8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Size 9.8MB
Sample260818-dec4hsfa83
SHA256 8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932
MD5 bbf5013e8e88d4c7d74a34283d5b688c
SHA1 aeae69a629c8cd78c36c41fe3dc61f099f32358c
SHA512 28fedebb2687fd5c799ae1c24fa7d42d0449ef83a528c955497e7456ec87dc56de8ddab404304047bb890c0413f8077aa12901bfefe9bf838f250c29a130d7fc
SSDEEP 49152:U+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOd:QUUgUUgUUgUUgUUgUUgUUgUUZ
TLSH
T107A64A0C72EA00E8E5B39634C9668266C972B8315731DADF62D4C17E9E33BD5B934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
2608	svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe
4508	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACBBBBBAABACABBABCAACCBCAAAAAAAACCACAABBABBBCBACCACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe"	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBAACBBBCBCAACBCBCBACAAAAABCABBABBBCAABAACCCCCAACBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe"	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3772	sc.exe
4804	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2896	cmd.exe
4748	cmd.exe
1764	cmd.exe
2580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1328	schtasks.exe
2292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
4508	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
4508	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
2608	svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe
2608	svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
Token: SeDebugPrivilege	4508	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
Token: SeDebugPrivilege	2608	svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2896	8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	92
PID 2896 wrote to memory of 1328	2896	cmd.exe	94
PID 2908 wrote to memory of 1660	2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe	95
PID 8 wrote to memory of 4748	8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	98
PID 4748 wrote to memory of 4804	4748	cmd.exe	100
PID 8 wrote to memory of 1764	8	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	101
PID 1764 wrote to memory of 3772	1764	cmd.exe	103
PID 2908 wrote to memory of 2580	2908	svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe	106
PID 2580 wrote to memory of 2292	2580	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCABCAACBABCBCCBCAAABCBCBCBBCCCBABCCCBCBBBCAAACCBAAAACABAABCCBCBAABBCBBACBAABCCBBBABBAAACBAACCBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACABCABCAACBABCBCCBCAAABCBCBCBBCCCBABCCCBCBBBCAAACCBAAAACABAABCCBCBAABBCBBACBAABCCBBBABBAAACBAACCBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe" start= auto displayName= "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe" start= auto displayName= "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAAAABACACCACBCCBCCAACCBCBCAABCAABCBACACACBBBBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCACABCBCCCCBBBCBBCACCBBCABAAAAAACACABBBAABAAAACBCBCCBCBCBCAACBBBBCACCAABBACCCCBAABBACBBACBBABBACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCACABCBCCCCBBBCBBCACCBBCABAAAAAACACABBBAABAAAACBCBCCBCBCBCAACBBBBCACCAABBACCCCBAABBACBBACBBABBACBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCAABBBBCBCCABACBBBBABCBBABAACBAABCBBCBCCCCACCCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 023bd0f62a448f649f39f398a0e003f6ac2779e2ab1ded79d721ba74d065a225
