a16f8c2768c17ca52540ecd6ab8c28f4af8c2dfd45d2ff26db328cd98016374c

Analysis

max time kernel
151s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
Size 17.8MB
Sample260810-csf7nahm5v
SHA256 a16f8c2768c17ca52540ecd6ab8c28f4af8c2dfd45d2ff26db328cd98016374c
MD5 843c5751a96c09da04b658a90ef7b5e2
SHA1 ad36188b1ac8beb0b1810e2cc34066cf84f86949
SHA512 4dbf382549596a65b1cf64a06a4ddc1d0808ceff918fa82d04ee72a027699414566b1e985447db66d8cb5f019d9b240be8b3b305174b78d010fa0e24722e26b7
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMdu+ElwMV+ElwMV+ElwMV+ElwMV+ElwMduG:t
TLSH
T1C2176D29FA980CE1E873517C8586C619EB7274251B21CBCBB67CC32E2F276D5AC39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1356	svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe
1584	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCAACAACBACACBBCCAACBACAAABABCBABBCBAABCAAACCCCBCBCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe"	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBCCCBCACABBBAACABCACABACCABBABABBAAAABBCACBCCCBBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe"	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2168	sc.exe
3216	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3872	cmd.exe
6112	cmd.exe
1400	cmd.exe
5324	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5424	schtasks.exe
3308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1584	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1584	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1356	svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe
1356	svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
Token: SeDebugPrivilege	1584	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
Token: SeDebugPrivilege	1356	svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 5324	1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe	93
PID 5324 wrote to memory of 5424	5324	cmd.exe	95
PID 1392 wrote to memory of 3848	1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe	96
PID 1176 wrote to memory of 3872	1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe	99
PID 3872 wrote to memory of 2168	3872	cmd.exe	101
PID 1176 wrote to memory of 6112	1176	2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe	102
PID 6112 wrote to memory of 3216	6112	cmd.exe	104
PID 1392 wrote to memory of 1400	1392	svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe	107
PID 1400 wrote to memory of 3308	1400	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_843c5751a96c09da04b658a90ef7b5e2_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBAACCBCBABAABAABBAAAAAAAABCACBBAABBAABAAABCBCCBACCBACCABCBAACABAAABBBBAAAABCBCCACBBBAABCABBCACABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBBAACCBCBABAABAABBAAAAAAAABCACBBAABBAABAAABCBCCBACCBACCABCBAACABAAABBBBAAAABCBCCACBBBAABCABBCACABABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe" start= auto displayName= "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe" start= auto displayName= "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCCBCAAAAACCCABBBCAAABAAACCCCBABBBAACBBCBABCCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABBCBBABACBBAACBBAACACBAAABCCBCBABAAAACABABCBCCBCABABBABAAAAABABACACCACCCCABCACAACBACBAACCBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCCCBABBCBBABACBBAACBBAACACBAAABCCBCBABAAAACABABCBCCBCABABBABAAAAABABACACCACCCCABCACAACBACBAACCBBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACAAACCBABBCBBBBCCCBCBBACBACABCACCCCCCBBCCCBABABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9ed173995214586df3bbd3b29d161516f8352884999fc042920747d479f78f33
MD5 c9a8e2496e85027494cbfd182cfdd9f6
SHA1 335d861f7f0a570bf730157f5a0f1a125cfcddfd
SHA512 3ffdd34d7cc82427227470dcfb2b0cf654ee5add7106afdaa3fbb45e76861ada15d77ab0b2e1bc2d76f370701afaa2dbd9f5ddfee3e69155244434d942836f60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 83ef94a63341976aaf202b248e5d650aceb0689f3a2e1fce4555b7eecfeecc84
MD5 a0e276f4af3a39143873dc5f83a79b2b
SHA1 e35d6b3d671d4f76f2ffcef9e708b37d1d201d6b
SHA512 196016636a4bb2e2bff414e85659aff1de6eea0bfa1940431ade997d465b502872a3b4bbbc7a4247bede1d106fbcfc394524b115aa939ac8ca2d001447bc6eb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 060a483850387ce46dbba8212416c59439c2e818ab8bedc76a085f74803dcd0a
MD5 b83aed433ac5e10a76642ee63c2692c3
SHA1 2a6e2c5091e6b1cb5e9967735fb88b8d9d28c703
