05416c018efc2085835ca02e4af4764be5abcb5b1631ed4f9b703215d67c893b

Analysis

max time kernel
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
Size 9.1MB
Sample260816-msp5nswtbx
SHA256 05416c018efc2085835ca02e4af4764be5abcb5b1631ed4f9b703215d67c893b
MD5 707e6ea12514ae95305c8a74a216bf66
SHA1 75d306f87ecb44dcb5b2fd754477e2b98bf49fcd
SHA512 28cba58025da6fae2673273096f6b681cda3b80b3aeca999eb2f662cc39a4d9118354947e9b9b066e3a4f6baa0c8f9e9e5934aa60bcedf960168452c3b79b7aa
SSDEEP 49152:U+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+c:yK7K7K7K7K7K7K7d
TLSH
T100A61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
5076	svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe
5176	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBCBCCCABCBBBACACBBCABBCBBACCBABABCBBBACCBBABABACBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe"	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAABCABCBCBBCABABAACABAACBBAABCCBCABACCABBAABABCCABBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe"	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
596	sc.exe
2780	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
472	cmd.exe
3796	cmd.exe
1092	cmd.exe
1784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
944	schtasks.exe
4956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
5176	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
5176	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
5076	svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe
5076	svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
Token: SeDebugPrivilege	5176	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
Token: SeDebugPrivilege	5076	svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 472	4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe	91
PID 472 wrote to memory of 944	472	cmd.exe	93
PID 4748 wrote to memory of 880	4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe	94
PID 4312 wrote to memory of 3796	4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe	97
PID 3796 wrote to memory of 596	3796	cmd.exe	99
PID 4312 wrote to memory of 1092	4312	2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe	100
PID 1092 wrote to memory of 2780	1092	cmd.exe	102
PID 4748 wrote to memory of 1784	4748	svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe	105
PID 1784 wrote to memory of 4956	1784	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_707e6ea12514ae95305c8a74a216bf66_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABABBBCBBBBAACCCBCABAACAABAABAABCCBBCCAAABCAACCBAAABBACCACCBBBAACBCBCCCCCBACCAABCBCACACBCABBBABBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAABABBBCBBBBAACCCBCABAACAABAABAABCCBBCCAAABCAACCBAAABBACCACCBBBAACBCBCCCCCBACCAABCBCACACBCABBBABBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe" start= auto displayName= "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe" start= auto displayName= "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBBACCBBACCCACABBCCBBAAAACABABBABAABCABABBBAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBACCABACBAACBCAAAABBCAABAAABCCAACBCBACABCACBBBABBBBABCBBCBBCACBBCBACABBACACAAABCBAACCCCBAAACABCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBACCABACBAACBCAAAABBCAABAAABCCAACBCBACABCACBBBABBBBABCBBCBBCACBBCBACABBACACAAABCBAACCCCBAAACABCBCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCBBCABCBCCBCBCCACCCCBCACABBBBBABCCABBABAACCBBACABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 973f65f65e94d9662beaabed9fd181611bf847c1ee728da2d60246670f26604b
MD5 6bac09c13c08c855a2adef4dabaaeefc
SHA1 fc4a7bd809ab114a62580b56339e71db71acbd41
SHA512 d4884b03a0467ef3c21ef607eca5e4569febeedafe484586c291c912f75415b629ddb164870d3a1cc4a450270861baa9f788c50446a1d12a298f5d6256e4a340
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Settings\Accounts\qap`g`v~dtlq
Size 10B
SHA256 f83f2aafb4736e6ebe8491a0ceb40bf259f31f5bf8124cba005cbba201ddda0e
MD5 8fdc79eace250f008e185bbec5fd8087
SHA1 b2fbf8f44e385f138419d1c7ebc1ef1040339e1c
SHA512 3d1b6ba3f1e828aa4e81a33656badd6f18eed15d073babe482cdfbb917517514f12f7871bad147d039390585978252caadf8881c4c11eb5b206dc9f75f89f45b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\qap`g`v~dtlq
Size 10B
SHA256 f8b46b69e19e2e27c23a043bc6a13cb074e957ad5e547e5d9b9dbfe31b5fe4f0
MD5 e04d8dc2929dae13d56247fae4881f4b
SHA1 2ac033a07daa6f62815588660f982449ad6ffa16
SHA512 2bfec77cf6ae19cc4739c2fdc2f7038c0e402ffed054de4a65c9faab2731c79be7bb86fd05243861934cd1d955dd55cbf7361d746643861c4b3bd5e37212befa
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 9.7MB
SHA256 e3a2dfbb3e5b5c635a1916aa0758307cf7cca653e449d7f79df66d16cfd5d591
