c9ec461c359ab742b134651ce6fdea2b5d6221ac4a361287aeb11c9590ca81e3

Analysis

max time kernel
151s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
Size 24.1MB
Sample260818-caabdst1fz
SHA256 c9ec461c359ab742b134651ce6fdea2b5d6221ac4a361287aeb11c9590ca81e3
MD5 c7fa72137cd0b95a8d77a091d64a2425
SHA1 83f399fa4eeb3f440a9182c5fa20844297c4c6e0
SHA512 212401574b5b4f6969673aa24178f7545aa23f089c42b4f6dbb85f19fb5a77365ecff1898c1deeaee89ac4cb47b3833984554528b0e913e762800f4aab755c5b
SSDEEP 786432:E5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S1:Y
TLSH
T190472A18FBD71161F97756B08CEBD2FB5D307E2087318AEFE605D60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
2080	svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe
2728	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCAAACCAACCCCAACACABCACBBABBBCBAABABCCAACAAAAABAACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe"	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBBCBABABABBABCBBBACBACCCABBBABBABACABCBBACCCCCBCCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe"	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1364	sc.exe
1852	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe
1140	cmd.exe
2636	cmd.exe
3744	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe
5428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
2728	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
2728	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
2080	svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe
2080	svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
Token: SeDebugPrivilege	2728	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
Token: SeDebugPrivilege	2080	svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 4716	4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe	92
PID 4716 wrote to memory of 5428	4716	cmd.exe	94
PID 348 wrote to memory of 712	348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe	95
PID 4740 wrote to memory of 1140	4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe	98
PID 1140 wrote to memory of 1364	1140	cmd.exe	100
PID 4740 wrote to memory of 2636	4740	2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe	101
PID 2636 wrote to memory of 1852	2636	cmd.exe	103
PID 348 wrote to memory of 3744	348	svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe	106
PID 3744 wrote to memory of 4228	3744	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_c7fa72137cd0b95a8d77a091d64a2425_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABAAACCBBBBBACACAACAAAABBBABBAABACAABACAAAAABABBBCCBCBCCABCABAAABBCCCACCCCCAABBCBCCACACAAACCBCAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABAAACCBBBBBACACAACAAAABBBABBAABACAABACAAAAABABBBCCBCBCCABCABAAABBCCCACCCCCAABBCBCCACACAAACCBCAABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe" start= auto displayName= "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe" start= auto displayName= "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBBCBBACBABCCBCABCCACBCCABCBBBBACBCBCBCACBBACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACABCBCACCBBBAABCAAAACBAAACBBCACCCACACCACBCBCBBCACAABBBBCAAAAACCACCCBACCBCABBCACBBCACBBCCCCBBBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCACABCBCACCBBBAABCAAAACBAAACBBCACCCACACCACBCBCBBCACAABBBBCAAAAACCACCCBACCBCABBCACBBCACBBCCCCBBBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4228

