3984c50bc1161efe3c71e5833733f43dfa8b0e2eae47780143736427494e4d06

Analysis

max time kernel
151s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
Size 18.9MB
Sample260831-31csbafm91
SHA256 3984c50bc1161efe3c71e5833733f43dfa8b0e2eae47780143736427494e4d06
MD5 edb022fa2218448bb29c97711db6d7ef
SHA1 f0037c1950bc7d476b51f289236e73e7b39d202c
SHA512 39822c3020da65080f76de9a96a581045f7970923d52085a3eba9ebf09e2562a1e5d3112097162dc5572a76c4f3f7b35a7732ae89f3a07bca1cba991906ed74a
SSDEEP 49152:U+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+Ee:H
TLSH
T1C8174A09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F68DDB5B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
3312	svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
556	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBBCAAABABBABABBBBAAABACACBABBCBAACBABCCACBCBCCBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe"	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACCCCABBBBCACABBCBBACCCCBAAAABCAAACCBACCAACCCCABBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe"	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2460	sc.exe
4332	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2072	cmd.exe
1032	cmd.exe
5196	cmd.exe
5156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe
3044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
3312	svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
3312	svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
556	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
556	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
Token: SeDebugPrivilege	3312	svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
Token: SeDebugPrivilege	556	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 1032	3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe	92
PID 1032 wrote to memory of 2532	1032	cmd.exe	94
PID 52 wrote to memory of 2996	52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe	95
PID 3704 wrote to memory of 5196	3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe	98
PID 5196 wrote to memory of 2460	5196	cmd.exe	100
PID 3704 wrote to memory of 5156	3704	2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe	101
PID 5156 wrote to memory of 4332	5156	cmd.exe	103
PID 52 wrote to memory of 2072	52	svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe	106
PID 2072 wrote to memory of 3044	2072	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_edb022fa2218448bb29c97711db6d7ef_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCCCABCABCCCBCCBBCCCCCCCCBCBCCCBABABABCCBCACBACACAABCABACCBBBCCCAABAABCBCBCBBCACCCCAAACACBBACBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABBBCCCABCABCCCBCCBBCCCCCCCCBCBCCCBABABABCCBCACBACACAABCABACCBBBCCCAABAABCBCBCBBCACCCCAAACACBBACBABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe" start= auto displayName= "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe" start= auto displayName= "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCBABCCBBCCBACABBBACCCBCBACBCCBBCAABCBBCCACAACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBBCCACBBACAABABCBAACCCAACCCBBBAAABBAAABBCCABBBABCBAABABCCCBCCBBBCAAAABBBCAAAAAABAABACBACBBCBBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBBCCACBBACAABABCBAACCCAACCCBBBAAABBAAABBCCABBBABCBAABABCCCBCCBBBCAAAABBBCAAAAAABAABACBACBBCBBCBBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABABCACABBBABCAABBACACCABBBBACBABCCACBACACAABCAAABBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 871da57a451613321a58001d876ae6c1c7104e39749e4fdd88ad775bbdc3a781
MD5 2c9b8206c5b4aeee8fd974f98fc6a51b
SHA1 7d91fac279f03b95d25598e8c517f49e7fa2193e
SHA512 5d9c7b4c4196f3102c1d54b84afce17351ef8005020e7b47fb0e6f1d62212b5f64c352476c270d47557b1dbd9eabe61d4a52a85ac22c59c07413219adb9548f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 3a7dfaf44c660f8de4c8e7a3413f97328778342b7063861fce7c19a1c5030cc4
MD5 fa43a7278c46e407f76cda053cfaff32
SHA1 395bda6e325bb5a4d8037e79ea1656876d7fc6c2
SHA512 e42bdb5dd000848f274f17f31c6347fbf2fba30a75e55606310151477c815823e3b97120fedf57eb8ae27263b15100beced01031c8aa54792e16cd150ce58943
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\qap`g`v~dtlq
Size 10B
SHA256 da2b8a5cc726d256e3d7e5c0569b1ea273e6e24157ac2dab3fe71ba5369d3cdc
MD5 f93163ca73add775f4e3cda910854cd1
SHA1 14b6ae686e3327f8db2ddf6cf24bfd1396612ca5
SHA512 89396595c4aa58883b1505b3222935e25d1f03da82e101b7aaca518c721c0ab3bb0931d46cbf4ded3efaa8843c370acde50f4d0ea08a2890f5b48707e32fb1f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 36d4210079280274ef43750d1d022b773288ae5f248e9dc09fe2afb09ec98ccd
MD5 6a01d49be4148955e3a64831f62652c2
SHA1 bf391a62d2340a0ba31f1b86a9f68be8bcb6d5a9
SHA512 2d96260fe8dc79e046a580bea06cd871d862b79693b17d01da31b063611fc1423b01fef99a59ffc6cd3d54a08139b0a5922b1b34be461b1beed85da40b0d9da2