MD5 1ac45b4622279131c6abea07855f8222
SHA1 d874ffff334a72c032ea2def01be26a6f4bed204
SHA512 bfb3785ca560d9678c7387254ef209ffb8b8c1684a9487c8cd5f6dcffde3f625fd83105a83688f6d671775c5c406fd2538b739320faf4215185083e0f625ec7e
SSDEEP 49152:U+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+c:yK7K7K7K7K7K7K7MgZ2Hb9t+2xc
TLSH
T1FEA62909F94340B2D92B11B04CCBD3BF8A30BE258B128EEBF649D75F6933B916439655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 2b6f27a9830a3d615ed4db61fc0466c35db0aa8e45b79d1755192a9fd59c9987
MD5 746e5c887808a6cc034c97ec0b98e8f3
SHA1 642923f34be62c2273be0981218516ad65f4ea8b
SHA512 215b3f529b6e1be721718f2dfd63d6d2a34d86f298273ff3aeaf2870a0fd15f80d1c9effac362d00f60cab74f3df61812784e9a0ecda483ebca17c57158c1c93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\qap`g`v~dtlq
Size 10B
SHA256 cc7e830c08f27272baa2b6780a7935ee1d4a46677fb1740b9ee8f933f1454d69
MD5 0b50ddbc0a81027a60d3138964f238fb
SHA1 ec9238f4d86a0119b9867e6184876a6685e4ecd1
SHA512 dacbbe7fd5f7598ef65c295e3c7600c44212538d399d2b11bc91deb7d643f23d719d218577be1a1282ea5b4dbfefef8f9b62096a69ad2d9eb91573f0ddd04465
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\qap`g`v~dtlq
Size 10B
SHA256 e0415f16528e58152176b2b7a15877dbefe4299a0bbdb3e0cefb7474d257accd
MD5 f34206b9cb039f3d4481c363f66b9edb
SHA1 06c5c7fb1d708c001ff70e6759277a80cc0f26e8
SHA512 d31541d1708b76b3129025c5f976d69ef5fa10b41872c94322fbb3d469b33a930b8000f5aed41b5cc0e902592a13531592eaa70cceb64e47a5b0b5e0593cb399
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\LocalCache\qap`g`v~dtlq
Size 10B
SHA256 ff5d891fd845e18a7eba8e4ecec6e076a4227fb46871c28ff0b0c66ce9164ecd
MD5 bd9351799179817af004c7866dc84edc
SHA1 c62bb662c6adea1c975ca4ba3ae49809182a8235
SHA512 e90214f4372b57e067d5fa399a5ff36ea81f0061de089f7584aac181041aa5785f8a27d3ba4c6906e7362321ae00877b5c762dedc7dc49abb22a00394b4107bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\acrocef_low\qap`g`v~dtlq
Size 10B
SHA256 0a28b3b82c315a77b450a3ea24bf8e7ccad31b29aa0924dde9f144d0fdb5671c
MD5 50251a4945bdb235756c19dfdea5b95e
SHA1 dad706a1606b0a19f98c3a2d995cfc576b84a53e
SHA512 c5009757aa8689b617485a2c9b6f63d0b7a7a37f9327a38797439287d1b2478322b0f173cf486dc21527c2ce6ebe9310291cdf3c7b4b5074248a1e58f11bbbb1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d1b151773253a78644a094f320a333e4a0260d83dd09573d1cde19443b7c546
MD5 b151d2ba4079759875b5f9c81dea9d84
SHA1 f83a897530c7adbd73d9c196f78c69a1c89f4ceb
SHA512 c9f113d4c72a4f8cb2c591823277b9731ac3621d251af5f5833853d97e153f159fe8065dc3bacad6c0bfbcc49563a0a1632748d4d0c2736711e948a8353761e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b350048a6c0c7f8a6e4793ebe27c2f00c63e6bf6063580579d1f4fe6c38c9fd5
MD5 8b74f415324b9570b8b8d58da35295c7
SHA1 6c0616ac950260794a1934413f51a9ce15f4672a
SHA512 7944ea0e1b59a0fecdb1dca5624221ed3f79779f631acda04021f3aefd2f9eb48315727b1122d1cb5f627efd7decd5436548646858dbb683f13fee381e517cf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f81eec7cdba2994babdb032c2052cac345162e3e9a3210b3d302525c3ec87ee4
MD5 7e75e48f762ff358081327597f7b4f47
SHA1 01de65749d3ade5d7c1a0c8cd5446ea43a2b3b2d
SHA512 f604f292d1c4577bc6a6a83b090aa122ae4c09d1b76c4158ce20be95df38b224de7502204f18b6c33485789096a8023d6e1c21168ccc29c1b8411164782545f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68b1136eb549f92bd7de083328d74c34cbb47e109c4760a2911903b5b57eb1e4
MD5 1bad9000ee9a55cffa4757ead25079cf
SHA1 1932f24f784ddcc88389638d803da7d21bfc4eec
SHA512 18d008a9e307476d560bfd67c50604f634746224199b143193d22479cbaaf850ac6141cde9eebf0c08ba11ab345bdf3289ed6588b90bf295ba9691ba8fdf88ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b827a838e87477b25d89009763613a4884c7d57bb80207061eb44473c2a93162
MD5 db58dfac8130c51a4529545ce9c2c2bf
SHA1 873c85ce3fd061491ad017ac29df9966720f8fdb
SHA512 db4f45fcc55b8c3874b961c173ca20a756c85ef46822d7f424dd219d85a443e8baf25b0cdbd027df9f802fac62138e1431f4e3caab4998635993f29732bb1116
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c91b2d0ef829623af332b17ea443657310a4da1608b30efd02fef84381e49180
MD5 7f83fe44971ea168d6e40f29016869a8
SHA1 a7f51c552f10ac2b15ff1a539e7a0e9e1bdf83d8
SHA512 11e26c8a65096a6400c523ae6a0782919256625441b144234b2c5262cc48485132d75f33f3434f0a1c34f3a4fc9ed0c8957b62fbe1d1be062f6b24fa8eba0d82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\AccountPictures\qap`g`v~dtlq
Size 10B
SHA256 cef2baa031ac4bd4b9b26b8b1be1b7d33fcaa3bcb5a418a3c76feb44c3b410cf
MD5 847952a09ca48a3e61abab0236e7e289
SHA1 6bb8c8a7c6ce6c8c82a54295bc45f0367c36cfb5
SHA512 2fc53127ce6f93d5d36c884891d859333253233de9f3c53430f64ff5a7eceeec51d284fc8f4952681ab600eb9a868917983ae9fb39620a00679f666f771d35a3
MD5 SHA1 SHA512

