cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Size 18.4MB
Sample260815-1fgjnavvbz
SHA256 cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664
MD5 6597da976c106b7b44ed0638bc489005
SHA1 765217794745ae602ea543b165c7473f7da8b058
SHA512 58204d8a2e358182f4d763a19d53a1386812ae0259c19efdcaf3f3e673fa2b8e96c267ff347ab372a65ec10e839715e485f1c78ec77e6995866c0cdcfa314e17
SSDEEP 49152:U+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+EG:JK7K7K7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1AA171909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
4572	svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
6076	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCCCCCBABABBBBCCBAABAABAACCABCAABACAAAAABAACAABABBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe"	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCACBCABCBCBCCACCCABCCCAACBACBAABBBBACABCCACABCCABABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe"	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4232	sc.exe
1208	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe
5856	cmd.exe
5620	cmd.exe
572	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4752	schtasks.exe
4916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
4572	svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
4572	svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
6076	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
6076	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
Token: SeDebugPrivilege	4572	svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
Token: SeDebugPrivilege	6076	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4144	1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	92
PID 4144 wrote to memory of 4752	4144	cmd.exe	94
PID 1360 wrote to memory of 2752	1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe	95
PID 1932 wrote to memory of 5856	1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	98
PID 5856 wrote to memory of 4232	5856	cmd.exe	100
PID 1932 wrote to memory of 5620	1932	2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe	101
PID 5620 wrote to memory of 1208	5620	cmd.exe	103
PID 1360 wrote to memory of 572	1360	svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe	106
PID 572 wrote to memory of 4916	572	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_6597da976c106b7b44ed0638bc489005_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBBBACBCAABCACBAAACCBBABBBABCCCBCABABABCCBAABAAAABBABCCBBCBCBAAABACBBAABCACCBCACACCAACCCBBBACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBBBACBCAABCACBAAACCBBABBBABCCCBCABABABCCBAABAAAABBABCCBBCBCBAAABACBBAABCACCBCACACCAACCCBBBACBBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe" start= auto displayName= "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe" start= auto displayName= "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACCBACBCABBCACCCCBABCAABCABABABBBBCBCCBACBAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1208

