4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Size 15.5MB
Sample260815-kllgsshj9x
SHA256 4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94
MD5 fc4a5ff1a3a2a934914cf2b8d0467e13
SHA1 b19b230a786f4afce6edc85e2148ef33ce7c2dd9
SHA512 61e309cd2b0a52740ec0fa4e75456ad89980ad021429968cd84ade6492e2c780c9dd00dd768a62e4adf4713048bee37c1c2be29351cc02f7cfc70be5346ad17d
SSDEEP 49152:U+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ESU:s7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1B7F61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
4868	svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
6084	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCABAACCABAABCCBACBABBCACBCAACBCACAACACBCABCABBBBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe"	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCBACACACBAAABABCACCBABBAABCCBCBACBCAACBCBACAACACBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe"	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4500	sc.exe
5028	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4956	cmd.exe
972	cmd.exe
1440	cmd.exe
5124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4136	schtasks.exe
2060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
4868	svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
4868	svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
6084	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
6084	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
Token: SeDebugPrivilege	4868	svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
Token: SeDebugPrivilege	6084	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4956	1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	92
PID 4956 wrote to memory of 4136	4956	cmd.exe	94
PID 2788 wrote to memory of 5436	2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe	95
PID 1500 wrote to memory of 972	1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	98
PID 972 wrote to memory of 4500	972	cmd.exe	100
PID 1500 wrote to memory of 1440	1500	2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe	101
PID 1440 wrote to memory of 5028	1440	cmd.exe	103
PID 2788 wrote to memory of 5124	2788	svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fc4a5ff1a3a2a934914cf2b8d0467e13_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACBCAABCCCCCACACBCACACBAABCBCCCBCBCBCAABCCBBBABBBBBBBCBABAAABABABCABCCCCCBCACAAABCCBCCABABCCCACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBACBCAABCCCCCACACBCACACBAABCBCCCBCBCBCAABCCBBBABBBBBBBCBABAAABABABCABCCCCCBCACAAABCCBCCABABCCCACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe" start= auto displayName= "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe" start= auto displayName= "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCBCCACBABBBACCBCCABBACBBAAABBCBAAABCCBCCCABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBCABAACCBABACAACABCBCABBAAACCCBBAAACBACABACBBACBAAABABBAAACBABACABCBCABBABCAACAABABACBCCCCCBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBABCBCABAACCBABACAACABCBCABBAAACCCBBAAACBACABACBBACBAAABABBAAACBABACABCBCABBABCAACAABABACBCCCCCBABAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBAABABCBCACCCCABCABCABBBCCCBBAAACAABCCABCCCCAACCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 63a0351484d02923c67a6ae02b94bf011dbbbdf89ea20576096058fee1a8bebe
