a10c571df331493d426e3330623df777e5a5851d411ffce157bbe8081416462e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
Size 11.8MB
Sample260813-e7mdbs1hqf
SHA256 a10c571df331493d426e3330623df777e5a5851d411ffce157bbe8081416462e
MD5 7674a8a8c10829fb129329503f5f39a7
SHA1 fccf527702347d9ef8bead63fa364bd81e9c0d9f
SHA512 a04584032b6ea3708661001898cc45f6fb710c027fed15e590139f8358459ada4fbe477bb3091ea4b2d6de4fa4f80fc4aebce3a6497493a311cc92250e0120b9
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+EovY5N+Ee+Eo+Ee+Ee+Ee+Ee+Eo+X:L5+5+5+5+5+5+5+5+57
TLSH
T1A9C63B19FA4350B1D92B50B04CCBD2FF9E607B2183124EFBFA4DDB1B6927AE16439215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
884	svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
3548	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABABABAACBACCCBCABAACBABACCABBAACCBCCAACABABBAACCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe"	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABCBBAABACABCBBAABABCCAABAABACBCBBAACBBBACCAACBAABAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe"	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1500	sc.exe
3768	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2876	cmd.exe
5720	cmd.exe
5896	cmd.exe
1284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4596	schtasks.exe
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
884	svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
884	svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
3548	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
3548	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
Token: SeDebugPrivilege	884	svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
Token: SeDebugPrivilege	3548	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2876	1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe	91
PID 2876 wrote to memory of 4596	2876	cmd.exe	93
PID 5416 wrote to memory of 3724	5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe	94
PID 1296 wrote to memory of 5720	1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe	97
PID 5720 wrote to memory of 1500	5720	cmd.exe	99
PID 1296 wrote to memory of 5896	1296	2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe	100
PID 5896 wrote to memory of 3768	5896	cmd.exe	102
PID 5416 wrote to memory of 1284	5416	svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe	105
PID 1284 wrote to memory of 4940	1284	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7674a8a8c10829fb129329503f5f39a7_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCCCCBABCAACCCBBCABBCBABBACCABBACBCCBBCCABCBABBCBBBACCACBCACCBCBBAABCAACCBBCACABBCBCAACAABBCCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBACBCCCCBABCAACCCBBCABBCBABBACCABBACBCCBBCCABCBABBCBBBACCACBCACCBCBBAABCAACCBBCACABBCBCAACAABBCCBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe" start= auto displayName= "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe" start= auto displayName= "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAABACBBAACBBCBBBAACCACACCBCCAAAABBCBABBBBCBBABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCCCCABCBAACAAABCBCBABBCBAAACCCBBBCABABBBABCCCCABCBBABABBACCCABACAAABCCBCBCACCAAABACBCCBCCACBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACACCCCCABCBAACAAABCBCBABBCBAAACCCBBBCABABBBABCCCCABCBBABABBACCCABACAAABCCBCBCACCAAABACBCCBCCACBBBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACCAACCABCABBCCACBCAACBCAAABCCCCCBCABCCCABBCACCAAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 516b87b1b71fdc24687751dcb8497935a48d250c00a4cf782f816c7eb8f5c19b
MD5 74fd5fdbd22150dc089908ee71945f80
SHA1 632096f5107c5db5c2ec7b695a4493889c5c66c0
SHA512 4ac3d0aa506e84de22d2a7a4f57501953b6d70151650932e47a4754d395a088eaecfc4add418f4c3966cc352346f3157da42d8c6bc7345ae18964517d9c6ef1b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\Keys\qap`g`v~dtlq
Size 10B
SHA256 5548f69eb11681bbda6df7643431f1ea2210730af58ff74c7ff226aaedc94030
MD5 76867c6ad21a86f9f30ec07b637f6228
SHA1 7117461ecbe073bb65778a1c505d54c99af82531
