124afdf1c99d2c31888f588ca4312dfc4e057b1a0b0bf42148f95a3d4a08653f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
Size 11.9MB
Sample260813-e8jntssajf
SHA256 124afdf1c99d2c31888f588ca4312dfc4e057b1a0b0bf42148f95a3d4a08653f
MD5 73bf514a2a8f684b46057858de5ba253
SHA1 dfc54ae70a47c8c3cac240d673f29583b1c58285
SHA512 013478ba81a2dc997f34b55dd1d5f67d5a123aa25ccd0e013eca1a844bb842631c65a3a2f804c75c25f504b2131f93dbd2aca1f1b10b295bf0c6afc9c5ae2dbc
SSDEEP 98304:5qKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5x:4qJqJqJqJqJqJqJqz
TLSH
T1F5C69E12F2D600B1E9B33530496BA37A597E76214735C9DF9384863E9E33EC0A93875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
4472	svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe
2948	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABBACCCBCBAAAAACCCCCABCCAAAAACBABAACBCBBAAAAAACCAABBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe"	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBAABABCACBCBCBCBAACACBCAABCCBBCBBCCAAAABCCABBBABAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe"	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2392	sc.exe
2828	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4104	cmd.exe
5008	cmd.exe
1408	cmd.exe
4004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3508	schtasks.exe
3724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
2948	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
2948	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
4472	svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe
4472	svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
Token: SeDebugPrivilege	2948	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
Token: SeDebugPrivilege	4472	svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4544	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4104	2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe	96
PID 4104 wrote to memory of 3508	4104	cmd.exe	98
PID 640 wrote to memory of 4560	640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe	99
PID 4560 wrote to memory of 2128	4560	notepad.exe	100
PID 2136 wrote to memory of 5008	2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe	104
PID 5008 wrote to memory of 2392	5008	cmd.exe	106
PID 2136 wrote to memory of 1408	2136	2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe	107
PID 1408 wrote to memory of 2828	1408	cmd.exe	109
PID 640 wrote to memory of 4004	640	svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe	113
PID 4004 wrote to memory of 3724	4004	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_73bf514a2a8f684b46057858de5ba253_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCAACACABACBBABCACAAAAAABCCAAABACCCCAAABBACBAACAAACBAACBBAACBBBCBABAAACAAACBABCBCBCACCBAAAABCBAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCAACACABACBBABCACAAAAAABCCAAABACCCCAAABBACBAACAAACBAACBBAACBBBCBABAAACAAACBABCBCBCACCBAAAABCBAABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe" start= auto displayName= "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe" start= auto displayName= "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACBCCBCCBBABCACBBCACCBACCBCBBAACBCCBCACABCBAABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABCCBCCCACBBBAABBCABABCCBAABAAABAACCACACCAAABAAAACAAABCCCBCAABACACBCCCABACCCAAABABCBBAACBABBACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABCCBCCCACBBBAABBCABABCCBAABAAABAACCACACCAAABAAAACAAABCCCBCAABACACBCCCABACCCAAABABCBBAACBABBACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAAABCAAABACCACCBACBAACCACAACCBCACBACCACBABCBBABACCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a47487194f20d76dd562fe6e90d4001054474b20f8fc93b2ccee468476d582e1
MD5 3c425bdea10f2f5443b6c3a71288b2c4
SHA1 ed15913b19d67dfb9a5639cec6c7ca80fd9f2188
SHA512 08f66c140a9290c0749d3706a6fa5309f01ae2907e210e9ee29ed81b4fd3ea3399a41b7c84c66368fd3bd5c95729d662dfaf3bcde83a6d048cf01c68a8386cae
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 12.4MB
SHA256 66351d48a4b8c2c7bb88907752585382bae959f5e5b8aae2a75fe1bddad5f300
MD5 da970afcd52b58a18fa6a77474a53b0a
SHA1 d4c40c15e983550f4b295a3dd6c3ad6ff9bfb0ac
SHA512 14ecf03b3cc5d456ae7a52db8bde89f41a9b37a866a5230871b74266f959b27786f8a4b17f76fed9c1391379c39cf90428cc651fd3b5fb790e07237731a755e8
SSDEEP 98304:5qKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5u:4qJqJqJqJqJqJqJqg