MD5 e73de87730f05999f539105f1deebb33
SHA1 ad19cdb7ea54da54c5c44c604077c0df099d2a42
SHA512 77ce0de4d128fde20b35c430c0b0c9fc2d2e7816c038e600a286058376c7c1685a800dfc95d7b4e38dea50deef13986a4dd96c0069ec26989d239ce4ce1639fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 96ddc49114160efbeeeb8aa6bf6a566c2f1ea3798c755fc7e0def16884941e67
MD5 c5e6445c4ff3e4cd4508154c42ec4fc4
SHA1 bef5532bf169ba0badd7cfcd71b45fd0d63080bc
SHA512 73a9dc93810a1533ea9b58e8eed6c90361c4cdd68025b4424b8d412d98b1cb3c504d3f840839ac664b5137a05a32e847d0cad89f0ef4ec60c720fbf21379aad0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 002da195bc45f8878637195a7efc72ec9608fae6087c3d7e334c119daa3137be
MD5 d5298f8628acc7a09d98210f6fc49059
SHA1 d6cd8bc8cb01dfb3094b90a501b226579e03d674
SHA512 69a4d95726934f432b67e69a36c6440940fc496d1f737703cf313d82280a510f39b8dd7f7193e534bfa185a8386750f1936970859e7d7fa1f1c1fdef2c416689
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 a71a3ab5d669f70821c4c5aeb449141da2e51b4d757535137d7cc813b2b916f2
MD5 7fb8109499308a439f017be8fad8ac5d
SHA1 accc24cabc63b1f4f656a3289fbd4cb087f6d9b9
SHA512 0ee8b6d9304a84a04bcda4c5bc2a58c66544917616e26904922e12fde6c30b025584c9f22a211bfedfccd2061bf0cab3adb7c0111fe2a3e977cdd4b50c6589dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 392075c48b32ca660fddb8a6777bba6e228ecf520cca72a21ca21aeeb96e7f73
MD5 7b31e0982d0f19b64bf5a8ae2af4f4ad
SHA1 40c9349ffd2ca3da976b9850672e931c99efc503
SHA512 3cb4ff2aa2d0f59e420c7616cee822e2ddf415cb00ff646345aad2f7d00430fe194695868305de06766a9c5c79333c413380681fd44912bbc95810d51ae39d43
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 16.1MB
SHA256 a219aa6f0a9f5532f083e5d54dbd9c1681113bf50e8a4778457fa96520d31be8
MD5 2261c07970e6f16ba560c8c53df8241c
SHA1 a0d51d6099ab66dc8bcfafb145281a1585b5de54
SHA512 baa8d7eecca37b730a454610888f6b220388f9de75afcb2d4b5ca4d62744fbbc024133af6f29a5ac66c280c66b984191f1db789f4db7d13f1594a107f312ef53
SSDEEP 98304:s7K7K7K777K7K7K7K7K7K7K7K7sgZ2Hb9t+2xC:2gZ2jC
TLSH
T114072909F94340B1D92B11B04CCBD3BF8A70BE218B128EEBF649D75FA933BA16439555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 da41c24abd892156421d4d712545cd65b831f277851e6e682bb105ca85420af9
MD5 2f67e834b0981b471e1bb703a2927acb
SHA1 8ed88e76bb99911262d8ffa5263804c8323d4063
SHA512 fc86d1a6618c5495ab2dd5c88392ab7cbb231679ee2cd66b89f5009fb5d71bd9f0efeb728018a8f4907549732c86b62a44e7ead875d0d8bb9c97899022362adc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 11b5fede3def68d6e54414728dd26a0916badb6fe4cea0b9100420ac3faaafb1
MD5 52ffa2695a7b85bfceb105e5733df88b
SHA1 28addb7f313e16dd30fdb4f381d8c46df32694fe
SHA512 829625ec57dd146b82486a063992e3fe96b262fcf48fb604a6d0cefc82c0d1b5d4ed543d361e5558657fe1ee943827a7a5c9746ac816ad97d3ee83f8a3351b12
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 325822551100bf96bc2723e0e2d7b568337c364f57d91d54ff98a6ef81bd826e
MD5 cf0f271788572ee8cb572ae088044a9a
SHA1 a932c32787bd03f2d7dd6b0b40bdbbe21c5616ad
SHA512 b810a0b5c209011ea428de1c7d69489327ba0b60c3a76a0c4c364f0e0618304ba397669f7088fc48b465e035cc2acf9351842cf7596cfa33324785203b3caeca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 d36bdd206c81d05508a856490a199805b28376dfd69321cfb0c86454c0ba3798