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.5MB
SHA256 cc134b4ecb3b6d767ec92134c31ae89d615a0fb5d48cd5a394eb0132220aac37
MD5 6e18a3c3bc04b8f3ad1aa672ee675e06
SHA1 fdb15ab724a6af9eea55589cb654513f58608c66
SHA512 ef2e17a544395a73fde8937477e1044a030892f7f9f85bcfb175bebf66c8a33f957196d72e51affd59f551acef3a8014e4c89a238558b998750b5d17e3dd8f3b
SSDEEP 49152:U+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+EG:6gZ2Hb9t+2xc
TLSH
T156274B09F94340B1D92B10B04DCBD2BF8A60BF2587128DE7F68DDB5B7A33BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 d60920c9d7d6ba57c840b4ff0d0fa9bae5495f69d68cf7cc681f93196585c529
MD5 aea3cf3c71004b5bcc1864786e301aa4
SHA1 1e890095eeaf8a254ef501cd01644e86bc16b6ff
SHA512 99af05d64a0f256165789108a72b8baaee05cec37dad09c4c386a18c9cce7ae2e072a66d9c4d1eac64b6bc471ca6bb8661dc34b787ee259b5135c5ddb935cf43
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 ea5d90d15518d6fe0f2abfc51e197964491329b7fb8394505a524d11fe296381
MD5 c69bd01639416ce0361adc1e3756e1f6
SHA1 cd86e50dec70830262415891d399fc2fc78c37a3
SHA512 8e0f53ec5745e9fa39a33b379c63e84db3afdc8a118ccea6e7d9654a4ddd26e3cc1b6b41c84c5587a4b8a63868e6cd4ac950466f5ad349eb4fdff55801bd1854
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ed6df747-e2fb-4fce-9ff6-71224a9171e0\index-dir\qap`g`v~dtlq
Size 10B
SHA256 c4278267c0ddc0591aeb1ad1a02e1c8045358539cd9e36efa76f63252c0ebeb6
MD5 3574060b6bd6f432f22b5d19de228d24
SHA1 34b920f600625a79cb3598e48d0883619e4748b2
SHA512 6f978516fdbb3c380b8362c94d1735e52ec3512f8df58d814f779f2b6bb223f997759c07ed6d42dd4aaee40d4b9e5a4f0c6e6cb38adbdf8485571efb290cbd11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 0986fec81823331f22286dcbe69e20ab4f4f1aa9585774c9fecd685885436cb7
MD5 0443a1ff746d8d36f02301c1c1f401e3
SHA1 aadff321aa2fdceadf9f0612c283cbd07b711fbe
SHA512 ffc4b48ad5dcb854ba8c35309fd67b0931ab6c4204fa1c5e561926492b520116b7484307d2a21b871046667ac93d4dbcd00cb1cafe38caf36b3de377726dd8b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\qap`g`v~dtlq
Size 10B
SHA256 b5823edd5ee1285dc8372028da821c2dff2963ffacdfc24f120be17214f3b82e
MD5 8e2b75573d4107f7ba47bc779bf811e7
SHA1 6e5f6350a3b41c4422ad8b85af53b3f0a528cf9c
SHA512 7e2e6a9a243d61f678a74bbf28b01a5c161ac0ae2268638a0dbce40c342b37d785f38c04a382bee402164ae63727c2f9d5693eb0e25dcdaf6efe3b1f6b25b257
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a90dcec344867e68c0d479f63b3f38dddefb07f85b1762723d00ca1e1fa39ae
MD5 e26a9705e41121bf62644ddf9776ce53
SHA1 1dca525311eba47797d29ab9e074afe8b591f740
SHA512 5b04f93eca5b4cfb55337348d4d81242e2687d6db9aa57300e132cc77375d08ee06e234eb04ddcb5fd03a706e9fce13f32b88d8eb303d2289f46d18a9e67ca86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c4e68aea582d0b0d3c412a7064bbcc606e359bf063442b676547527db57c62f6
MD5 d5d0358b0df10f6f9c0dbe4b0e92906f
SHA1 74da2a3befb6351dfde8112172415604f3a88693
SHA512 41176434dcce627669619e42f9c7d851f77a5c7be1916cae9d3cee6fc1fdfd76a8b56a39e7983ceffddae9d875b6baec6bf69156930b57b3dafdb7b1ed9156db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e03ef97970a98cc20d06e95f69767bb3bc7d3b161ab1fbbe3ac94be4c354ba2
MD5 03e9c68d63829867a0fc72c1f4f79c8e
SHA1 29558a9e280d7310e3c02c133182fc6bd0918265
SHA512 5964b34b4cd790be74139fa8c4e3bc3989b7d4fa761e945e3c9a0ec048655d7c1db487983e45019c7c9c6451d149a90d92330e7bf38dd848b5f78bfb3bdc564c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21ea93101a57db30966075f0bc0da2c2d5d89df93bf28b84f9bc85e5328e1cd9
MD5 7b788be8caf0426bcaf5294bc0ab2f07
SHA1 b4306903022dfede6970e1f8cac86e5f8f7ce4ff
SHA512 1d1bcfe707f60390407800884c25fc1bfbcac054e25696516cc141839fb3de3166b21354ff5a77377a0263ecf06522b275594a45b48d22d91cdd22c0892340de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16d51854047a5cebd0257279a339ffd51ac667ca63fdf0d7dd68c8a7ebc475ff
MD5 ea192e5af063066aea50e33d43d2d727
SHA1 b80c84d089361ab607ff1a5abaee0b41419dde35
SHA512 8399c6bead4f06fb92eb197da5d146904439c93d62e54028797a1d1f601765f6e5324aab26c7ea216eea37f5232172d88af0500baa918dd8d807a21366b2ea14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d596c41b79f618c037f0865b4f1f45659f32f79eff4b2e44017f4fb0a38e016
MD5 d960535bf9a2300e97885b1cb2c45967
SHA1 f7a7a0e56a808ab5c7a3f00b79fdb571d0177cc7
SHA512 585fa7ba02225f4691cd82a414adf18569792e33a5811ee34f5e27fac98219a02fd7349d9bb2a2910bea6f99b35197c2590b6e93ebea4b1eb76d444dc0f9af79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dc9957d20e5572ef9ade6e2108f10cdcb8e7395f7d9df3de3e68ab1ccf68689e
MD5 f13265ea91b56b1ca5866f78b05b4056
SHA1 7582f2eefe8591a8340b01eba30d9a69063a50a9
SHA512 1425bf950ac56d0efda6d45a33ad9e6b08d968d05c64a4ece938f8678fd7f844cdeb666532e5579483222219d2a37f2f158affecc70eab6624b923616e3f129b
MD5 SHA1 SHA512