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBAABBCBCCCABBBBACCCBAAAACBBBCBBCAABACABCACCACBACCCACBACACACACBAAABBCCCAABBCACBBBBCCCCCBCCCCABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBAABBCBCCCABBBBACCCBAAAACBBBCBBCAABACABCACCACBACCCACBACACACACBAAABBCCCAABBCACBBBBCCCCCBCCCCABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABBCBAAACAABBCAABCBBABCCCACABABBBCACCBCBBCBACABBCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3678691c4ace78cf60bc4d084efac06c1b2963a9fa0258463ca1a4f38bf7dcac
MD5 987d13dabf1eef17418dfcf98415906d
SHA1 deb8df1fc6f1b7948a7d169323b4a280d58d661d
SHA512 706dd9210dd730189e27b5eea34eba13176a4078483f12609c723c7c0714580d657f07ca650dd409c2cdd079697bc4199470d821519bf4089e442a2ca8e6dc2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 f864da6fa3e574ed0ebaaa129fb5b408474cf6dcad13d6221fe1c9455de09595
MD5 33dd073d08706a62040347af078a8a48
SHA1 a582aede849f3616616e229beca0a651e9947e8a
SHA512 02094058652dc5f66a43b3bd5d465bc212ea04b63d1a56a4ce443f4964f06a33a38c6f7f028889d46cf7642d422758902924f8aed6f714404ed61e3e779bd59d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\qap`g`v~dtlq
Size 10B
SHA256 0a68c9a015c50ad13ca5cdce04645e3828e7c49dea6237483c58cba9eb887163
MD5 999b0d073d3a5e92dbcbac34e567125b
SHA1 63d1b9ea9e9297679946831832890c18a91774b1
SHA512 e29a0d3a152547c56dc6c383256cd89e1a3dd906c10c52afd78264ae90af7a978bfc698059d05ad19305456b7df7e53d6572b869fa474ac9ae71bf3361b3e37d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 90e1b3a67ea60b2a70fbbfa0a78f9b13a35c94e10a422dfe3ae909f33b6f5438
MD5 52e796a47cb07a85483f6fa9577eb580
SHA1 008297abfa55c9b07bc24679741900bf219f4822
SHA512 0f70a9333bee850b6e932bf183fa5f258b0ba797684071a24d482852bf276acb9b6b4c4ea70a0b21b73db6005bfece7862d3f95518703e28ed7f08c0f30ca14d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.0MB
SHA256 502a0f793811acd5d91bb4332f6a5b1743e91f137d96a8238ebad3a9ae77961f
MD5 669591adac9aaccc26659fd9d5b0621a
SHA1 e53d21b4b16a57d237182b7de45df776925ebd9e
SHA512 db436e77dcea30e598308b1a74c059638b5c92fa93f7d2ff9c5de3d16e108f37ff24ba9e7296a778d56ae68bbeca46e8500f44dcdeaf498c10e654897db102bc
SSDEEP 98304:JK7K7K7K7K7K777K7K7K7K7K7K7K7K7sgZ2Hb9t+2x9:EgZ2j9
TLSH
T19F172909F94340B1D92B11B04CCBD3BF8A70BE258B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 64db4fba6fffa5cef9c71299b6b605d6ab0dc3bc0841e8f80be67ece515d99de
MD5 25baf0a9fe1eb6efa9044040c4f9cb73
SHA1 f27a11757f70886e3f744d12a83abeba820c158e
SHA512 30da1aede1fc134fec392bf231e9cc72c53b747b179683d940e1d5ef92096f669c4a354bb1098292e13ad8868a240a08c13e22b7626afa6a507afc7e7c5bb21f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 e3af0255b95878494c710734aa5e3c70bc74a3c9724f7bf89a18020af20a7209
MD5 eb888f205c305870e36cea9cff3ebe10
SHA1 285a0905207c66468cc4bd7098d7ccadfbeba1dd
SHA512 458ecc9a8e718d87dff285d64b141a21efa6c6da4c65b81da314e387f02da396fdac5d903b699145d568357d1b65e515fc2c115423b14f98d0027fac9887aafa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 9d0e4a3004dd76ed850c1632cc9300ae8a5698dcd9af173489c25049800fb373
MD5 2a39ff39baa624ae2316397c5293cd82
SHA1 c71688823bb35f6b5e568dee120f1fbac83924a3
SHA512 cfada20355bcae3c0a33d5f5118df8d9050a8bdeec439a94aaf4d1290919953b47bb3b8a88c031068353d0d2ff3293653babec90929097666db988ac97a00103
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Adobe\qap`g`v~dtlq
Size 10B
SHA256 94737865bb6f18ff879e371e82355951098b81e5d2f48be68a898d0f80e94b0b
MD5 1394bb40775da549e0ae2ce7e73b4365
SHA1 75172ceb815a25cd728fca279427875097a876b3
