0780b554ebab4bc96aa742e0e6276078a64ed90d3ca80ee5c17e83a77ef5e829

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
Size 23.9MB
Sample260818-d1ppfavfre
SHA256 0780b554ebab4bc96aa742e0e6276078a64ed90d3ca80ee5c17e83a77ef5e829
MD5 40f6e28b71fe3fd3a12d9da498bb0fe3
SHA1 f398c31184273cea3f2a8d69ca919644006a7d9e
SHA512 61833e2fe463a0ce2a94b8cf294ec0635af56232580366aa9cdb4286aac28e5352ca21580f58f93b671f0461586b874fdcfc6e8407af8544181c147517454ff8
SSDEEP 98304:irgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2N:i
TLSH
T10C47380F66EC00A6D87F8275E6D58166C670B031672159EFA190CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
4760	svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
1976	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCABBABCBBBBBABCBACACBBCBBBCABABACBBBBCCBBBBBACBBCABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe"	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAABABBACBACABBBCACCABBCACBAAACCAABCCCABACCABCACCBCCCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe"	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4236	sc.exe
2696	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
844	cmd.exe
3912	cmd.exe
996	cmd.exe
3336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2884	schtasks.exe
3296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
4760	svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
4760	svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
1976	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
1976	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
Token: SeDebugPrivilege	4760	svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
Token: SeDebugPrivilege	1976	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4500	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3336	1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe	108
PID 3336 wrote to memory of 2884	3336	cmd.exe	110
PID 4684 wrote to memory of 3508	4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe	111
PID 3508 wrote to memory of 3476	3508	notepad.exe	112
PID 1104 wrote to memory of 844	1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe	116
PID 844 wrote to memory of 4236	844	cmd.exe	118
PID 1104 wrote to memory of 3912	1104	2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe	119
PID 3912 wrote to memory of 2696	3912	cmd.exe	121
PID 4684 wrote to memory of 996	4684	svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_40f6e28b71fe3fd3a12d9da498bb0fe3_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBAABCAABCAABBCBAABBCABBBBABAABBACAABACAAACCCBCCABAABBACCCACBBCCACACCACABCBACCBABBABABCCABABBCAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBAABCAABCAABBCBAABBCABBBBABAABBACAABACAAACCCBCCABAABBACCCACBBCCACACCACABCBACCBABBABABCCABABBCAAAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe" start= auto displayName= "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe" start= auto displayName= "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBAABCABBCCCAACABABCABBCCCBACACCABAAAABBAACBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBCBCCCABAACACCCAACBBCCBABBAACCCACACCACBCBCBAABBACAABBBCACCACCCBBBCCACACCBCCBBCABBCAACBBBBAACCCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBCBCCCABAACACCCAACBBCCBABBAACCCACACCACBCBCBAABBACAABBBCACCACCCBBBCCACACCBCCBBCABBCAACBBBBAACCCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCAABCCCABCBABCCCCBABABABAABCCBBCCAABBCBCBABCBBBACCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 5761303d9f758b5eced1b9d9209ca07331a4880ddb92522f5b633169404172aa
MD5 a20a937f7b1e39b659502d5a5c1726ed
SHA1 974c0d3e78147fc93ac6e2b1f5c5b8af40d9cd2c
SHA512 847dab2c97905d25fdf89aa5fb90b5b2d592fd279f20c252968d386ea08354bcd7850a238252d3be90cc2e185c1c0af8c3d10870e9928e1d32b36ea00b9a8d9b
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 24.4MB
SHA256 eaebade807f7eb21ec7eb44d30ccff27404c1a221052f2b314093f737d3cc341
MD5 736c79be41422897b744166aa1f937f4
SHA1 826100484e5638d192180a99d9d4e617148eeaf8
SHA512 c16fb9f9d6476b5fa7630778c8c5eecc6e867f8d64ce82f6749d74ec726149d25d09518723f6431176610562894b13ca1a1fd5e36d335cbba8748a48fe7a1e8a
SSDEEP 98304:irgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2V:M
TLSH
T14147390F66EC00A6D87F8275E6D58166C670B431672159EFA190CB3D9F6FAD1A83CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\SystemKeys\qap`g`v~dtlq
Size 10B
