ae482157110f870b38092968d2cef9c262ad27d87cdb937d01deb7f6b4716017

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
Size 12.0MB
Sample260814-fdaccavxcv
SHA256 ae482157110f870b38092968d2cef9c262ad27d87cdb937d01deb7f6b4716017
MD5 39a5188eb2f74c895f7867c98b2055f3
SHA1 95503f8c8163a77c3191a50dbc6901dc3cb2bb8d
SHA512 2a0a636114f30829927da66979d7f66608b15a2b55cbc3e66aecab34e2a75fd146828eb6f95ea479cabbca2ee184d2edced52ca9a788b432896d9c99d3f050ea
SSDEEP 49152:U+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiJ:L
TLSH
T135C63A0977ED0854F4B7B23489B68669DAB3B8A15B31C7DF5280823D0E73BD4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
4248	svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe
3320	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBACACCBAACCAACBCBBCBCAACCCCCCCCACABCCABAAAAACCCABBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe"	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAAABACBBBABABABBAAAACCBABBBCBCCABBCACCCCABACACAABAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe"	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2784	sc.exe
1260	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe
816	cmd.exe
2288	cmd.exe
3372	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5868	schtasks.exe
5392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
3320	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
3320	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
4248	svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe
4248	svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
Token: SeDebugPrivilege	3320	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
Token: SeDebugPrivilege	4248	svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 4396	2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe	92
PID 4396 wrote to memory of 5868	4396	cmd.exe	94
PID 5560 wrote to memory of 5648	5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe	95
PID 2004 wrote to memory of 816	2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe	98
PID 816 wrote to memory of 2784	816	cmd.exe	100
PID 2004 wrote to memory of 2288	2004	2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe	101
PID 2288 wrote to memory of 1260	2288	cmd.exe	103
PID 5560 wrote to memory of 3372	5560	svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe	106
PID 3372 wrote to memory of 5392	3372	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_39a5188eb2f74c895f7867c98b2055f3_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBCBACBCAAAAACCCBAABBAAACABBBBBBBCCBABBCAACBACCAAAACCBBACBCBBCBABABABCBACACBBABBABBCABBBABACCBCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABBCBACBCAAAAACCCBAABBAAACABBBBBBBCCBABBCAACBACCAAAACCBBACBCBBCBABABABCBACACBBABBABBCABBBABACCBCBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe" start= auto displayName= "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe" start= auto displayName= "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCCACCBACCCBBBBBCCBBCABBACABBABCBBBCBBCABBCCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACACCAAABACCBCBABABCACBCAACCCABCCCCCCACBCBACBBCAACCCABCBBBAABCBCAABBAACAACACCAACACCCACAACBBBCCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACACCAAABACCBCBABABCACBCAACCCABCCCCCCACBCBACBBCAACCCABCBBBAABCBCAABBAACAACACCAACACCCACAACBBBCCABACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACBACAACBBCBABCBBABACCAAABCACCAABBBCAACCCBBCBBBCBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4d25b6d7f01256b33c85dc9c429f8266884b0e1a48b41168270905468d651e59
MD5 31c050d11d6f6037d7244193998920f8
SHA1 5520f77790bfe8c39c061dba78833e385be7ead2
SHA512 5e71b125c4b4e6361e48ef839f241c2c0e1418d764cb4a936d9d3b3d6260eea62b3e030b3964e3f00aaa8d2a9926f3d4ae36b873baeb70f0762937c72fff936e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 2f661b5958e9065ae1bd3aab846047460072ec861cf1b996e7b73ea2ef46f148
MD5 d6179aad2e1ede8bf5d2f31336d0d0a3
SHA1 ef5cab6c24189a2f203c14f460e92ec53d511df5
SHA512 6d75480ba17145468ca0139c9bdf5340314d216f4c78d0ea5a07a968b438f89e3072d4ecaf77322c5cf77f303d6217503909dd9a5f4a77d35a764e94043ff21d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 0f50fb88d3ed40082e9ab4de45b0fd82961a62e57939b7621298c892b2a941cd