TLSH
T1F2D68E12F3D600B1E9B33530496BA27A597E7A214735C9DF9384863E5E33EC0A93875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\qap`g`v~dtlq
Size 10B
SHA256 d3b1ef7d9e45c9076894f6b6b678fd5de02bff3d78d7b49d2d0d74b6b49f5073
MD5 0ca273ed378c284666521a6b54eae180
SHA1 8e04bdf4c9dd42d1c899708ec1527f575886bccc
SHA512 1487b287fde4d6fd91060fc9f0adbdab5ae60327503bca76def3f88b7597f61b4cc54f784b01bb6fb52309658d63af5c541e2a78d1dd0b0471c8241f942826fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.19041.1023.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a5caac191fff92085311a7bc5d4bdbaa9a92bd3869a2e26c3d83c3c7c5c18daa
MD5 ac0827e42e52a703288a34fe8a909cda
SHA1 3c889856973352b6abb3071dffbe1ece96afc924
SHA512 91131173bbc54788faca10c59371e7efcddf8a802856137a2acbde829f629c5f3cbda640712d87e9848610443bf4c4c75a3a6c72e4a640cfaac996de51dc044d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f0558e97e708f0c8b1b92baa43d508dd404732a34bfb90ba23652d77218e09be
MD5 32ab8fb1a62e0eb2c60f2244b632f10c
SHA1 93766a2007480a2abdc6d34955fce4c2bb186860
SHA512 32d8b9d576494bada85165b1397490fe537423440ac9c7d6df7df05250e786eb6a306a897d6ab7ed52f38b46cdb38c6d384330c4b14bce059a49afc9f2e14d51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\hi\qap`g`v~dtlq
Size 10B
SHA256 c455e35b0ad2c79e5e91bbe8c8d8e7df660e12f7a11e4ea0975ff8337f196c19
MD5 30827ba8fe0f77228ee26e4d181d1ade
SHA1 ed469d2805a052fb5824cf2566b476fd763ec3a6
SHA512 cd104b323286165915887e1b3c02664299c66bad1d6f4980c852cb7290b1607ff8ec63fd26b88f4f6861f5e9819b14ae8a9d90f54ecf00efd0390631d06cb8e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\0\qap`g`v~dtlq
Size 10B
SHA256 46a6a3491a4e23bf2d6667330e81165dd5bc162178f0e5699ba369b101038b6a
MD5 82f833aafa8b59f5f1d60ae6acabd1c1
SHA1 0b8d414c8b88510e5f611150c16cb12659116c4e
SHA512 9bdc6a9ec07f48ac15876ec58a2ad6180c1745f5745f6db3404f145f71f2026583cb5b26542e578fdba1994075c068146bad7daf4c5792b7c6d975d623844c4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 5d993de8455ec591d2cc7c9150f243508af7d1251f19af8f5a1a94eeb976f1af
MD5 35cc7bd7bb5ef1a1fcedc3a544e61fdb
SHA1 01a5b5e769f454218eea3f71f8d192c639e8bc47
SHA512 5e908568f3251ec1b3d8989a8b079ce4321f2c03d2c482348b94e1cf5eb759813e2729d4e096bdc33e70c28fe3619c21fe2e97329f49428eca392335dc812f26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ac71acfe53c8b319954a10971376096bf55216b6c8d212ce982d082ace3fbad
MD5 5d15c4ba3df305cbcb0365bcb7b583e5
SHA1 41f1defca9bb39aa80e06bebbbb81c5e25020928
SHA512 712a7f7e2a6109fee32fc042bc3a25c50f9d6f19f7bcbc2d15c430efe2e3d006f09b1143247112498960dd6ed75d1f4de8b9b86350450b0030f2fac3abcdfd5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2beb5c4110c578878fe88a89056d52a792f2f0b30926e179504187d0decb2f0
MD5 d764502caefd082d701998ae03f5a190
SHA1 9ecc324477b75f80b511854385845896bf3daeb6
SHA512 d99f06e6a4ef13da4239a4cd138949e56854d50769462e2f070798d11581d61a2466e6264bdb8546b5be085a9068c2a38a378414b08afa9868c1ffb5a4de3c61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea4cceef5568191f438861b7760d30da38339cd1d6964fa6be8f5e763ef6c011
MD5 daf08d4e2ff43cdbf95472a7b36a9ab3
SHA1 13741e8874f8519868f724428496aef6302d7086
SHA512 e2ac1e19251c9ae29b52c499bb4cc67fb8705fe3c21fd363e6551b4f768e8a2b0f3c649a76732bb4d057e108bd4ef72bc7f23325a8f97c3a9fd71a229b9ad205
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4b6c2fbd43a3a4c0c2a55f60d9239a03de064a8a91b04f52df949f635328c32
MD5 58b356509c6b2cee68b9bab1c9daf3a6
SHA1 51be9f75bdd20fe8bb05145074ca28cdacf16e5d
SHA512 1622a11372992af4880b125646dfe6a2b7ee0bf5d246fce113ce81f3e3bbdc217b936de66930e2b73c969aab515a815cf11729552c58fd0cd94a2ac2a562c91b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7172cd972d4946e7d2bcdb76ecb30630b6da5ee2f00a640a8655a684cd1d485c
MD5 a8d72293001f18400cd8bdfe79465c4f
SHA1 ae1cfb9d3a8a02dfc305f2d00843ac1b6869b9c5
SHA512 f7660cc89822053f18adb77f81d8b59bf4937686f3fce148bd87eb9e4458b183bb3c1e789817848ce1a240a14e61243d803d951fe5358bc0d6e8c03801c0a0a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2479b32445fb75da7461628f5ea42505a1e2f5afe5deb792467f6a626fc30e93
MD5 b42e27dc84ad4e2ff44db31ff7198dd1
SHA1 661ca9456a89713738fc015b56de92455aa55f57
SHA512 5d32846c3c795a1d8e3b459ba1bcdd9a2d7ad4ac7843eff9526f790851ba64056e11ff51974ed02dbf328307317b0582d418a51f7fd463893fb3ececc084aba5
MD5 SHA1 SHA512