MD5 b08b73c9e8066beecb4ef364efd34c07
SHA1 dc5550259521867aa0cd4c0a3098490c1f47c84e
SHA512 9979ae6555460a729669eb63124bbde0e1940e10be1d501cb630a2db9c8e6d9a866fb2307faf852367ae2ea7d22b44c903c6d3dc1dace2cb458394fdede16242
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Network\Downloader\qap`g`v~dtlq
Size 10B
SHA256 c02ee6252aba78734b736691c897b37429f528d9af8864ed87022147d511908d
MD5 1825b8e59ceb82d741d179e094fb248d
SHA1 bc24e43b9359ba19da8409cde99e44606ca27c7b
SHA512 d9af2c37f7f08bf21d2f063e966bb9ae1c982d739e7ab8f17e1ecfc044e2e9664aa0f8817a0b428ea78784fd56871fd5763d35df1613eecf69b1cf858d782eac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\UEV\Templates\qap`g`v~dtlq
Size 10B
SHA256 344e43bdcf3d827c25fc2637bb5e16e8403294a7c006cc3a9a2bd95f4b0de67b
MD5 c51b2c3e4999b100326d000106526688
SHA1 f5dda104c551e24da8316965654a08902feca9ea
SHA512 4e2521c4020f8b22103a173f43a00fe6f28511ac67ef7faf333dfe781658cddeaec2a56c959f2ea57e0f872dcb05cd98ae51b8a3ee79fa6c5bbd9b096e9555b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\User Account Pictures\qap`g`v~dtlq
Size 10B
SHA256 e1e7f6a1e8dc139ccb8209a4f8056d425de2624b75a1259acfc18104a13f64a5
MD5 65501d9c82dd054b75d6ce91bdeed87c
SHA1 0e9dc806c9f744cacff5478ed6f188fecf64486f
SHA512 c3843952968e37a337df73c5d6452e850979c6d1cdab18b09850b1dcf1c02b43313b69725a6da74484faf831ed1ffd06b5d40ce94a7c378bf586f72db315149a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\qap`g`v~dtlq
Size 10B
SHA256 db32bb5b30fc79a91db60c1e86d4795d4a601aac89483a09d665b49cf5386afc
MD5 d4703d24a491603284500f3d1d70aaf2
SHA1 fdc5c34d7fb8098f1a982b02671c5353be8ee7ae
SHA512 7cd01f773ddfdc8fda33b26a806ff2355fddea7c1e4a75a7116095a7904f7b00b1e354e0571d4d2733a50d372555ff6d0c6d3dfb9c090f862d0a3ceddcd6cb1d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.3MB
SHA256 d4c952f44db9d61892628f0c4ccbf0e0ce144db72d4712a0e33993943bec486b
MD5 ab806c5e0630b4120b1467a92dacbbe5
SHA1 5205d3150f40078bebbd4cd1c6be7e97c5036452
SHA512 6b56e1ae1f2c93f6423fc4d85cb1025ce4cea7002c085e3fb28df8f12462fb71bf163c4eb8a0504ff978de87663458b51e7c612fbd9d8df7ff9f62017c036257
SSDEEP 98304:QUUgUUgUUgUUgUUgUUgUUgUU4gZ2Hb9t+2x7:wgZ2j7
TLSH
T1C7B64B0C72EA00E8E5B35634C9668276C972B8315731DADFA2D4C17E9E33AD5B934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 af3fabf54c351aee2b9e8b81efe7b7ed015494c2b8643565463478c49e925706
MD5 cf664e3c6c56500b379363e1af7d70d6
SHA1 acdeed180cca2bdb50651cb999355c66ab46ffc0
SHA512 54b228bd9f20b1f58b6982fb31d5acba4a4a1a65173aeb6aa2c334447d784814a60670c194c248e7c908de1fcf6110f35f382d5952032b44cf844a766629ec8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 403e5b14df7f80fbc0fafb04585ee054e1dd1ec68c438d677c121ac4cfae81f4
MD5 beb2add4471c661d45e5de796f0f8b0d
SHA1 7a11c968f8e4abf439bc6991ec55daa87d2af7cf
SHA512 a57f7d00672eeb0f58a2ab0ba353d1044fe08551648123d0c077d07fa61406505be95b3cf16400585b67a36dd7c5bf2885f660ae025d5a878334283b218e82ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 e4ce936b99724daf7e30ec79910e41a3b9bd48e0a88dd6f604df692fdda7e386
MD5 e1f6395a31bd78c0c721b5f142f80aab
SHA1 5772bfcc232e5c3b44fd0459dd91e3ce3880d291
SHA512 bf36b74d22ad70d3ea88705d9fdebd7283a105cd944ebabf0d0ed42d999098d1d2d95f25b42b8a80cdeea218ccb11cafff702421fceb0b5cd63505326b4911d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\GameDVR\GameMRU\qap`g`v~dtlq
Size 10B