SHA256 3c69dc062270610d8505a1d101dc941386589e6d9f38ba0268ccee7eddf372a4
MD5 1af4db1c4c92db1e9e029c7128e66dbf
SHA1 6d2f0d3b243b622ad4e19bcbd8e89281bcac60b2
SHA512 394e3722b694e4026905ec44bc75ee6589ecfe071360688602f0cb432df713c3344691620ba5be028844addefcf462d197a8e752d5cab96f256b3645406d95e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\qap`g`v~dtlq
Size 10B
SHA256 1773a61b6745147610a246ca21d3900d5f7d102885fe8b340cb9334b2900e1f4
MD5 2a07823b16e841a0e61c43b5da29ac0c
SHA1 810b872f54f1abf167292ea11e08960fefcfaa42
SHA512 cc629f7979d438feaf53744c6bea486a8c62613e22b14201c612396f4350b4a33cccba397fa1c9ab488e13f3ae7b4ae0d2564b092505ed3be80333218fdf976b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 eb345b4a36f1d676240ee1b8e1c8ba732a0bf5aac11253e29d5bc3c821da78d8
MD5 186f8e27c969e0b7ae2fe745c4f8f6cf
SHA1 4b5d5bc8c3b28c37114e40e4e07d2e53da2fb595
SHA512 9dceb597d110efdcb9434b87b408536b8f919ca4ad321f3de0a63c140891ded0c54add6b6adbb9c1066e72e84c7b9def74465a00b755071147995b18c9a2a1e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB\qap`g`v~dtlq
Size 10B
SHA256 7b70e3f06e39c536d667afe7c2e6ce17e7ec713b31968a9bc11a208b063c69f1
MD5 9483c721c2f321fe35a63d2c6feb0b31
SHA1 572ee53c97a9f76935605ba72e4582d88dcef031
SHA512 4a04bd57d901df0027a52eacff58594b80e9f12558cc755edf748f7ba0b8ac1735d3b90c087e8b9f50af4eaa00fdc619c123ce48ae2f5341d6e3a9f7261ca5d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 8884089e3fd32d0d13ffd416f94d925923ea0462de91db5db36363a5a27d8839
MD5 11ea49a0a946d70c42a00696d3217fc1
SHA1 727f4f6c65ee32a3ad3f4725147f6b536ce98663
SHA512 88739cca218cccb59f78022a5499dd5e4cc7fc740afc88985b4dd42becbe3df5a02766ec4d5d423fac438279563e1aa489751d62895fdf03d0630ec4bbdeba0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 8a126c82a34be51f29a94ca4a9aa3932eb3e9e16a0edb465122ddcf5dcb0032f
MD5 627dde58ebe2834dd95b59ea6395bb70
SHA1 d1c34ede09716123945da60ef7ecc944e7df937d
SHA512 41bc1cc3d662ea43c769e4f12a70a2112f4e1f30b0ecbb9e3a64ec879465f90866ff003870ee2c93fee13e5ba540210fef23f98609a342baa9f028fe9cac7892
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5a00f45e6598bf2c314b2814fd247c1539a82efff0b3e4579fefb0f334f4297
MD5 1d84ccf20225ccd09b4d4ef60c5c52e1
SHA1 6fc0a0ac312b1d6c4cc0b1bd0137b8dd685d6d6b
SHA512 bb200e36c4a8963f9b6ced3e38ed1590d16335f22aea2a4dcab570023802b879cc97c2a35e22dad8dececf245be4ce887183a6ba46c541cebf58238ee4ca2d1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 032a41fc19f3932df8822250975492369983e101549b9243ce36f9dacd76dea1
MD5 81fa9dec93b734bb5e84f08665f3e23c
SHA1 7b250f507288916aad00f8d968d34c595cbbb75b
SHA512 19e048b135e78a52f739ba999f4f44cd27dbb71dbb95261ec937595e899dfdd2c7fee7445b4bf8cbb270b0dcc8ce42c19859f90e49b12e512eb51223709f6f7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6370a7684fcd8bab3bfceb318d0fc76041de13315e0fcd9d9af4b3aa24623e2
MD5 6518f38056ad30627255a8123fa591dd
SHA1 35a189ed8a687d6ebbe7a295424482a4c9d673d0
SHA512 6be5d7a15a17658ec39acb6e48e05cd18c48a623aa874b9996a4550e8a88b1487cb9eda7e26ffa24b1ace69b4278e3a32ef7271df21029fc4094ada6ee3cf499
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5315939ae36efc3aa154240316b7dcaba1aad1d47d2fd9af31661b66bf5d9f85
MD5 d88d4dbad1e388e96c705a926ddcc3ed
SHA1 24dac18aa10b2538a19184e42c96730362aed0e3
SHA512 81027ec48298f479ea9fe1d7108fd22d2d82aeee45217fbba7573bc27d3b44dd1d307c1b232f49d6207c83ffb56b98acb08f04cda6c7865f6849d440fe519297
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 366e8324ee139eefe9b487508db880feacd4a836e99e6493d8b0cdbc9a93327b
MD5 4396e1c9b3474e49aab1caed38d388a4
SHA1 351a8ebdce6570eedcc50a410c8caeb3ee020d0c
SHA512 58e038704a7f278d471a4d434105cc19967353d74880390847aca0cf5d1377442ec6e52b543885c56d4cd37b0d3961c9b96ba3d218ceb228b2476f827743504a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 271671a46b18f88e7243a1abaab4bb48f7932aef511a91d845678b4408225f48
MD5 1c1fac2250e9c111a2be010b4bd12349
SHA1 495333aaaf1ad5498c4b9d36a8994685b652c203
SHA512 c211308776458f479cef638b3284ee0cb7f887cf7cd5b5f1f155e78e1711074b13b971d8e95d6bbf4714e0bfa98cafd00f0a6170fd40df3b49e851f6bda60e23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 05e377b7dcf9a9e0619ddb54a3cbdf21801b1b10789e458cd5986893b5c99c3e
MD5 04733a78158e86a1d671b2bc100eee9b
SHA1 7e814e8c1e87b5477bf1d54d48e33556bcaf94d6
SHA512 64f948eaa197bdc1cbc81ac9b50752476cf7c3866e972e32ab5542b441a9172f4a8c977e2c0a5d0c85572cf46da822013b7cacac76b62500e1af9163ebc07309
MD5 SHA1 SHA512

