d7344048d2571fb12bb73a61ef62f4919866a5f58b3158b7072311fa5b5ae897

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
Size 15.4MB
Sample260815-2a2hbavyhy
SHA256 d7344048d2571fb12bb73a61ef62f4919866a5f58b3158b7072311fa5b5ae897
MD5 caf67cd3d12904c61ba8adb4f907ee82
SHA1 9117d5837056c6c0aedad8a8adcc7cb834c6a0a9
SHA512 d19fe28adde67c26d139f5abe9434a16db85c27af7026e07aaf3b862ab023cd10fbaa3e7673a06211f98144b6063a61eda89a0c7af1313a0b5afdc6d52a065f4
SSDEEP 49152:U+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9W:U696969u969696969696969694W1PszZ
TLSH
T16BF63C09F6DA04E4E577567089BB817A8932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
5836	svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
3444	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCAACACCCACAABBBABCCCCCBBABABCCAAACCABACCABBBBCBAABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe"	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBBBBABCBABABCCCACBAACACBABBCAACCAABCACCABBBCACBCBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe"	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4132	sc.exe
1856	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe
4812	cmd.exe
2824	cmd.exe
5888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe
5380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
5836	svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
5836	svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
3444	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
3444	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
Token: SeDebugPrivilege	5836	svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
Token: SeDebugPrivilege	3444	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3680	4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe	91
PID 3680 wrote to memory of 3052	3680	cmd.exe	93
PID 5684 wrote to memory of 1880	5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe	94
PID 4848 wrote to memory of 4812	4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe	97
PID 4812 wrote to memory of 1856	4812	cmd.exe	99
PID 4848 wrote to memory of 2824	4848	2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe	100
PID 2824 wrote to memory of 4132	2824	cmd.exe	102
PID 5684 wrote to memory of 5888	5684	svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe	105
PID 5888 wrote to memory of 5380	5888	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_caf67cd3d12904c61ba8adb4f907ee82_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCCAAACCBCBCACBACCCCCAABCABACACBCBBBBCACCBBCBAAAAABCCBCCBBACCCAABABBCCCBCBACABBCCBACABABBABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCCBCCAAACCBCBCACBACCCCCAABCABACACBCBBBBCACCBBCBAAAAABCCBCCBBACCCAABABBCCCBCBACABBCCBACABABBABAABABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe" start= auto displayName= "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe" start= auto displayName= "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBACCCBCCACCCAACBCCAAACABAACACAABAACBAACBBBBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABCBBABCBCBCCCCABBACBABABCBACBAACABABCABAABCABAABBAABBCAAABACBAABCACCBBCAABBBACCBCCBCBCCACBBBCBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCAABCBBABCBCBCCCCABBACBABABCBACBAACABABCABAABCABAABBAABBCAAABACBAABCACCBBCAABBBACCBCCBCBCCACBBBCBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCCBBAACACCBBACABBBBBCABACCACBACBCCBBBBCABCCAAACBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a954ce9ab46e7ac8d7c3e887b84d0e50bc555a95d3a4ecec17a79e9a6072543a
MD5 40fe1c48ed11e1cc74fe0d7fbad7d2c4
SHA1 21c3a828463063cf6baaf41a7f387d631c3a1213
SHA512 52859bd6adf4bb878346aaff002963f3c2edcb715bccfc1aea243c4d2c717085f543e66d2791ecfe8bb92a19545dd4ee2bdc3384ba98f25e2915c224fe2bef67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WinMSIPC\qap`g`v~dtlq
Size 10B
SHA256 1a38e8ddd870352263b60495e3dc81ad0629371aeaac7433e2e779e5aa5352ad
MD5 79ea3f2d4d7b51a953c29bb2ef5204e1
SHA1 5da3b77f1664eb0623b11e4758fdc7d9333c13ce
SHA512 4313cc7728455f656a827e41582778efc4e6365f54ef8816270aa4e6d37534befbd49a74330d9fe8371ff9919dc40714ce455fbead5ca06f8495329687b11097
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\qap`g`v~dtlq
Size 10B
SHA256 329c7cac06c480ced6e460ae367fee9e9c604fc77cb2336c40e69040a3cbc3c0
MD5 c70c87356c6b8dbf2f3c29b26e083471
SHA1 60a5d53d3d9b7613e4a52c3f6bcb7241d390b6fd
SHA512 fa08811ac9ed2245f218f0ed85030534a872a051b00ef57c75c0950a41eea659c29c9dc25edf32bbf560d28beb64827f09ffd6e166632a4860784249acbb1a32
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 16.0MB