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBBACBAACBABACACABACBABBCCCCCBABACACBBCBBBCACACBBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6f744c90eb6255b9c2eb3bf31034c97815034e25c703b7b924cedeecf71a8123
MD5 9f1a4825134f5bf7080495bd1fe838eb
SHA1 57ca3ce4406f785a630c5412838ee074186d8fb4
SHA512 499d8c006e89ee5392fddc1f89bb640ec61508d4536ec5680fe81d2cdf26c0decacc1e2ef5b383b5762d1d8db50a1bff1ea0293b784060c9b7e6379de327035b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 cac23edad9b3b9c9ee4b9a5f96f9f073915762e21eba7854266de04fce4236cd
MD5 472fd898ce14923c6b6ce0f0eb647291
SHA1 f0dcdede947e61c44be65d6d4d5bab92e8faec47
SHA512 7ad5d397642d9630f23fda6a64e45991f6b243c223584ae3fdab8209e3f68f541cf8a1470da1c0c884c240cdc3f5dc4323dbe40fdbb4c8dab385ae85812ffd61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 e911667ebc35ef297adeeb7ee5a138bf2e3b1dd7487c9248a6b7f91b2bb11735
MD5 707e044d227f5465f73daf975f981426
SHA1 116db4c15787d56e955fe75b8d71419dfc8b26a9
SHA512 ee2c1bf37f5eae910741eb77809b00ed6d0752dc85e2e4382078db7dd5dc211d9e6213d207c7a88138ff12daea6951a7b2db879d064c82d6ecb1804c2a8bc44f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 8da278ad285c4eae45b2a1dee1ca0e86e82eedf76e24295a0bf6a00115d30612
MD5 6726f754208573160b1bdadd538542a6
SHA1 9eb1d83d903e03b05acbb5cc39ef7df2f3dc0e1d
SHA512 62458a351905800825dd3a9f35c40a9eabc4cf48d08d71ea535f1624724b039c188244d1d5572ae5509a7d8cca2fa46bd0c9d8899400b28900f78e9901b987ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 e63987620f509304dfaaaf4602a59d34cdd57c193204039a1abe68a968f5cc6a
MD5 881755c3255a999f846cef5094a9555b
SHA1 f787e22314ab01ab69020cb23c95ae0c523a4c5e
SHA512 157b0283cca3d94364426ac0cd6404c3f35dd50ed9d3c462ca2caf66b10d1bf1a2842818d168710b0be912189ef417c3c3a3b6386a282989eed46f27c2e44614
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 24.7MB
SHA256 eb40c6595d01faee0774a780887c9189b4ae580ef39de09fd023ff93e8e07613
MD5 d3a682ad02a5b2ce1c98aedeca8bd7e0
SHA1 86a64848b3cb983821b511d17b7d6739fa238f43
SHA512 20ca08265c007bb6a042765b9c3f73ce2001a22cdaeff7bf20a559947f4f9a69f74c8486540b5c8e0ed4c3b07d0ea2d41f6d85a59accab35dfd991c3c0a1c5e1
SSDEEP 786432:E5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S+:J
TLSH
T14B473A18FBD71161F97756B08CEBD2FB5D307E2087318AEFE605D60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 15eb1f311acf87eb6bf344a15b2cbd0ef8bcbe9ae9cced090e4c5f2e39dad2f8
MD5 210527c24eb5f2ec9b4706b2e2c5f0a3
SHA1 c553580cde612071d17951400a9bafe2fa99d670
SHA512 c4f2958b9293c99555d1f52505c0595b151d693dac774f4e77ebbfdcb8aa3e0d0c9898b736ccfaf279fadfe830f398f20c8244caaee02cb76d3a4e42c0db8899
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 38ffc64abf2f7d49e23bd2a7e5f1928637f35abe51c9e355512f98de61bb766a
MD5 95ce7b28c16dd07fda6a24e350f0b6d0
SHA1 f589045516a8d402ef16af0bdac08a8b998b440c
SHA512 cab30f549044474b26e93888bbb0f4d6f972c68c89eb075b34df401f9b10facc7ffe22b27c05e29879217e6b81c02986f5af561d7fe63669da68fbec2d0b1f70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 e2396d6244396a355fd22db2f1452ae31d7495408c588be155f0beff49464ee4
MD5 af7313071d0a9a92bbfc3a89d0f9535a
SHA1 a3844e8ecb3967b69e6d1ec77f7246194750bcb3