MD5 c8105961ca3dfb2bdefd7c5d7c895092
SHA1 87c4cace904e3a85afea4f7cbef24aa2e13fd87a
SHA512 97a15cd37e52f860b42763a29e4e0f3e3ca93553ae0dea9756a65e2f34c95c319278f2456ed203fd907f4794146cf967f94bb6337cb73c6be337a2c2d8351261
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 f64ba027eed1b47c2ef3b41def96a400cfd454b5728394bce797dcd1a4c09527
MD5 57b206fb60793a2bd246725ce538a265
SHA1 a200a6680b6d20a9d26bdb8fd0f198cfeb4e8827
SHA512 5c665064adef0aa4d78db59fa80b5fa46ea068074f7bdce317d3c17f4146faa055112c62a94a162946d0a22e4a01bb320aa6bb11ba2bda42e44e48321f6bd153
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 bf778e161b15852169680b6db59e5f8bfad492aa8d6c25aa79dea7d4cda4f155
MD5 9a78a277b84213521f9c096416e103ed
SHA1 f87a01916d168856eb1e52cde05883eed4ed1425
SHA512 ee848ba378a767045fd6643608771293766e10ac1428589d5c97c34e43224686c3e8d482f2a85366285cd8a815f0b87ab457ea4cd438eca8d85160ec318a4e14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\qap`g`v~dtlq
Size 10B
SHA256 e4906553445f7318f8f22d2479fae1ff62ab27efff8267a4e28e85d88f117d6c
MD5 49f667bee220cdd00fd5ce0902dcad0b
SHA1 cd5f75dcbca7a27d70af79f08a2fcb1b013c1b1c
SHA512 f5a9b7ca9f5b6dbd2508f0d01b530698d81dbc1848ffa83be5e6e1ca5fbf08d56bf6c2ea96559d2c9bb7c131fa69b540bf04679925255f47234a29dce14adbac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\qap`g`v~dtlq
Size 10B
SHA256 dd5232d79fa87793ab246a25cb131f96f025c8a195b488eb7a4a8da569fb00af
MD5 16393add18a162cb4e9f6a1598760345
SHA1 8fa18ca4c822999539e43a85293a8bc7a9660073
SHA512 774fbb742058204368e7dfddb4ad8b84cae30c79f6aab9ada42adf4e89688fcc2b3e75d435b8c1b2ba53fd2daf5675f17bf3ce420d80ec6f63ef7af77fc6b74c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\qap`g`v~dtlq
Size 10B
SHA256 7a847ffc7af2fa1c00c4977087ee05b2f3443b121601eb1df8c7a70d4059b750
MD5 055b5b7f08660ad38868dd1bda57d0b3
SHA1 3e1ec8720890c5e90e1e42e66be18449c06e4d5b
SHA512 9ff5634ed915387f13f96821cf6d63444b12d6811ba524a4351fe8351db05f2a965057969cc88f5769899ca5549a462b22fe9b7be1ceb329ff4ac51eaf08e9af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5402e03809b9faa4435e2c0c4702572d0d71e389bcf6ebe5c1f8f39111de2775
MD5 9456290b19cf366191fab7a4a88aec2d
SHA1 76b2c63e3b7322c702f8ab397fa37dcad7d49c17
SHA512 3e8ccb5b0abcf8d6a2f9c069e74a6908ca85da59e2245426b0b822e26e6852a0e5577e581f27aba43f06576da55d721ee5ae74096b6b240bdf86751522c8511e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9cfeb97f53219e169d6b9c40a89cc3c53805ef86853998550ea849622bca3516
MD5 80a3a257103b08d0e2c25c7f7f6b90b4
SHA1 001ff17c7ec55124f42f14f9614e10f35ef1fe75
SHA512 f5874ebbd96b73e8f23160dd250a3b7fe05b33d90cdfe84bc5d37ea6bf04bfe169edd2cd7ea98c35e36779c383154ba6d9b53136e47148c4bae80c71e6b244e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 368cc22ef07bf14fd05d58b7ba013ce1521e11c02a318dc5f91274a66e8c196f
MD5 2a473aa039bb20e9c799de04cbde141b
SHA1 3d802f7b335faf7a9b8d9e75c1a16a72a2f31bb8
SHA512 1f3cffb8ba9764cfde1367ff6ba78e47b45f49fba966dd42a62c5896d5ec8648ff49b384402e7d6ae976dbc0e2d87dad583a07fbc5ef9e576d8aba4db5c10488
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21ebd226ced0aefe4353f15bada1c6e4968a1e2116efc8b703a6ab4d61b5eff5
MD5 5916561601595485218939c88f62c0bf
SHA1 53b4ff28233bd44e91a52d86ece28c7e703e33bb
SHA512 341468a09b3ac75d9f680f54d148614ed95884f3ea3a499bb4ec2354b6b99af32db95e88bb3142596e05cb32b946e3507548b691db2cc590a4e225f0727ea281
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69376c60e57958da367029bfe743f60b2e540ddfb476acd232eb41b5f4229009
MD5 429f0380af19d85f5588b73e82656972
SHA1 6a706cf0d581ede6e3bbe8a3ca9a4f59adf7ee32
SHA512 83059ebfbcefe2af94dd40b6df43528fbc7a2ddf2da8b0a945f4604e4c455656e649384271eac0a0c42feb171a38b927d6e1deaed0ee10724bc1850350a56894
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8da5b82a6ec2d70509563e55d769b9a3b5a31c0c993309c83af318953b27705c
MD5 29b1ce31a684526c9ff26124d60917e5
SHA1 55b8f766e5c65574d6e4f7b17247b0c9c5f7572a
SHA512 027cf5023f1688471f25646e3837dca21ef5e6ffd236a9fac1c6be805e81542a4bd8488e0f28c49a4483b658e6fff38345c907c0b6f196d8f8f502e28fd3958f
MD5 SHA1 SHA512