SHA256 d87c35ed074122ec0326b4bbb148973378eb507633400d208c53b61af0677ab6
MD5 e54d2cc6223471100e1e75addaaeaac0
SHA1 2012ac79179b8bc3797be9831cbff4deb6feb51d
SHA512 3a50bbcc2fa8bacf6459841f689c9177c036d1d7d2ff415cd6a72cc1ddb4387e5fe74e8f07ad87bc7cb595064f434e09a0f35bf7f3b3ce42a0a93b25a4dbd686
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\eu\qap`g`v~dtlq
Size 10B
SHA256 bc1de3f48d869fb969961fe8b9da7312ab11ab92ba6565f44bee0c557511cfe4
MD5 68db5b1cafec589c0895a775d56b16af
SHA1 3956bec7822c13d3f3d9807e7e4b840647af616a
SHA512 63529431c23c9bf7fef98878ba8242dc45a18eb8a772bf185c67fd9cacf935a4341caf014d83cfccd6f1ca96caae79574a6f0c68c02268e1e711a85945039d30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 46fb8cb40ce5850935e43aa329594dce55637562d8ff1ae1dfe283bb934eabf2
MD5 c277cb2bf08a74acdad157277b182e17
SHA1 b71dcf0567859e2a07c8443621b1fb4055880ff2
SHA512 1cbad76a6b3d0f38fc19b9e3a7f48f58c1fcfc18dfd75a9eb62a51209c3fce2a17cc683b918e52444bdfe448c8dbdd5c6ac46f61c92a63fa8ca8b18f3f643087
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\qap`g`v~dtlq
Size 10B
SHA256 3693f0c3b4e79eaaf5ca6bb876ee4019ab4c70547ad779d1ac614a83fcab2426
MD5 81e6f7d8b5586f937395f95e313c4b8c
SHA1 9c01e0a5aafcaac43cc13d29c47c43209340adb5
SHA512 b1aac5475a4cac1815178e5488802438118abc952d8c436b32b9f247c2577b6e0127f96203167b0e06673e5d12a1031dd200544f2281a8e4b428becca701302f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\qap`g`v~dtlq
Size 10B
SHA256 a53f9f019501f7a9f2c853a9918cd673f3353a37596ade44d6c434b83bc51060
MD5 964c4d132a9fcb1bf2872f6a7e6e320b
SHA1 00cc3ada18432bc26e0e2ac0ab69ceb4a5eb0ab4
SHA512 7f48c4f17f3727fe67728382259d6873610c1fb0102b997cc7c65b9b2112dfba0dbdbc87a06fbb6b98794927cf40f1428f6c3455cf90abe0640b038f87f931a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\qap`g`v~dtlq
Size 10B
SHA256 9f785d4d6cd86ab4bc8cdedfa9ec2b4f02d54efdee3eb37a4626d8d6d5a48de2
MD5 9c6cfd57648a1f90d1b2bb0c41b66939
SHA1 9978e70b2cf83de673840e67727869574d072121
SHA512 125c6b723e1eff5e069fd9df453e7a09842b188187ab975d1aaea2265073e2a2262ee4bbd797d259f21a04d53cf527146da04a46b338a9c6a15d4c5464e20258
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7290dfc2cf274866d3567e48e31ce1901ba8b869c761f5de890340f8e15784d8
MD5 c85b1ac8b454ec3b02422f582240fddc
SHA1 3218cd86a34dbc9fc384bef271d1edd5cf1b15bd
SHA512 8a9f66de8f0e54af75c2dc0f139101aafd2e8ac429878c64b8a6f6734683b3b78ee2f45e036e0c9a175ff16e47bdd9358af39d31b3c89bbd2e69c056f6d92a2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20d9f638aa53b255fac8c83e12a9a571f32ca819150040353ea9acfe2beaa457
MD5 2ca02744fcce8a4f18e2b3d21b67a0e8
SHA1 347bc904d12f6a9383fc96a9c5a0a4fd089f24af
SHA512 8afbb471fd15608bdbc9df06750b772754c3a851a2bd623b6f25aaf6df75c1173192098e8f7a211c62102438e0407ec1e0666f054a9c7cafde4b03c53670ae79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68735200af30ecd27d710cf8a8279dabd898bfc344141cb53538a3dcea7dd2af
MD5 314195727b55d7f16189c5c41a2ae83f
SHA1 1dcc50b5e7c8108dd8109348783cf3177314c560
SHA512 ec8de316ae0e69383084574980e1c7cb7ffa0369569063d71511f01b944dfe724f9042037206e8d70efc574fc57683a928fb6e1f3742dc3d0fd1e80de7e8cb16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c091903afb34c97967bc8bb81aa88ef3c3949409de10b00e8599f4c3356e3b43
MD5 7b37a35543279894b5a02bac45698d69
SHA1 7b40db17e5ef6ceca84469f7255a2912c14204eb
