9826ecc3c112ee89b3ab
SHA1 7817cc6ad0d5ab3d0f0772035575aca85da259d3
SHA512 b97eaa23185115711e90ba517435fbf2552f5246aef5575d3059f5412ea032a2c47810d9fece7dd08fc622ac1896354a9d74f682c2865ccd4febdb88a4805538
MD5 SHA1 SHA512

Submit Download

svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABAACBABAABCBCACACABBCBCABBBAAABBABBAABCABAACBCBBCABB.exe
Size 7.9MB
SHA256 db32ae4538718b85c8c8cd1fb34c84bada370db198b5cd4d1a43096065dbdee3
MD5 1bed6643824588ca4e26b4a29a637c18
SHA1 0a73fb396b54183c32a012aee403a235b10e2d76
SHA512 dd93836140550fef79a1aecc5cbe8129992dfff4345e077089ab8e6a222e378e308b5e801d9dd90bd5021e75f5ea03434dc1ae21c20ed04212f1f7c73321837c
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHPs:7p7V
TLSH
T1B686390CE6DE0074D56AA0B08987C67ED5F17821472249EFE795CB3E1E33AE5B538B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 67c9ea70f0aeb0dfb03a959aefa9eb9968c3175db147cb8ff7cbf5e69cdcfe83
MD5 28e487e3baf1c8803ea58c3e9fbfd8cf
SHA1 dd8aa39c2352937367e69c9d79079e9a06897b51
SHA512 1d4b6b3219968354fd411284d1fd198a83708a2a52a7623abde1dc92c3ed3c2809c6b102078278f99ff52673d22334f42a831eb32d886f4ce28922894d550fcd
TLSH
T16E21F652B1A5C883F43278CBAF11DAE78DA43BD6685CAB2063494318E6C5C35DE05CF6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 8227ec0067e84e8db8b01009cd007159fcbfc01d33619595c05fa8a7e7711a7c
MD5 867af9de9977dd339a2c500cdcf434a4
SHA1 f467188b2be86a1273d897899189f03339490aff
SHA512 e695cfdeb49abd79816b7a644c710a95e2f3da56b5ecfc933a86a82856f7c2f296838ab72c5dbb748e1595a49dd8c6c3784a8dd943f99d918e8abf5e376a60c6
TLSH
T15C110442B1A5D8C3F43278CBAE118BD78D943BC6685CAB1023494308E7D5C35DE058F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1220-77-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1588-58-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/2440-36-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/2440-26-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/3196-170-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4840-6-0x0000000000730000-0x0000000000751000-memory.dmp

Download