Submit Download

SaveLock.exe

Path C:\Users\Admin\Downloads\SaveLock.exe
Size 36.2MB
SHA256 089813e031503980498968b41727c4a103dfd1e8d4126d2c4047ce07c7a6e4e5
MD5 f98f51ebc92d0115f28540a46185006f
SHA1 357e4389edfcd0e2376ad3076c3f8973643f90db
SHA512 28727ba91a5964217fe4c9e81d189d47bf02259c6ab1280526c4adeed180973d4f4fa99dd08d10fc099bcf69a50d0e4341d352cf31745ea2262c0fe11049ffde
SSDEEP 49152:U+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiz:+20i
TLSH
T1BE873A0977ED0854F4B7B23489B68669DAB3B8A15B31C7DF5280823D0E73BD4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveLock.exe

Path C:\Users\Admin\Downloads\SaveLock.exe
Size 4.8MB
SHA256 be3b04c9590d3e6c99c8203c337e4552235c044f26a2946e01745e4118d08471
MD5 064b71783435d477d2ed709b84685b1e
SHA1 653b97df4b679d179d9be3973792ce5cf0537a9d
SHA512 c75d12c8bdc8f0e6598ca43681958aa0202a23d0788ed6b5cf64892ef600c1fbdd25121bf9fe4b3395c071973f0d621e8775123d1073de46022e80d45b275b5c
SSDEEP 49152:U+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPi1:f
TLSH
T1EA363A0977ED0854F4B7B23489B68669DAB2BC915B31C7DF9280823D0E73BD4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 01c129e7cd95de3d474b57cf9f58e95fb35a7ebb0b084d4b5e8127c56e781560
MD5 3ffada4a4e5ee28829674f3b2d8c9814
SHA1 b572b22a5ec89c2c9a7d8892f309374a4cc13699
SHA512 cd5d049b1e7d7668347ed667e09e7581dd6149bf082e23f5ebd49c8d09b927db83554377ece6a0ea49b5f61f31a3cef123a4aefd985d2209321ab2573382204f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\qap`g`v~dtlq
Size 10B
SHA256 a25d392f7c67a2fabb70cecc9f2cb59a947ac5fb785ee059ec26d54b7c2d5e8b
MD5 7a5add95e5e9629c1891edc3e95ab29d
SHA1 a0ff9728cc26432fce416febb3d5a64e27184533
SHA512 3d5dba5ba4455311b4b6fc5c93074ab1583656975662aaff03c449504dca7d39b2d5ec34a78ed383366796b99173dc7adb177a7f3e9057403b5ab2ab2d8bc96e
MD5 SHA1 SHA512