SHA512 da22564d1cd56c392a7179357137722d971839b6532399d9fca290e3c2bbef86d2b8a020af999aef591c135e472783006071022ead4cd13b2ba2a3347d9ecb4d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 8a00d60137868e28f6a897f4d1e5da0041e95ff05f9f81d54786d297d10ffb56
MD5 86aa9bb2978e639f417cee0e5d36a744
SHA1 af9879c6711f507e90c9b3ff55c83e0f1d355502
SHA512 d3ea1a01596e260ab30e1c519dc363afc774901f4a23091af0b4ee2b43f14aaed7dc6787f4350031aa35000f4e37c84980c737f7160e00c07294ad2ff1c1d012
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 734e51224f6b2339e8fdae68747ed1b1c4b3c18b75befb6cf97ba0eb4e8f00b4
MD5 c65d96affedec9628a0922f1d9915cc0
SHA1 30ee97ab2138a62401f2cf87653e916a6ac63380
SHA512 51a0247da13866d65fcf067f3779220245919f1236c84b3e1853ac8007f92b58b5055801b39af9db305cae752531bfdba0feaf59a9dbad610f025554ef9ecaa4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\qap`g`v~dtlq
Size 10B
SHA256 c322a4af5dabafaa7b3959e1bacf70ab7563f87d3f498bb2c4cafc28cb9e84fd
MD5 92c0faf12801c0fdc0fcd41220c89135
SHA1 cf6c6f8365ff1d77ecb08dab956c634452fc0352
SHA512 f3f835d4e9fbb6c92e8a878871cba69cde129e3e38e1487b4a117e2e6f5b21291f238e86541f146ddd71dba51ac53a282357c35f57a04af5434d1b3b917bb5e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\qap`g`v~dtlq
Size 10B
SHA256 96734ad8513323447de654b8a266a6e6b055801ae2b5a74d35ce565c3367ca8a
MD5 ecf76169b18fb2a51676b3d738d2aebb
SHA1 e4fd7057ee1b76fe203756a9abebb983aa65d503
SHA512 6f1aee899a9fee97169944843c50140d16fe0ae5d0e06abdc7ee6afb65843f9b3e77f9363e18ea5cb6f5be284b38af6a24cd0038fbe13fcea21ed06d8221d143
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ne-NP\qap`g`v~dtlq
Size 10B
SHA256 e16bc0effd7fa28a169fa3a96dbf934d5ad651bc12901ff2f65391410f623e04
MD5 21fffdfa6fe3515c50af145058ff254b
SHA1 763182c1900b0d47dad621e0e129bb8f8e0657b6
SHA512 c44ff98781f6b62dce4b280ea9884dca7496b4160f36b056cc3491ee6b266c134c18e1a38603dcea58ecac89716f0f1f1bd6616eac3f88ce4a343923dd78125d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 72a7b5f72be88cc50ab7ca577be975372d95715224f051393b0709bb0a2afa07
MD5 83fc7e3db4ded31434fb7ddaaf7f51c0
SHA1 ee854a223f3aa0d2c83af7c77514902d1495fe8f
SHA512 0b34693d08b57a297650874f2f6a84dd151a77434c3c09ded6ad69acecba73ad10c2c9ac168ea2f672398cbfb05a87955568ffe0d2d9fe155a48296e6ba53ad5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a24bcb7c82f35302ea88eb399b118d14c810df7340bc594ac40200bcdbdc8048
MD5 c3c2421d6f22287b77963a700a08a3c4
SHA1 e3f287c6b659e478e3ee4d5dbae9afcfcc286a8d
SHA512 01e249eb936bf0f0c581554d6a7731f17dec27fa81d204fc4de97a7e080441823b251d714b6db0cf7cc70acdad1e8c98a941aee9001f2b23e2c6419044196d97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1e60bb8711f85dc68c453770bef0dcb0965467aa33a5bbd8047803b3c71f629
MD5 4e954f6783b4e009ce131e816bbff350
SHA1 8208d476e078b2edc01e34db1ff2f2571c36bbc1
SHA512 6e1e506ddd279256c8d143e1babdba8bfeefcfcf23dbad7ec651d6866a8d90f0f0054b7d96e85ef7308114508406d4ce20fae0291bf9ff3aee4223a512d5162f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3187b1c76a1bb7d4abebe4e663224c2a0c11dd276e7d329671e663d1903c428
MD5 a474b94f1ccb0a9290921a941671f161
SHA1 b1c7b3f7bb3d377145cd1351a68b26474dff69ac
SHA512 4efcac57f9f2e86159e078cd3592e5b0a21ad0d7bf3af2d965080e8607b69f04336d9fee1b8b94b9b971a0dad7331aa67d9bd21f0e15c2604c91374c4b417125