SHA256 2e13b08303dfa5e723da7fa32178df7ec526c7dbc9d52856bd4b03a0ae0e88f0
MD5 eb10be0b9e369e44941430cd7a4429d0
SHA1 4f4549d1332437bce84ae9c8299dbe5b482168b7
SHA512 27cf60a45c8cf06df1d94c3fcb6463b623d20dabeba76c6373e2f2d66a275bbd4b65f4d3f63b0f3028f79098d2fc326c5470a847f3ede6ec9ffd2654faeb195a
SSDEEP 98304:U696969u969696969696969694W1Psz4gZ2Hb9t+2xo:uxs0gZ2jo
TLSH
T17EF64D09F6DA04E4E5B7567089B7817A8932BD314721C9EFA284C67E9D33FD0AD34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 ac35fca762dfd0e6b1e8b16d718fa7a0dfca9a5e81ec38aee7de4e43799ae46c
MD5 5de3c6a0044f9fd6277c7ee6a561c27b
SHA1 b768913a6c1ceed987510a68c95c5487e7857300
SHA512 27a46e31fdb4d3096d40e3bf1bc81aeee45b2d81e9c9659cdbe2bfec4457151e89b76762aab5eb25268f8095a011192db44ceec51a66114debd85a19a485c4d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\qap`g`v~dtlq
Size 10B
SHA256 8244c60d377d47d5d77e269af6aab39d89c269b38d912af3654249cb43fcfcba
MD5 138daf1b24931c3a5f914ff745d66f10
SHA1 6068229721802d576d69336fd49010c41b43e5c1
SHA512 6135f8f6d6905095fb8adf469eddee20223dc0d990902a707e28ffc8d250e387617bb20ae30c64c99904f28ac07f704fadafb888b507a79c5daf181561e517a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 bdd6b629a1ae542bb81552ec7eed5ad6a2df5ebc7fa2bd83c9da1307d7704d54
MD5 f8a9a8f5b4446510e083ee97500c66a1
SHA1 8929a0e89542e45931d9e0ef4621fbbaf3f50682
SHA512 766d3f9570cdc411c6893dbc32d73ce5a845f8adbde744820297898c9af0060b6122fc19a25e8e3a440773e676a8871df7160c757e8b44ebcc8e00fd33feff69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 58f36005277ce548b0e15a4815c0962c4edabf1aaac14dbcf9c4c7a0696f7907
MD5 56647b8dcf3e78ea462c2a73f6251868
SHA1 786147a911cbff4b6dba8430502ad3a4cb4b54ec
SHA512 636f9695e269bb932f26eb64f4a4ee91211ed7c4f9bd60aba0b516aada31f1b7d82c78820617f258f73ac202b425fbe38f2033e27f88edd263bb7f01e851d4d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\qap`g`v~dtlq
Size 10B
SHA256 71c6a4f69a34046e846a9fe669422531c6935ca116ab904ddfe4a7e3d388ccae
MD5 78e980aff2d7a9beb7ae52075596363f
SHA1 3f335334af379a6c1b4f06c4c58ec3105cc45cb7
SHA512 ad69d97bcb6922075a95a5f2a1e565c82b3cabb6603849a99988e01f058e50676034be0666b0fa4de858c7536962e8671a914112eba8342c9f4a54805797caa0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f86f7bd2d32d66676c71430f3f8e0f6a132a92be5a25ee9c00e2689621b46b60
MD5 ec1f5ad5cce77cec27aea9b56d8cfda8
SHA1 74355751c8767012a5f91cb05fb762599229ef50
SHA512 1a55c4434d2f8ebe195d059ad3c5e6ea44683c9472e0c14bd407ab4b7fc8f3fca568f5d7fab5ff7a5f738d5855af90463f9fc109139ad56ed1df08d45abcb901
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b59bcbfa9dceb65990f06a41289ee698f72a475f3fd2620ea4333cd5f007094f
MD5 fdfdf180c669d2537696c4d70bcecd10
SHA1 b963128a0312ef3dc85c7155d19ff9d5a083d611
SHA512 01a4bdf2cc1451b8a8a1db0c6bcc2581be0ebd9e5e46276a26320462c693da9c2138ec7a4ddb2f2661b823cfbc5e16debc171cb76c79ee9a310190d7eabcc4b4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f6a867313615cfc9f0d1360036276d4ff7e714a09067453d00ccee0e1c61e3e
MD5 5b2df6800796de7c48ca848a92391e1b
SHA1 c2a7dd569b15cc4c13f3275c0f52d1fd55006da9
SHA512 2d8178ded90f6676669445645d371cafb72c21882af97419467c5c8745556d857fbf15a1a8d8ea63024311cf8364f018e8d406afd04e04dacf80acb340cb24c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a9ae3c1a0236e3a22946a33c520ef1b7b03d5db6a2ca9983f4c956c7c18eb73
MD5 2ed896b09e271d53c0769cd98770489e
SHA1 50638b81ef005e57227d9b269d2797e3a212a5d2
SHA512 df1a98594b0e0949386f827796d5aab8250840ae8cec8c0b0bfb72081224553f3c0144e286147e99d4eb09a21f25a1dce938896cb3ca0cb14b4a1025b3ee65ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5672740eadda3107ab120d85a8aae76d173839a7daf12b256b0cd6d83cfcd314
MD5 47dc00d8cb3e8997bc22cea7d67ebbe3
SHA1 d5a371697c3adbec4c478959b32d8d368fe0f8ce
SHA512 e3d84335f9e2b43f57d79ddba97eeffba431b03ce07d32cd3746c76727657e7ef9ae82142a6775ce52d1121b681b08d127f425e46391e9355820dcc242bb26b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31af1c15ecc0b7f9d56bd0085230b8cfa9b75553c1d7c83280bc1396413336f5
MD5 03e5abd0c5e2104603a0ef947d4fb8d0
SHA1 562c4156fb140104df174667223c20f8909018d2
SHA512 bf4d865b15cf7d644cd171db6215d7bff7ef461bd0ce144cf96a190762680a1bba532269fdd20dc0c82b7c556af010421e4bcbdf505676c151eedf85ef256b58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fdfdc0a7284bab1286abba4e7ad0f33d5888befaf33dae5eebb91041912cc846
MD5 f5d0a8c19af76ce223d47679a50c0676
SHA1 447d4ce5344099dedda7be98e32214859727f5bb
SHA512 23daf4d5126d9dc76a13511ab610e5ce7ac84a4007c4d96d86693284b52e207887f5700fa56a2c6e064a1c9ffc4711ad4ddf08033ae1ec347b2e5516a3f19a1f
MD5 SHA1 SHA512