Submit Download

svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBABBBBABCABABBCABBACBCCBBCCCBBABCCCBBACBBBABCAAACAA.exe
Size 12.0MB
SHA256 ae482157110f870b38092968d2cef9c262ad27d87cdb937d01deb7f6b4716017
MD5 39a5188eb2f74c895f7867c98b2055f3
SHA1 95503f8c8163a77c3191a50dbc6901dc3cb2bb8d
SHA512 2a0a636114f30829927da66979d7f66608b15a2b55cbc3e66aecab34e2a75fd146828eb6f95ea479cabbca2ee184d2edced52ca9a788b432896d9c99d3f050ea
SSDEEP 49152:U+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiw2hT+EPiw2j+EPiw2j+EPiJ:L
TLSH
T135C63A0977ED0854F4B7B23489B68669DAB3B8A15B31C7DF5280823D0E73BD4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0cdce4578c9ee3597f25e1eab95ce3b02b475716f3670776db4952e5740a151f
MD5 4681d1f5bb3a1b848eceec6d1d143178
SHA1 d809d3a11da04a8e4efdbb5cb1cc2b4154acbc8e
SHA512 1d518a970ccb0bacdb81eab77460abcba648ab6cfcbf7221686389fb2d732ec2a75a8e7c5627c6624ba897f0d8198d6f92bede9c06fd894301c29bb85dbe4445
TLSH
T1F2110B10E8E4D833F932E8CA5339DBC208B873AF9C98594423094228ABD9D328D59CD5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 821fd9088cb4fbb73e36c7e85fc8bb9a8dbdee30c97b0d3bc66cf2986a277d88
MD5 7a1bd8c16e02587c6c8690df6410ad68
SHA1 d8288bca665ec4351e2f10dea22c2de10ae0cfc9
SHA512 534f539a06fcd73394c293170ec2ec9eba0e8c95e2d8e1ee4fd7663c17a42b5852b13bf403087fe014a7998a6ef6c13e51c0eadba69d2865e9db301865362b3e
TLSH
T18E210110E9E48C33F932E8CB5339DBD20CB8736F9C98598423094128AFD9D328E59CD5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0c1d797c8938c1def93432ae931c4f366bec9f1f08f15c6b4b9a86c6df574ab3
MD5 a66cc5b7d9adb6024d4f26ba7b6aa3a9
SHA1 170b5d2bc4128930a88c0924322cf865cbdf15a0
SHA512 b909902a931ee7032c43e73531ca2e31408dd6269dc9800720d7ab9b44c942b7192e80c15193e83f81c473e66ebf62870d4eb7d6f3cc3dfe600c4eaff0e3bba4
TLSH
T159112B04D9E5D833F932E8D75339CBC20CB863AB5C586A4432064128AFD9D338E59CD6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-91-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/2004-1945-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/2004-10-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/2004-68-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/2004-46-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/2004-21-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3320-1946-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3320-3979-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/4248-84-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4248-3978-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/5560-92-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/5560-69-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/5560-47-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download