SHA512 20e0e72ca58aead672b98ceaa3d944c7bc9e6eae8a48f5662851d84e7ec684fd81396debf1dc65832803130d5478171ea7735e1081ac97be3f62cac46244971e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ne-NP\qap`g`v~dtlq
Size 10B
SHA256 411ce569424a9aa9649dfefe1ddb6dc66b75186179a83d7da197c183a648b68b
MD5 f4b9bd2b535ffebe7562816e6dce1cfa
SHA1 26947663dac656f4b477be80b2bc4e2230281073
SHA512 4ba84acae8f74ac11f45d76978970d57452599d2468b5537547a9f2b42d6ca366a328b711544d3550fdf986358cb1b52a4c6e02fc327ba89538f3dbb8394a299
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 7f545862cfba832fddf1e7b402eae5514adbfece81ffc6efbfe05a98a0f2949a
MD5 9d8cfc3be6522b41eff0c9005647c242
SHA1 2bf01f3b4a4155a4d66851d7661039dd50cae6b3
SHA512 b7c0c744e3b7187ebdfd201f39e712a352de02e2b88de801a70cfabd493b2aa4ff2962aac5f1625e23b2d86217ef0ac63824f1ee201a99d4465360ad7f1554a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\qap`g`v~dtlq
Size 10B
SHA256 394a14647ef5c9a6bf986d9ad44057216e76d83dc7a5fd2903202216cbb21e25
MD5 fab235fbf88ee949aac4070533375103
SHA1 011cda576abc74e1c5071017857f7b199d13acea
SHA512 c969fefb9c66153134ac4e8c02b7e4f89f7f1ec6ec7bc11f76015ebd0d21205f80b200dfb165a5b6c7387d0f97448273b565c66d6b87d84d51c99150c070e38d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 381ab50a424dc8c3b27f30ef47d1e23b379e8b3d11fd84f8166c1d32f933b971
MD5 2a2099ead254c3a54a31de663a9e6b3f
SHA1 8e2d984352c8f3f1b6e5d9d1a5076850a420b5cf
SHA512 ec74fdc57fd3fe7b7097a718b05d20961549b70d5233d25af878b9f6a9574b756111ded45badd8dd88491c51c00e5e3e9bdebae170166fa753b2248b6646107f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 346372a1a8c3580e256a5359580069090c5547be710eb0ec29d823ddd3d54d3a
MD5 1944caa3b5d34d7e3cb97da1e90a5949
SHA1 29452285753e27ec728aa40930fcd9dabc236f1e
SHA512 54296c23fda80e923b1933ec6199e0c9f21bd2f1ecbaec5247e27a5398a4ff1f5548823417b0ba7be0964d79980c185b901e4bc8c04bd5480598d8d4a352af8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9aa0a4f0f7e94173bdcef79802ae72ee9f2cb6eaac781c7700e2975178db6b8f
MD5 70caf7918940a56be4a63154fb53e152
SHA1 738a530c9ddbdb823a22987160e2e7fad6b1aad6
SHA512 6c3a6a9008b8dd8c1505c6cb598eb5c56f48feedcc7d728f9a86e6484946708259198b9d793e7f20136af1e30d3767a2c776d75834e8ff0879c8db72dd689818
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 043ca7873e7c87e40440ede1b3c88e7cc2349432fdc9116030839a189d2f147a
MD5 edc0702411d6c879d5e5c3075dc31ba7
SHA1 59a3963d54db1a6face622329edfebceb7a997bd
SHA512 c0bf8aa0298c3ea9eefed321347bc64ce0516502973428e07e18324f72abf7301e458c734008ce1ec0fb3e61b0a372c7b038ae574c8d3bc18010067f817abeae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1469ec9e9e0d0c44cc7784e944c9b546b30e08eaa991c26adba48005f6ba8bc7
MD5 41128bf7a89873f332bcea49aa217ebf
SHA1 c3188b0221b5b0f87c500f931210c411aff95ea9
SHA512 2c517e7e024cac68ee452ef7e5b894e300704e9fdb80f93981ddb7a61cb512cb8930870a153597542f15fb4fd8e1d9017e3b8324ed471cee73eaae3fa653aa25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a6b16253418ed005cbac5105e88d0c5ee3e5131d3e61bce267004b32fbb9c326
MD5 933bc9c8fa68a4939ac523f0a8ab95db
SHA1 e5e46ee01b691042dff9e7b1623a9f3f4599d030
SHA512 b9dc9a7d9ae0737c07e8c3b2e456c6af991c2ebf86df7a0026b895711abf5ae315892981776d44ead0eeec56eea0b011320d396f0d7416120bfc746198014512