SHA512 282c3f380ce9fa6a27f4510f8d85bc7d58365455d28a1df8eb595c467b2d36917933f5e54e8e11ccea402702e4adc200b79a376a1b68de8690865134cbd28aba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a63a145bdf98b8def2168e1122ad5513952e4ec10d6ae9c59875616f9d44fdc5
MD5 63d269c932425ae5a775a89c02162833
SHA1 a3c985f162a435d21b97aecc95b29d491b8005fc
SHA512 0b8e68e9fc467ce0de7549b9634ac934b5f7907c694184fc081f3d2c1feb24a8c57a354ce66609174186f19dccd730b1804b6e0018f5b46d38284a9b8c031e42
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 389ff1d10f017cc82e7b480c2f0b4777e42e6468bad3f8789c7ca389d63c3fc6
MD5 aff538c0039784b20a78623b7f9ba222
SHA1 20790c357d42e559b2e09bc413d4f8cb22da5356
SHA512 ee33db08ccba4d357f62436d610accf6d944846aaa6cf03e61c54afc0759fdaea4b64d9f787af99b4b33a56f332dc4a2f0c0a25c6df2ec4de47e620055d5d450
MD5 SHA1 SHA512

Submit Download

svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACABCBBBBACAAAABABCABBCABAACABABBCCACBBABAABBBBBACCCBB.exe
Size 9.8MB
SHA256 8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932
MD5 bbf5013e8e88d4c7d74a34283d5b688c
SHA1 aeae69a629c8cd78c36c41fe3dc61f099f32358c
SHA512 28fedebb2687fd5c799ae1c24fa7d42d0449ef83a528c955497e7456ec87dc56de8ddab404304047bb890c0413f8077aa12901bfefe9bf838f250c29a130d7fc
SSDEEP 49152:U+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOd:QUUgUUgUUgUUgUUgUUgUUgUUZ
TLSH
T107A64A0C72EA00E8E5B39634C9668266C972B8315731DADF62D4C17E9E33BD5B934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 47375d427e1cd30af0aefea790da6636e5aa11157587cc3ffcc34e63eb851799
MD5 335f2c4cb5ea7f5182049b67cbefb92d
SHA1 4a7528a224bbafe47355c331bf4a81765c86cfa7
SHA512 b0e48f589b640c775e781010aabb908a35b57262c0a2e10c1ae899dedffbc2c264986d928fbd182276d640151bf05ac386bd1bc8f64e46f1dc3e52a0c0524caf
TLSH
T1DA11D571E4E7C897E932A4CA562DEFD24CA833979C9C6A0553094218AFD5C32CE594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 19f0f7fcaf16d6c08e37bd068f7522820c6f608acb849e90475b7ab56c7d4a0b
MD5 48ddcaa9c5718bae4cb7d22ebdb97726
SHA1 a39700b7451fb434c04985021c27b77f2758c043
SHA512 43c5ec0ec8ecfe3b8229ebc713700ee2e9ce970405bc86daad63103451882f764d27be36aa0c0ddfc899c2cf74478883050582e8f43e2ae6c982efca1dc09367
TLSH
T12B21F970E4E7C897E932A4CB562DEFD24CA8339B9C9C7A0413094218AFD5C32CE594E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d584fe8159074c842b6a55c0693285d7da4b70a4eea61aa6b8c3fce5e3893708
MD5 dcc163301b9466c1444c7278982bba30
SHA1 849c45dd98f225cc177017b46552af1a1f5329bc
SHA512 61920a0fd97fa20228214bfda20758c0c4339baf7498a52e85ed086d4ccfbd9cad1b86aec9a8d1cc9e4e8a298efebe4ac98690bf4c08c4f8d20e10a7fec9105c
TLSH
T1F9113A60D4E7C893E931648B522DEFC34CEC33AB6C9C7A0523054218AFD9C32CE590E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 b952620dec9193437f1eb67dd2a9ce7cc5c393c036cf0b5139a92e0520140b1c
MD5 05edb79a2e8449333641fd40298cc699
SHA1 4e1d27bc489a88ea840594a6789808b1275a0c54
SHA512 66b0fce473f633c24605f60f34208add3155f1b407724ad81061f163e689eccf68854578a489853e5885084d6132e5d633e9bd9b504ee38c989633db53f67f31
MD5 SHA1 SHA512

Submit Download

memory/8-6-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/2608-68-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2608-3476-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/2908-32-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/4508-3783-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/4508-866-0x0000000000650000-0x0000000000671000-memory.dmp

Download