MD5 ac9ef0f175b424c6d855b29d8a03fe01
SHA1 eeb77037fb34e962e9b8d37e51c8ddb77d934b66
SHA512 1388392f229646202ef98a20be871be3050f8ece35db61f9a310aa35bca49ea4da8c15f3ea3acd71f7df9547daac06eff23a937cb6cffdc96419db93d80539ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 ef49837388f6e461577cd2eae9dd5943dffa538ae54958581e773a256ea9fe82
MD5 3d20f7e323313fb4bc3baf39e0ca01ce
SHA1 4c6ca6b91f05b428bfaf09e440922bc53ea9083a
SHA512 355e45607abcfe19bcfed7d8c0a8670636a75b63384e25938f5d3bd6e735ade0753e0e8cd7504ab0e8ac459ce78c0c59988b0faa49a3075f27c1760362ac5b28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 53a2f996d99dfd04037b89c19076741f6044fd92b3fd9758227d9cb8b344cf12
MD5 7088d0a2808cfdf84e55f37aeb50f3de
SHA1 9cd3163aeb550c6543a5bc15066f0786dbda5e00
SHA512 288eade7e4193050175184007af699507b10e67e82681d762086704f4a09bee508a1395fb14bb374a791131a7174c8cb1d8d42afeb0d6137a935926cf28c5dd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\qap`g`v~dtlq
Size 10B
SHA256 cede9f44079a12dfc6b423f130269d97c0835195db6ff54a25589d8202182608
MD5 f594f5381de6f001a7252900582467d4
SHA1 442ea9a3b6b6cc4462fc39ecab71abbd0ec9f449
SHA512 20cef6c16fef52f7a51138b346723e54accb2c28af571bf273953d4fdd94672ea5b109b3ab7c425209d7c0edb80af50da13bbcf062f6867875a3b4c4fb5558f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\qap`g`v~dtlq
Size 10B
SHA256 3e3b2e12eaae09034ab3bbadea40d923d210ec8de977eb7507aff68b7ee87917
MD5 adcf09d3a7948ecf52f19dc4e95421e6
SHA1 9defa6193d8ae0542309988bc73475213a288a1b
SHA512 8bcfd9af8165e5c1461f53a5b3aed3c24542ed3e61b3ffa2170646af8bb20ed432cfab5a40b69fe3e2899bfb39164118872a97bfef5e8a02c58a0c1e7faac791
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6be703c6edd5222f1886bc0ffcad25d59f957570dd26b837655b82e5aa53f35f
MD5 97513b266f01aaa08ea20215fd547624
SHA1 b11a94467d0608c1a6df6ddd9c8f44c2711d912c
SHA512 3d90dcd6025969e295b184d4d62cdf1be00d0618f38df2d1fa86746a6cc4ca861bec2c87bd42350727cf4e6b827658d2f3a409fb9059f757241e06b1ff70887b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74f160d5a35513897539476f4bed60ab055ebe06d6ffbcd28c5ccabaef237b00
MD5 329a9b93af16a1468316764cb1302ca6
SHA1 0671d9b43fbe8858455e3caa190d7a2bb43e0e6c
SHA512 87d83b2fea8a838bd6fe3559eee8ef9478c903ba8c2cb6151be07c42ee82c3970b395a37159570f11cdc9d8ae7b70ec18957c9bb22d708a3f22778853ef6acd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c8b05c5b61d73980ea2b973280b09d524e083ae4aad88f568ba397bd14e0386
MD5 325d9bbb8c00fa75cd7f194f03ea5270
SHA1 81a73265f84c501554f491244b5ea4290b515670
SHA512 c23604466801bfc34814f5defde9d26110fddd4f24dc321b8c1679f6d56d1b32127fca620c4ce6b149b0c2f913240ef181251f925b821bd93ce17b096fef1143
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6d3bc5d02b868dc60b152c00bf48a82adc7ada8714775399780f78d25f671f6
MD5 483acf3aaaaa83bd30df609139471e97
SHA1 693d41dcda8b1263598c9b0f71bcb548b8edd9be
SHA512 07f148a5f1c43b8bcac5c885b649ea5dff3808b4a8066f9741fd7a365a93182b818f9ccc909660c2d4a833351908acc6264e54cf6e8407b8770e6f3bc23880d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a43840ebb6fc1b68da2de758a5049532345d7554936333bcdda2597016973fd9
MD5 1bf6d32b92a8a0b1d4da18e5bf5d76e6
SHA1 6ce5ed81a5aed32d2f05aa15e02c939bbbbdb5b8