SHA512 4b02eaab83b8355852a509354ab1bbb5cb3037ef38af8ec388251582273467ef864b721061b5d1874026bb8d515968ff5feec1461306822ba7dc4dc38f42b019
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 b0d4dcd28b86de91f5e77cc21797810e5f05a1dd1528608dc1d8d5e5697c5e1d
MD5 3a3b17039cebd55e1178e2ae4d01077b
SHA1 5862f83dfe621667ffef4596361ea2cb0172a0aa
SHA512 02b5a0cf36ed9c4330de8ea203a5e863ac8350ccb62efb1a1b892b092a60b791acab6b141cb90b6fd5e533925ef7eb1798b40a4304df0ad70411074918572ff9
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 12.4MB
SHA256 5993f8f1225b25ea357d801788b47ea9b3f93c8bc69671ea0491d1f4341daff2
MD5 4e12fb0fd817288917cc838b014fcfc7
SHA1 5a6f1b66088af431ff2f38799145e9d7ecdf30d6
SHA512 ae2db179263d3c03462a033640d05bbcddb1b526a89f05ff9d54ff9bc1f7775a95437c0490b502defc8d9c267c74f6e8f82e120d8d5a91dfea48e6e7a426f258
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+EovY5N+Ee+Eo+Ee+Ee+Ee+Ee+Eo+F:L5+5+5+5+5+5+5+5+5egZ2Hb9t+2xE
TLSH
T1A0D64C19FA4340B1D92B50B04CCBD2FF9E207B2583118EFBFA4DDB1B6927AE16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 6463678a4dda319f1d36293e054233d44c3f7f69647af328b06f28783d44dd10
MD5 876d6fa890f4a1136bcb1b6588614293
SHA1 120359979cc90704442654388dd5256a160fd604
SHA512 0d6e36cca3381edd92fb1b35e83541bb379630a9a3bfb4844a2e740a0ce42f3dca78c5e1232799b4b379b42e269575691c58177ffd428657011c6d50c546147b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 e6e43ea96d27be60952f0656bab6de611961a9cf4f0bc81aadd1d9394f55a965
MD5 a4503338c58719dd7c988e832f8ca3fe
SHA1 7be665add668d16a1a471b83c488b8301443f6ad
SHA512 3e8062f6dd3f62016cc45cdd45bcf552680395998c364591b5da0a43aa9bf0f94d6fa47b88f25f3f6cb20e9f78c5bdb5357ab348ee777ca52e496b18f6aef5b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\qap`g`v~dtlq
Size 10B
SHA256 022575a655eead65028805ee6eb8dbcd01a4593780ac4df4a3af3c8101930dd4
MD5 4b6da0da288ca9e30acc835e99b2645c
SHA1 5d85a3388c4f85461e642bef1632e61634e7f7a2
SHA512 67a50edd989473ea0fef6718e3e57421eac77c4e1b14045de463978ff49e7380e839f7b0af3b601883e2613e3d87a1e865f7b8c298ec8f787daed6fda7d8517e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 4854712b39a960d116198c0ebccd770a79556dcda479a0ddddcdd9d4938767a5
MD5 b29f712df8223a843031ff61a77bec7c
SHA1 684bd3578db783395219ed1efab1ee0b3ba61c71
SHA512 a4f77132f8f734f9f337406477b0b34eefc948b30e2c16102fd86d7f43cb3a52e09aaedf9df25b467f702d0be5cea757efc7326052ebcd726dab702fbbbc4b56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 687646e9670a9921555adecc4798d3a74a7c521f7c0ab5163f8c4df4301a1f4d
MD5 f943627ef03f42ee709a47377776f57b
SHA1 3134a59b84a91437ca857acc75280950f297be19
SHA512 6c4d74fee102aaac6323d2b49b5d97bfe3c5e9c9103fa5e33e3bf660f60e28c702682cd1d1b00fce2b6d4b2b13c246318bfec0305431f575096aa722eb355de0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 6004c538844f00fb843661becdeaf21a3e957e40362c361ce61676fef075535a
MD5 a542f9a007867abf8253231730bacc06
SHA1 804e0862ccc11eb0eb4aec03741d997e4fd9b5c5
SHA512 3c380950ee8de1ac3d0a52cddaa9d06792e744dad04c8cf6c50f6086b59c6131a42af51cfe457f10f9db4a08ea7745e6120db565aa38bb53d7f60828163fe247
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3f78c18c3b5f2e184217394a0fe748134c53557a88cd60c4d5e1e1470a26f101
MD5 504992391a0990b0e9c549b964c4b59f
SHA1 9bba93854ae11209a4f5ab2805fda26db1e980d1
SHA512 ebae341d02e58dff0aad89551cc38b7863e57a09c65d7d7c3faa07f5a62214d63a3a24f79d5bd4cfef9e1ea79671c101938c20429cb00ecc2c401c434e2415a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3fb536da4b53c5bf3444d7876f3e22de7211baf933a10fc7177f8cb05a5573a4
MD5 05dba64f9eb3276914beca3914fe8836
SHA1 702296ad2dfe595cb2f8d721091acac797a14538
SHA512 36f56d38c832cd512ae7b24b489b2862fb269e30bb8233f286e9a83031e650b491cd57898b950ac51b56cfdfc8afb86c2f152895c455f54f5682bc4d287a1dcb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f15948a2d785021bf907e274e1b1735e1df61c8353bbbc9bb22791f1087eb79
MD5 859cb86a831770dd887f98cd464ac144
SHA1 a4339c6addcee156a0bfc356f8b81a1460fb79b5