Submit Download

svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCBCABBBAAACBBCCABABCACCBCCBACAAAACCACCABBCBACAABACA.exe
Size 23.9MB
SHA256 0780b554ebab4bc96aa742e0e6276078a64ed90d3ca80ee5c17e83a77ef5e829
MD5 40f6e28b71fe3fd3a12d9da498bb0fe3
SHA1 f398c31184273cea3f2a8d69ca919644006a7d9e
SHA512 61833e2fe463a0ce2a94b8cf294ec0635af56232580366aa9cdb4286aac28e5352ca21580f58f93b671f0461586b874fdcfc6e8407af8544181c147517454ff8
SSDEEP 98304:irgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2crgryrgr2N:i
TLSH
T10C47380F66EC00A6D87F8275E6D58166C670B031672159EFA190CB3D9F6FAD1A83DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 75323f28be318ca324669e36c0af88125b434dcbd079c861d0d0e7d3cbda3fde
MD5 375f2e9030690e7ad7894fbb7cebdb53
SHA1 582e2fb4acb0e903357a20729b94727cba1a3181
SHA512 4a9fcef58a4845ec3daf077ff7b30aceceb2bb73d823d673a30f2ceee6e0663615b17c78c5394c39ca0b418fb66fb4cbbeac5c31171ad350661c2a3e6fe0d6c7
TLSH
T12321BC70E4F6C873F93369CB952DDA920C9437BBAC989A08130DD118AFD9C364D194D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 466c5484ac7d60ab008be5dbafbcd01b7c75f6d17723f9226466f688aceec43d
MD5 cc16f59e4adbc88bc499ddd330921439
SHA1 f66b1ee9f826a46ac3825c7b8a64481e6eb15856
SHA512 46aa9889629470a42d7f1808d38c945d19712c09c25cbaca643d427502d63438aeabad349bd990d5ecb9ba82d296bd121c682910834f803f684ad08274a0c49c
TLSH
T13A11EB70E4B6D873F833688BD629DA920CD027FB79589A18230E9219AFDDC394D150D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 970B
SHA256 94ab881371d0c480375cc5b98e5d72c2b374557eac7423f133ad62a54a5fa43d
MD5 ceab8a7c9b5fd3a97ae819d81b0afa4e
SHA1 8d4a79b6048458367772762325d44ea031170b7a
SHA512 6aee155f64d19ad4a649fa866b349b45e6b5c5c5fd76da281500944fedbe8e14437ce9233441b23dfb957be44e9c4c856d74e865ce4dd689d377856c95283440
TLSH
T125110B60E4B6D873F833698BD629DE920CD037BB79589A08230E9118AFDDC394D150D2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 938557fa72f43d8e2214649e153b0bef7c213c33069b519456158c20aa765c4d
MD5 c90753fcca62b2f3435176238f6d373a
SHA1 1fab139f0e39ab8af0b1ab6ba96cff52aae3cb40
SHA512 2cf20a7ed10554d16ab1d6c3be07bc6440a300de6545cc4ae88fe118d9ba62c8b9f13b685c4a75eef618c7c61f22bdf108dd72f1b497819b9af0a45a7a471215
MD5 SHA1 SHA512

Submit Download

memory/1104-0-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/1104-7-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/1976-1256-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/3508-59-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/4684-36-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4760-80-0x0000000000350000-0x0000000000371000-memory.dmp

Download