SHA512 3d84a199e3f57c1429bda26ed7b6a0c558e5805cb03ed0cb1fca001f01d10bf7ae6788295809e88da837417e68d6214d8f4d1e5da6cad5a4b6c825efea42bc7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e00912d5cf97c79f499df7422e9d4e95575b98e247b02c4ede171d2a6430b6be
MD5 953bce0182bc98c2d7a4d26edc1f8c36
SHA1 873ece725d755081d7fbc61f240f72519551aca8
SHA512 442f90e30142cbd12a5a8b66f205ba680f8e50665d6716c2964a5e40c10b383cf25a0bc55b3c9973ec19c3f05f6c58e36700c76c67e25035926339810f830bea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cb0f5300b5890c10cb2bef0efcb34209693b14cb7c8e46f0b6ff07e0d42871ea
MD5 096a284f635f86f27492aa00f3dde111
SHA1 6d3255054e54eed3d526b7791c28d0a0245a355a
SHA512 ad0d0db95c60b0fac5b3a1f51a15e97248274270b6cc9d9827e55733450e9a684be78a1f97ebd84d3a69453b0bb7e3ed22238d1bae89aa6c759758bb425f2fb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 64d8b6e15c96963be21409fb4ef4c148ec74d04dfcb78d6aac9a14893f20be60
MD5 9274075571a5fd7898eba1873b8c2f00
SHA1 f4fad4c223529ea0ecb4fc9ccf36d6cc0875af56
SHA512 4e8614c6ac39255aebc409b33c9d041f08978fefb1984e6726c7da0de6cfe399d9ac632b57a8c166426711dba5f36e3af6cd70a9f9e545e618d987df7562b80f
MD5 SHA1 SHA512

Submit Download

svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACCCAACBCCBBBAACCBBBBBBACBAAABABCBBCAAACCABAABABBBB.exe
Size 15.5MB
SHA256 4a15f89b8cc697d739ce272bd75e8e82927ea5b0e55d6fa6fe51283db70b0e94
MD5 fc4a5ff1a3a2a934914cf2b8d0467e13
SHA1 b19b230a786f4afce6edc85e2148ef33ce7c2dd9
SHA512 61e309cd2b0a52740ec0fa4e75456ad89980ad021429968cd84ade6492e2c780c9dd00dd768a62e4adf4713048bee37c1c2be29351cc02f7cfc70be5346ad17d
SSDEEP 49152:U+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ESU:s7K7K7K777K7K7K7K7K7K7K7K79
TLSH
T1B7F61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 57322a56b15db6747d7fb174764ef664d9e9fb2a68ed04622d0384e770fb74e7
MD5 0f345b2e5653198adb0e33ead97fc9ea
SHA1 11af9bd3b9261801e198faf6b87c64c0ef94c5be
SHA512 73bdb12a61b8b3e34580085802e001214cd0e9f1b1ade3abddf68bf9bcf94b83c2694e0fbb5137a06ecb450271059d7dab980bba23ddcfb132ddfe37f81e7f82
TLSH
T13D219171D5A5C8A7F9322CCA9B7DEA9308B82B9FDC5C5E10624A4128B7DAC308D594F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 abc6f64bd844686bb88c3b33bbc41d51f4574f8b5e73dedfd36271473390bc88
MD5 e2332ffd8174d98a46e14a16b62ecb34
SHA1 2d537d6c8dc0bd69aeb7e4e6cfb387536cb5e9e7
SHA512 b9dbdd59eb8aee568abc2861c820cb2e246cdc887b93f5fb83fce2d8590c3e2c113631109ce4302e67a70e11b2a2b4910c33429950f69b1dddb938c6e1af18c5
TLSH
T10611E361C5A5D4BBFC322C9A977DEA9308B43B9FDC2C6E2463464128A7D6C308E554F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 af8dad22b3b33c42f0c3cf70d89df1509da4c7f530ad615babefa95ea3eafafa
MD5 1829698fb419562c26c260bf10bd6c64
SHA1 4dbedbbd7366b6186f2473062fae91451b6b4139
SHA512 e52d9d1224146f400eafdc9c40a060b14713d34addef649bb6ea099420a96d2e693ed310743dde8afabde764b8afee253a0d31bd4c4db85ec44a74cd9a3b40ed
TLSH
T15A21A461C5A5C4B7FC322C9A577DEA9308B83B9FDC1C6E2473465128A7D6C308E554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1500-0-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/1500-7-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/2788-33-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4868-1555-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/4868-70-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/6084-1556-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download