SHA512 19178bab5d5b3513aa5b0b46954bdf239e5131043bc95a6bf7c1715c9c12c5a6bf44021053a652a49600c6c7a68ab9804e6c197bf3aadcd869002cda1132bf58
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 18.4MB
SHA256 4e76ed17337fad59bce14df95beea7b2cf5ebc5ff63b5aa75adfe2dbd3803a37
MD5 fcce4fde8550d7a1ec35ccb440d68edc
SHA1 6a05f173f8cf5331960f4752ecd3872151cece69
SHA512 1f619b848390ac9e13998c91dceb0a554b884a29d48bc7ab4dcee77373710fba8bcb60f90c793781278d08de9af11f738e5be5d931823aec3e3f8e762738cf64
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMdu+ElwMV+ElwMV+ElwMV+ElwMV+ElwMduv:cgZ2Hb9t+2xp
TLSH
T19B177E29FA980CE1E873517C8586C619EB7274251B21CBCBB27CC32E2F276D5AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 a48033f0c4ce2fc7604e02b4191077c85f5b557b5c155eec495127e64d365de3
MD5 6188e8f975329823a402985efb16ab5e
SHA1 255782c2151e5d844ea9803d80da24ba76289b2a
SHA512 66f46d072f5fa0b72b4317e75732b15096f9ccda053b6218c7b5cba9bc2457292ced64468dfaa5fc50771f634b9b8f3c20885a26facee360b045ea6cf63bed4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 8350913e62e62eaa109a26d30ef2ec459b884ac18fb4ebe0b41c7a99bcb2e06d
MD5 1d962e884ebaaaf82a19bf3f57a252ca
SHA1 537363e4f38ce26761baa2249eff1e55a8fd6f6d
SHA512 2935428ec1b63bb586653c0dbc72d7d3775f635332babf5da887804f2e0e16c9ed7e5652e82dedfb0f3c443e290c8c1f5906d04da99bc76a3aef80d60ee5b59d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 08ae6460a7bcfe85050c6ad8364d52c6659679f0fe0397c80f2e9e27cc8cd554
MD5 449f3d0f00b9cc5f63b453a2e122bb26
SHA1 92b04be28385392efe0f3a31e04652fcbd9d8c1f
SHA512 cf3d5598b7e2d05fc7138195ab86877b221c276909d10432a1dbd28431c0c6ae1913b5d525e2e6f00030240f70652c549065d73e64a08b436ce213810c9119db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\am\qap`g`v~dtlq
Size 10B
SHA256 1161d37b0c99afe1a6f412aa75b2ac5ec5db97b9b03b726445334be394999d18
MD5 072bb4d395ecff9902a12c9afefd764d
SHA1 20236be2cdd8db28100b696eb8df0e2c1487da16
SHA512 49ce5e5655cb798dc5298ffd5b876686ecf79f98a2c54d2a71ad9bed294d7556a619116790a05e3222774dabf25ffe57c6b3d6ef3cd136418451798b1909be30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\AC\INetCache\qap`g`v~dtlq
Size 10B
SHA256 c4ed1135fa8c47e19a5d4efa6e93dbc663be2898c6e508bc900dfe046c5d0b9a
MD5 2749a06f4a079c1ef8e87cc7bb06364a
SHA1 c8f607fa686add4fe1b89bc0323b9eeee1c3232a
SHA512 e7ce5b2159abc5365c9b4aa055f0d02e65ff937738f22f42b1acc67a93463b6c71d843ef5446889c196f1faeaa8fabb2df44b489dd587f187e8a94ef9af8fdc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9335eedf1b3333b4bc6f7cc0b59c67bf463455d0c2b7b6f8c2643ce4da456511
MD5 7c65b14a8c8c10f0bd82c55d33ac368f
SHA1 528bbdd3c7d38b9e1fd23c7c1672834a1b78b1f1
SHA512 67e6e78f66c0b0e46df32a3ba17785e07c12b4eea0d61af599bd5aa0cbfda704a3bc18e1cf79c850bcc6a3fe228ac7a679d14c4f7c45b9b9d5367c469ecaaeca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1e34985ace8ea51ee908272cd1e34c94367ebbd912f4721406752ac7f170bb8f
MD5 e0520f179757a9769e9db152a970cf7f
SHA1 c736c96a355a922f7b535be118f3b1461779ed52
SHA512 2046aa94666f78e41d1dcfd54aa8f5185a42ef26375ca156e0ef4f90cf7faa7f647260a11b47fa77972b2eab0643247dedcd3b557367c1ce7ffb6980bac2ffa7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 acfdccf4a253b51c95875913a0602e5241f0bddd1abc4a215a59935ca610855e
MD5 2497504fc9712fed8439275e8d23065b
SHA1 752cb97fdc82cddbab7d2401fe9e0eeaebfcac89
SHA512 706b3f9285ead55874e34723358d8eb1240cadb1998b592b858f0978cc7461f26a7fc14933581399c672a47fa14922c02a3cedcf3718e780f083dee9013348fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 777aa97a43a62d83705d105fbeb82854f5ccdc4f6a949f6c0ce63ebb076a05b0
MD5 0dddded336facaa54f9de4e894119b32
SHA1 ad1b99fa9e40646d1bb9ae92c63b87ee8e0846b2
SHA512 de0723328a73ced37c38b37b742fc018d027d4938f764a2123fc4b81e49274572484edca08421c228841bc3c740eb4bf66fe455622a132c9092fcdc76aeffe6b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4326f814031e9bdbcaf92c918a86eb81ed1d75d2c4cc7657b8ee4a4d73592afd
MD5 9f8083da85155d47df97684df6271f95
SHA1 cc3c11344367a0894289299bff9c46b535801a8b
SHA512 bb805641ddfb473558d332f0b55db0791498e58c55506f9b39102cd1ce985dad87412135775fe03d69bc037f12b08aecad39156850fe38e8765e5ac9ef168c08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f0eb1f0d35c6fc54d77a0dc235190e84a8c637aeb48da1b2b9bddd2c729a23e
MD5 a0ab245e394f371f97b60c85c2e663d6
SHA1 922b5f4dc71b1af7ec443cc5921bf6b1f4850ccc
SHA512 93a72926c4db1a399259cb4e2fdfba154130c3f77f195867fa6cab2bae8f40ee02a0b59059f70ca32cde47c945be96429afc54f64d8a46c8621999d930dc949f
MD5 SHA1 SHA512