Submit Download

svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBABBCBBBAABBAABACCCBBACBAACBBCAABCCBCABCBCACABBBACA.exe
Size 15.4MB
SHA256 d7344048d2571fb12bb73a61ef62f4919866a5f58b3158b7072311fa5b5ae897
MD5 caf67cd3d12904c61ba8adb4f907ee82
SHA1 9117d5837056c6c0aedad8a8adcc7cb834c6a0a9
SHA512 d19fe28adde67c26d139f5abe9434a16db85c27af7026e07aaf3b862ab023cd10fbaa3e7673a06211f98144b6063a61eda89a0c7af1313a0b5afdc6d52a065f4
SSDEEP 49152:U+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9W:U696969u969696969696969694W1PszZ
TLSH
T16BF63C09F6DA04E4E577567089BB817A8932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0604e3ae083e5077f371dbf1f7c656ebe0c66636fd52e2f3fce88393f08c83be
MD5 b9dc61ca6f07c20ba9c6d188ca5a7760
SHA1 49f783e24d8efe6848b79c1c6a062fcb4a21bf11
SHA512 ae7f205b5457d4cba30f34896aa8d605ab603f58627176e0f2244020857e552e235d6b44955f794ce3e66317b5d2c41d5b9b57562379cd1968d1818d95325fc5
TLSH
T101219656A4B9CC13B932A8C79E29DBD24CB43F9B98DC5D44520CD118EBD5C32DD1A8A1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 621a3bc260291b74991ca858f9d19b16a3ac7fe938799da2af8ace69624fbcaf
MD5 d09c63bb1bc01381d53779c873ae48ee
SHA1 257756085da6b38e69c7ce0c1b4ea275721b217f
SHA512 ec60e8694491d67fd5003d373f0b396a621c0276914d3d6154625d1f3821766ca8b5faa3f215bb8f7891468b5832c261ab6d3b7b1ab4c326b2b22b299845213f
TLSH
T1F301DB46A4F9D817F93368C75A39DF864CF43F5F58D85E882208A118ABC1C319D1A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f8ddbaa610711bc8a4d368bd9da712c44a528dd2e31b0de1be2464f994e088e5
MD5 7f385ee2ea3394d24ecf06a7d3967ec6
SHA1 38adea1930a1e9afb2b785613852391a9c3ff971
SHA512 dc1d0e1016573cd445062ab36a43f20a071f9fb82536a40561fb2bad3a8f8d7414b0564420978fa8609dd4147e5390deae6c3b8270bdc20dbdeba149013c203b
TLSH
T1E821AA56A4F9C813F9336CC79E39DBC64CB53F5F58D85E5822089118EBC5C319D1A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 890aad06c3dc2ce411c04b4b302b96ead1e4f9566ac37cf43171af43fa6e566c
MD5 4521b655c64f28000a6c57a5e935d8db
SHA1 f8966ea3219525a3835381c75e988db8066582d0
SHA512 c027c8c814da730bbaec58eb20730ed426ea730b74318147664e6f815b56b0e37c4a9081cf9df2af2441322379b4d4655623466be86d8df8ab6d3c3d027e32bf
MD5 SHA1 SHA512

Submit Download

memory/3444-84-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3444-2361-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4848-6-0x0000000000160000-0x0000000000181000-memory.dmp

Download

memory/5684-32-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/5836-63-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/5836-1235-0x0000000000470000-0x0000000000491000-memory.dmp

Download