Submit Download

svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABCBCACCBBCAABCCBCACCBABCBCBBABABACAABBCBBCCCBCCCA.exe
Size 18.9MB
SHA256 3984c50bc1161efe3c71e5833733f43dfa8b0e2eae47780143736427494e4d06
MD5 edb022fa2218448bb29c97711db6d7ef
SHA1 f0037c1950bc7d476b51f289236e73e7b39d202c
SHA512 39822c3020da65080f76de9a96a581045f7970923d52085a3eba9ebf09e2562a1e5d3112097162dc5572a76c4f3f7b35a7732ae89f3a07bca1cba991906ed74a
SSDEEP 49152:U+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ES+ES+EnX+ES+EnG+EnK+Ee:H
TLSH
T1C8174A09F94340B1D92B10B04DCBD2BF8A60BF2587128EE7F68DDB5B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0bb94cd846d41d97cb053764a815eb6b1089e9be1a761f4a8c7bbb040edefa9b
MD5 fa7c5efb83f4bd968306a3161ecbf5ba
SHA1 98c4a74b2fc0670276cf3998b494aee2560212da
SHA512 ae965974bfacf4b50b633e82544929ae443bfe09a7c59317bea8135cebcaab7efe8f31cd9f96946ec3ea1c77527d0bc06634246a2515798cb6d0394885495b4f
TLSH
T18621B421F0F6D863D033688AF525EB970CA47B5BD89C9B14538E9118ABD983DCD190E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d5c3b29ff6b540fba7748df92f660669054c852b0187cc689d3a3f7b1e6de24e
MD5 6f46547bf64988bdf4ff51f7205a09fc
SHA1 f321becf259b8da8e7a1b92864a2507af5ac0cd0
SHA512 2a9bed5b57ec1501f416aaff4bc7797d66575246a41f4d103383e8ebabb553ed3e2b59574810a84eb72166d307b4bca9855bdb554ff4d4a97572405f2c651925
TLSH
T12111C861A1F6D853D0332446F525FF9B0CA47B4BD89CAB14538E5118B79583CDD550E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 912e0a55613579cdd63174ca7526bae9a2a06a2eda604ecfe269becfee0a03f0
MD5 f60b8bcd4756322e7849265b52c4f02f
SHA1 f4b46c56718a80412c0a9aecb2abb3e6b166b80f
SHA512 3bfd5d0c0648e3210b9f8cf78fb463fa02b5f06f41dbaa728542ce22ba9d03ed8edf4ac0ba6c24ffd373a1780231a3dd9754c5a4d1ba1e4106064075468d5b4a
TLSH
T16B21D761F0F6D863D033288AF525FF9708A47B5BD89CAB14138E5118BB9583DCE150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/52-33-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/556-84-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/3312-77-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/3704-0-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3704-7-0x0000000000100000-0x0000000000121000-memory.dmp

Download