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85eac583f68da8c7494227be62bef46441b3e531f4efaa95dd6470aafe84862f
MD5 ae9850817869b9c0c0c4415382bf9e1a
SHA1 7064c34b0d564f6491d02e35a28562c6e945ca22
SHA512 857599cc48cf4dbcea6f015aacd2cb09a63ae7d0dddd236a55706cf03e4e806824c95097178e565cdef21147dbfbabd3ef494b882c426daa38f6117ae42d1155
MD5 SHA1 SHA512

Submit Download

svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCACCAAABCCBBACBABBBCCACCAABACCBCABAAABAAACCBBBBACAC.exe
Size 18.4MB
SHA256 cd95d559ed49d79a4f24c80672fc2bb145901697471cfcabc5252e92c07d8664
MD5 6597da976c106b7b44ed0638bc489005
SHA1 765217794745ae602ea543b165c7473f7da8b058
SHA512 58204d8a2e358182f4d763a19d53a1386812ae0259c19efdcaf3f3e673fa2b8e96c267ff347ab372a65ec10e839715e485f1c78ec77e6995866c0cdcfa314e17
SSDEEP 49152:U+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+EG:JK7K7K7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1AA171909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 cf8a7db1b138fd4d1470bf1684d4f83de17f90ed26166254f2973915519729c5
MD5 8d77e256ea830d7c4a7221b10edc21fb
SHA1 819900526faec47c9284ee5741ea8ede2727c9e9
SHA512 64eebdbeb8362a2002e70fe6163390287f2be87b8dad50b6dbbded2930354f33cd63656059ed127320b7bf1dba9cc7d6dbfa564b98a07cf4b4e0af4dbf46ed2d
TLSH
T17621AB65B4A6CCE7E933A8DB9A19DFD24CB83BABE8589D44130DC218B7C5C31CD194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1922c796d83737d6a989c016fcbe0f7dabe48cbabd24e41580b96ce4cae2a449
MD5 8cff429f0c7bcb99c1fdf41285b13a3e
SHA1 b3061e6a0f02f8a989af87d47624b6155ac1cf3f
SHA512 9cedb39f0ad93b0c7bc9a71e4d675cc4571bb220478eae90719a8f7fe78544df29aa13fbce9b1533f4610c38a5f7f10e7ae456bfffa1a38da16ff24ed185b3d1
TLSH
T16911AB9574A6D8E7E933A8D79B19DFC24CB83BD7B858AE141309C218BBC5C31CD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 885815902689d06decf4dcd834b1ea792df144190053e3f28f9043fb97194aa3
MD5 0e5b7becb574f3af6e1d5837a950d528
SHA1 bdd6b5b14f7e61d75762e6845cf2218dd564c1cd
SHA512 03f2a811a4ad5a5ee99fb0a7f975bdad677ebb906a7d44ea5902adbc06714cde122447e131148277c0e447e869786e8764e0041ee7f7ef75844cb9423960fc37
TLSH
T1BE21C994B4A6CCA7ED3368D79B19DFC24CB83BDBA858AE541309C118BBC5C31CD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 68ea9e2030e606e6c6427e4c622488d0040ac27fd054930a96280d47f27ad6a1
MD5 be7ecfbacc93c5d399f20f676e858cc1
SHA1 962d94ef739ed7da24980a6d39a6f2b0eb4add30
SHA512 9b232917e1058d547a354e924e129b15954360200dd2529e09af7562ac403208a1072690aa1220f2c51ad67b9e66da5038240509463715cf61e5bd4652c13a79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 a7cbc4f844815aab2c34ac836b845a0b2702295870885a4386f6c3de594e0f6f
MD5 f4c45ba9a97b5c5b1811d04be0fd8069
SHA1 373dcfc9d1f697e7236d416b7ad8e6d4774ebe34
SHA512 a05b03a006d8b665c518391eaee4e041b861a2b3326cf2b3f2dd703c66b33bd5fc7a326d712f0621fcc847ee505e4efc89dec40dcdafaeced7cc28149cefef74
MD5 SHA1 SHA512

Submit Download

memory/1360-33-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1932-6-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/4572-72-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/6076-1908-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/6076-3906-0x0000000000700000-0x0000000000721000-memory.dmp

Download