Submit Download

svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCCACBCBBBAABBABBACCACBAACCCCBAACCACBABACCCCABABABBA.exe
Size 11.9MB
SHA256 124afdf1c99d2c31888f588ca4312dfc4e057b1a0b0bf42148f95a3d4a08653f
MD5 73bf514a2a8f684b46057858de5ba253
SHA1 dfc54ae70a47c8c3cac240d673f29583b1c58285
SHA512 013478ba81a2dc997f34b55dd1d5f67d5a123aa25ccd0e013eca1a844bb842631c65a3a2f804c75c25f504b2131f93dbd2aca1f1b10b295bf0c6afc9c5ae2dbc
SSDEEP 98304:5qKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5aPqKRuy5x:4qJqJqJqJqJqJqJqz
TLSH
T1F5C69E12F2D600B1E9B33530496BA37A597E76214735C9DF9384863E9E33EC0A93875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 754236ada0dd767bec3590ed191ea1b32c90f7ffd04fe69f6f08995d0f4a4c91
MD5 35d5fca4b5b3cab470b23fd92ea56e07
SHA1 b2e46e1b736d3eb926a8a51cf28f22e3a4077577
SHA512 89f3f9f683ac20ae85a2ec735997a0c6e057ee7f8baf7d83d5b905cde65a4aed34771818b604c2842d951fea8f3ba00320bddd847f3cf353a94189a6304467f2
TLSH
T1A321DD50A8E5C8B3FF322CDBB52F9A431CF4375FB458BA14130A411AA679D718D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7dec1e4ee26d5077f665cd4bcf9306105f98b719417e58ec4d45dea7dc41c730
MD5 a22f1b018cc6757649f517e2c4e90c44
SHA1 d58f995077f6691227afdbbd9a58bfda9afced6a
SHA512 b5b008b944bf1a35223f2a64e4d815de12a9cafd6837c78bba2c7bf72b2131d9687be9760388e551df7c3c851cac8b9e5f4f9fc9e793619b3c5f473dbbe7f01b
TLSH
T1F921D860F8E5C8B3FB232CDFB52F9A421CB4375FA858B904530A820AA7B5D71CD554E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 e980eb55ff842a2afbcc0f71442bcd62066d13269a522720f22a2f7dd3899724
MD5 e0f2da26df873087fde0c7c5adca0934
SHA1 0e94800cb762b845f886c0c13bfc16f9f4531a99
SHA512 02824a901175314393f33334a150fbdf5d4ede08641aaaab60735bf7780d337e1638e07ead40531d8aa642d45ff95e0c7b97b4c7b75bb1de8d6c1027e22417b9
TLSH
T183110B50A8E5D8B3EE3228DBB62F9A431CE4335F7458BA18230A4109A369DB18D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/640-35-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/2136-6-0x0000000000040000-0x0000000000061000-memory.dmp

Download

memory/2948-114-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/2948-3030-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4472-71-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/4472-3028-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/4560-59-0x0000000005970000-0x0000000005971000-memory.dmp

Download