Submit Download

svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACCCBCABBCAACBCACBBCBBBCACBBAACACCCBABBACBABABBACCC.exe
Size 9.1MB
SHA256 05416c018efc2085835ca02e4af4764be5abcb5b1631ed4f9b703215d67c893b
MD5 707e6ea12514ae95305c8a74a216bf66
SHA1 75d306f87ecb44dcb5b2fd754477e2b98bf49fcd
SHA512 28cba58025da6fae2673273096f6b681cda3b80b3aeca999eb2f662cc39a4d9118354947e9b9b066e3a4f6baa0c8f9e9e5934aa60bcedf960168452c3b79b7aa
SSDEEP 49152:U+ES+ES+E2+ESM+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+c:yK7K7K7K7K7K7K7d
TLSH
T100A61909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 544941e4838cc1b9f7479b08584f73cc3d4ed71a119a032307f7fc48abc142b6
MD5 0fc08f1d2f2f4fc2835febc249b65f1b
SHA1 62661b1abdfde7c3655a9001ef1b036fbfad7a41
SHA512 20c5fce7d9708fac84ca0d3c383b352908bb604358c0a45943a05b7246ee01935eea2216036de3d836450b642e0b189cdd5c31ccd612937493d74dab088368ef
TLSH
T1EA21F615E4E9C893E93264CBBF2DCED2199D33ABAC586A64230D411CBBD9C318D094F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 bbf63a861c677ce454041cdb687c179b4c4cc8264759d09d85e6aa45f4a7734a
MD5 a01398b63004798e0a8a5ca529b9a253
SHA1 5bd6274f71610b470ada9b02d24e9a5167ecc35c
SHA512 05dbfcaacc52da6480196aba8e868ffc3687e8095f3f02d92d618aee234d8e272f4f454aa37dc5360b40ee8feeee57a4ebc8544a5f8a6b748b18194213c2798b
TLSH
T1B321F354E4E9C893EC7264CBBF2DCED2199D376BAD586A64230D411CBB99C328D190F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b15ffbedebbbe39a2b2b46a7e176bb38271fe09271c8476f6d7bfe77d9934fa7
MD5 5b499ddd7369f24a2327fa24981697f2
SHA1 287402649b4085c8b5b178c4ba595f5d89b82662
SHA512 06e68387e76bd5431412b0061c976a3b32bba2ffdd6a8c864fc283a9a4eadb1684d8a47122ab1dae89e84323e532309df0bd8b67a3a99e11a01011d4cb827c32
TLSH
T14C112314E4E9C853EC7264CB7F2DCEC2299D33ABAD586A642309421CBB99C318D190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-6-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4748-33-0x0000000000390000-0x00000000003B1000-memory.dmp

Download

memory/5076-2361-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5076-63-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5176-598-0x0000000000390000-0x00000000003B1000-memory.dmp

Download