SHA512 def91c348c1b2308668a954a7a12eaa16adf44786be2e2e0800a67aa28564ab9d5d071572fedc482ef3d5e0431391ed62ac226e70e5e0edd418d6dcbc299adf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be99c0d186ffdbfe56260cbd845b86dbf0f7fbecdff3b863add3322e0c1419f4
MD5 a161879ce5e557eb5bfaa266ea5194c8
SHA1 0a09c2a014b2784a2c473ba1623eaa3f30fff0b2
SHA512 2a43df16fcfff90064490e69e0b965906e6d94b17d2aa26a4234a985ed2f1ada1c876eed5d145eaee724ba01452a8bf10e92d35eb4f28edcaf3cc4a406f73263
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 91e338af4638cd6afe83cc815d4cba1edceacdd0ae9af44957c227fe4682b71b
MD5 4086148728c188e18626e44c21bb9e30
SHA1 6931554f809d4a59b612139a011cce4233fe6d00
SHA512 be4bd7464cb7a29d9a30371135033f333320a87d548dec3942ebe1ce10ebc23a710be9ad55f3b5cc82b65ecd4b497d3a9c385aec04478fdc8d97ce194ded3829
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 91b08e8a3d8a3135c2ea33aa11289e3631ca798bd17cccd94034309c154864bd
MD5 adb3e588f40f0ed01892739bc5df4e5a
SHA1 18ba5c08e38286f2623957484789655368fefcbe
SHA512 44fe9ce6ab660c385257f4a12b095eebdaf03066a5dfe7e19a1997e4095b69dfa27b156928cab6d8ef48bd00ebe781cfeff0fe019c9e342167c9ae30b39772aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4328b2ca9195566f7eb08979be986e9121ddc292f1fc755d07c80fa3c2ac74d0
MD5 980bc3197e1342d334b3c627ad1cb907
SHA1 aeb7e98209473431c036d632977cef30cf6e19ea
SHA512 112382b983ca20da8c6f31afefe055c14c1a4cdcb0bc5ca3e5b4baccab355916ccc778bbc4bf3fa39a96cdfe0819347ba9e6fb4adc2a6725ee196a2dd5073f40
MD5 SHA1 SHA512

Submit Download

svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBCAAABACCBBCCBCBCBCABAABCABAACBBCACCBBBACCCBACBCB.exe
Size 11.8MB
SHA256 a10c571df331493d426e3330623df777e5a5851d411ffce157bbe8081416462e
MD5 7674a8a8c10829fb129329503f5f39a7
SHA1 fccf527702347d9ef8bead63fa364bd81e9c0d9f
SHA512 a04584032b6ea3708661001898cc45f6fb710c027fed15e590139f8358459ada4fbe477bb3091ea4b2d6de4fa4f80fc4aebce3a6497493a311cc92250e0120b9
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+EovY5N+Ee+Eo+Ee+Ee+Ee+Ee+Eo+X:L5+5+5+5+5+5+5+5+57
TLSH
T1A9C63B19FA4350B1D92B50B04CCBD2FF9E607B2183124EFBFA4DDB1B6927AE16439215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1fba5946579370ad9935c76724a0a54b82b630395405e5e620016ee5bb5ed305
MD5 401f8c49439f819e8624b0ceda6977a6
SHA1 12554aaf54f96f480d8bf77c12a2664e909485e6
SHA512 e141fe18067d628be9e19175efdf79e3ce1e7c85759fcad04da0c350aa93102fe48dfa0b6b01df3f2b36449b1fa29dc402931cd21786279c7702aa209b1447fa
TLSH
T11A21D390B8E48873FA336CCE653FCA9208A437EFED58AA48130C42197795D73DD558E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4bedf204998c3bc9a899a2e4866eaae71c1ead15da27dc74b573654e44ac3e70
MD5 eb5687f8ef5ac9dafa3b3f4fd3e0da4f
SHA1 811fc32075bcec428959169d3d6824498f8aef8b
SHA512 8512d305c1d1108cc14b9e91e7f3b5b0a6fac35ad4d158477013071fd3b878512c1aff2302337a506571ceedde20c208ad196ac71498e535a1f2474ea5237489
TLSH
T1F111B280B8E59873FA333C8E213FCA9218A437EFAD58BA581308421EB795D739D554D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2a1cb32cafe9b320312aabd9508b2ee22cd8af5131a211436a686b93c2618193
MD5 975231e7967d3696d1c595d9196e9b7c
SHA1 f886ccfad4d799b8bd5a63bcd37337481b98501d
SHA512 a21bc99908cbfe15dec391da8bc8a51eb3300b7374ff5f0252750f35103ddaff48a6c72425a41c24eea7f03ec0b6d147221b438e1ff37fe23d8e2728af001a3b
TLSH
T15121D780B8E58873FE333CCE253FC99208A437EB9D58BA581308421E7795D739D514D2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 2daa8de12e7b7d426e49418518d6d5447de7980407366ad86ef08e7a19012b01
MD5 bedbdcbbb6736f178ee0aef29790e7ea
SHA1 7290176f489fa27f1437c28dd4bc16fa15815b95
SHA512 94225009cf8e59fd6ddfee5c33e37ebbf951d7a4dc97a8638975361c56cd931203e8bbce4b8232c861f0379b306e65f86304cfddbcd10f3c2a9e98ef80f4ef4d
MD5 SHA1 SHA512

Submit Download

memory/884-72-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/1296-6-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3548-83-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/3548-3821-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5416-33-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download