Submit Download

svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCBAAAACAABAAACBCCCBCCBACABCAAABBACABCBBBBBBAAAAAABBB.exe
Size 17.8MB
SHA256 a16f8c2768c17ca52540ecd6ab8c28f4af8c2dfd45d2ff26db328cd98016374c
MD5 843c5751a96c09da04b658a90ef7b5e2
SHA1 ad36188b1ac8beb0b1810e2cc34066cf84f86949
SHA512 4dbf382549596a65b1cf64a06a4ddc1d0808ceff918fa82d04ee72a027699414566b1e985447db66d8cb5f019d9b240be8b3b305174b78d010fa0e24722e26b7
SSDEEP 49152:U+ElwMV+ElwMV+ElwMV+ElwMV+ElwMdu+ElwMV+ElwMV+ElwMV+ElwMV+ElwMduG:t
TLSH
T1C2176D29FA980CE1E873517C8586C619EB7274251B21CBCBB67CC32E2F276D5AC39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 fe53f59f80fe554775f1e1a781d0789a3cea7c1cb40e299c00dfcaabcd51909a
MD5 10b5550ebad939ea2ff16f0205c673f5
SHA1 7f6e0ae9f3b563a405bc9f23bd370b87deeb5847
SHA512 4b84e18129cb72854769f3404f9194cc9648d22b21cf6ea6f63925080802533b79b1eb1e6a81eafcd0352b5218866d3de7e097a04c920131ec88830f9568537b
TLSH
T18B219666D4F9E817A973A8CFC229DBB24CE8378BAC186E94120551186AC9C25CE594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ba4c2c0dc0dd1cece3ee3a2d2b9bb532e36b46c56ef6b00bcec472c3482ccd84
MD5 7f35edb9a75b78f840bd7ed3c557433e
SHA1 defd40c4318e0d4d35197cc607e9c2ccc6e17951
SHA512 f565cf7e3b82e6531fbe8d87d398b042fa765b01d5ad708c0c80ed59a6e12bb67519af89c6f9942fe585e6de826c88a5afcbf0415019f843c165464fbe2fccf7
TLSH
T13E21B776E4F9EC13A933A8CFC229DBB24CE8379BEC185E90120942186BC9C31CD594F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2416577ae3635fdc0bb9b7331ae9a96f52b5b35b1b13f58f8fc3da347f451ace
MD5 a29190b668e67f8bf892a438fbbeb423
SHA1 feaf884e7e2fc89e5d7a30c65ead45c061727cb7
SHA512 36e956c990b3a6582cd61d7cb3dff86161645650a7ae445ab696472505083b7af579f5a297c7995bd0d95571b17db9f2ef142099fe0931e1bf728095b61d8fe5
TLSH
T11811A766E4F9E817E97368CFC229EFB24CE8378BAC186E94130541186AC5C25DD594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1176-6-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/1356-63-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/1356-2010-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/1392-33-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/1584-75-0x0000000000620000-0x0000000000641000-memory.dmp

Download