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae380b2e3a1f50a27ed7807d617518131753ab67b4cdc11039f8d77dd1c8d722
MD5 69d035a213112f2475c053a5dbd3ff69
SHA1 beb9b6cd15eafcaa5432d5465ead90f6b0b0b096
SHA512 149e5c907e543318a247548cc786468817545a0e1733806ded79ec56ea0a83fa3b252e098baf7c78548e4a15aa8c1863fb0437972b2aeedd670f7b25feee9505
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6386fb99de4f45bc598c18f8f2777520855e7817bf47bcd2ea647978c517dae
MD5 753f3dd5a31708b37c1807f47e2635df
SHA1 90b81d3a88a00eb6d5acfe9d57aa1eee8bdca744
SHA512 e0159a8a06a23d1a889876c9cf56b359fb0da174a93902658d0d85c1222470a69f4060e0b36f2805d9daf47e6ab799dd5f7af4cf406c171e1f9486e73d95750a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a78fbeb50661a02502dc897871418128d3c700467099ed85a79cf6811c85f08f
MD5 4d679d5cf93948aebe5073a7c5d5102e
SHA1 d8188b0afa86f69a533e7b6f675a07a95619dc72
SHA512 b91eeb4d2dbf6e113415c5ef631be7d06d01c0e4f0203a6a0d84a3520a91d3734e63b7d15dc35abfec3d9d76c66e27031223d84dc8d616b2b06fbaf65f81dde4
MD5 SHA1 SHA512

Submit Download

svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAABACAACCCBACCABABACCCAAABABBACCCACBAACCBCACBAAAAACAC.exe
Size 24.1MB
SHA256 c9ec461c359ab742b134651ce6fdea2b5d6221ac4a361287aeb11c9590ca81e3
MD5 c7fa72137cd0b95a8d77a091d64a2425
SHA1 83f399fa4eeb3f440a9182c5fa20844297c4c6e0
SHA512 212401574b5b4f6969673aa24178f7545aa23f089c42b4f6dbb85f19fb5a77365ecff1898c1deeaee89ac4cb47b3833984554528b0e913e762800f4aab755c5b
SSDEEP 786432:E5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S5F5B525S1:Y
TLSH
T190472A18FBD71161F97756B08CEBD2FB5D307E2087318AEFE605D60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 80450fe9f825e58f8caf8b4e16cf8275c8be66e6aa94fb79436db661501c8e7c
MD5 dec430d9ec6570e93d49c8936bc36895
SHA1 3f005f4526931942a2ec793b8e55fe399a2dbe30
SHA512 3e0efab59cbdbbd824c90e5cf0fe02c81786597049a9d682d00bd07eeeb6d8e4d62c138202d78728e29f18495f16633863e347756406585c9e8dd720e3145018
TLSH
T19521D46594E6CC73EC7268CBFA1AAB930D94366F586C6A14230E9318BF5DC31CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 9dec8375eb47373eb442150bd0315ebca8aa64824bfbdcce0f41934ebed983b4
MD5 60348be0aef9106f29d05d0c3e4d1ce1
SHA1 f4581870aa37f34f866b740d57d0632629a5c8d2
SHA512 36f125adcb24f96a41bdafbe160e60e4e66b7dcef9240db8487cfa4ffea8e1db35ea08940852bf5525721678e3cdded711fb4a5ee8fc558b20011af8fdac4fb9
TLSH
T1D1210765A4E6CC73E972A8CBBA29EBA30D94376F985C5A00230D9318BF9DC31CD154F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f6867b9e3cafafb763a10c3502683ed6663db4e59a39b6eca26e58a53dafea17
MD5 db5dfd270fc29dacdfe8f13e39fc8887
SHA1 d7da35d39603d375811079bf60f155e0bda52a42
SHA512 ee0b993b4836806e97505aa32ac919fc2c912c6e4291357a72652a245cd8115e4400ede55ff45a243fce047a140f1313605c02edd353823b0283ccb2e9416f08
TLSH
T14D11012494E6CC73E97228CBEA2AAB930DD4366F186C6A1423099318BB9DC31CD154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/348-33-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/2080-67-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/2080-3863-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/2728-1247-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/4740-6-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download