50ec7b6039d12228319722db102fe442eabb6d305e798657a138f089fe3da1f1

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
Size 11.3MB
Sample260905-sl2ssaxcpg
SHA256 50ec7b6039d12228319722db102fe442eabb6d305e798657a138f089fe3da1f1
MD5 2e9ac2c53dcb196283067ba97fa5514f
SHA1 4d7d49d7981da34d4ee6bdc430879a47c464f202
SHA512 ab24937ff72ebea0ef428eb7302035e3af31e1fe65ba7e4d82ae23c0e7fddd4fd1588c9d9934a39ee1c0c9b923e9abd23e927aee1dc1cdbb84cc5b4634620fbc
SSDEEP 49152:U+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+Er:+
TLSH
T196C62A09F98740B1E83B51B04CDBD3BF8A30BB2586128DFBF64DC75BA933BA15824655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
1484	svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe
960	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBACBCCCCABBABACCCBCCCCACBCAACCAAABABBBBBCBCACAABCBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe"	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCCACACCCBBABCAAACAAAABACBCCCCCCACBACBCBBBACCAACBCCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe"	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4788	sc.exe
1524	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe
4588	cmd.exe
4796	cmd.exe
4504	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3384	schtasks.exe
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
960	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
960	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
1484	svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe
1484	svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
Token: SeDebugPrivilege	960	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
Token: SeDebugPrivilege	1484	svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1884	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 4588	4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe	100
PID 4588 wrote to memory of 1628	4588	cmd.exe	102
PID 756 wrote to memory of 3532	756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe	103
PID 3532 wrote to memory of 5036	3532	notepad.exe	104
PID 4240 wrote to memory of 4796	4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe	108
PID 4796 wrote to memory of 4788	4796	cmd.exe	110
PID 4240 wrote to memory of 4504	4240	2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe	111
PID 4504 wrote to memory of 1524	4504	cmd.exe	113
PID 756 wrote to memory of 4808	756	svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe	116
PID 4808 wrote to memory of 3384	4808	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2e9ac2c53dcb196283067ba97fa5514f_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCCBBAABABBBAABBCBCAACBACAACAAACBCBBABCBBBABAACABCABAAAAAACBBABCACACBABBACCACBCABCCBBBABCCBABACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCCBBAABABBBAABBCBCAACBACAACAAACBCBBABCBBBABAACABCABAAAAAACBBABCACACBABBACCACBCABCCBBBABCCBABACBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe" start= auto displayName= "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe" start= auto displayName= "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABCCCCCCCBACBABACAABAAABBAAAACAABBCABABCACABACBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABAAABBAABAACACBCCCCBCBACAAABACBACABCCCACACBBBBABABABCBABCABACBBBACBBACAAABBBCCCBCABAABCBBACCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBABAAABBAABAACACBCCCCBCBACAAABACBACABCCCACACBBBBABABABCBABCABACBBBACBBACAAABBBCCCBCABAABCBBACCBAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3384

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABABBBABBACBCBABCCBCCCBBBAABACCCABCCBCACABCCCACBBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 9bb175ae186bd982713f6738c444050d32d9524e868474f2715d224cabdf2a7e
MD5 5b9ee3727f14a41d0a61425fb170afd2
SHA1 4fb1d6191f3b0cf6e4fcdf09ff076f2396852e5e
SHA512 22b4b650e1b2e6e795c6f7c97f2ebd1fbaa27d25fbeacb95362251ff76b721d50021b901a1cd53c30d334ae7875fb452844ca739bd8a7c47f9e846cd0ea3beca
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 11.8MB
SHA256 5aa05da22e275553baf35d19da642fe881509b8c0c34a2b568241144c03dccd0
MD5 6092a7329913882845335eff006dc3c8
SHA1 9f0f625f2d905ea8ca9a288da4fdf8b0f9437a79
SHA512 1efe4fab2e42af5bb4513b62ef4ace5d6b3eec69c33c3dc7ce4076f3577e07cb122920192d441087bcf81b0f0c6c36fb8460d55a441072948952cdf7a79de44e
SSDEEP 49152:U+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+E6:ppiA
TLSH
T101C62A09F98740B1E87B11B04DDBD3BF8A30BB2186128DFBF64DC75B6932B919834656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 47a6f4e9bdd5788a79ea527113597491e7a9e704597e2120a2f7e1de78506c49
MD5 376b547c42c7a1d46fb2d308b7b63aed
SHA1 ada9e22cfc8baa65002f94762e17f36eae0b3d62
SHA512 bdc064fa7a5155ded137e747e914ad9898b3e6214f557005daf786baa9129c8cd4c2d0d604a34433e4c4700932ebd334d8815b81546286b2babc526d181457ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\uk-UA\qap`g`v~dtlq
Size 10B
SHA256 ae041d281c66f08efa29956d166ffbc430630ae199c24f792901a991d60c7122
MD5 0f0b4c133b88e2cd93da4a7ad743f195
SHA1 2cd3bdf41e32bdbb6c756c10e1acab357bea0d36
SHA512 921dbb91ceea7350a50221546d804435e1f1377ee99c18ec5316cc71852a73d6c54ea560be9c097caf6b6f9a143b82f2342b950048b4209ecd4e10b05a36c45f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\WwanSvc\qap`g`v~dtlq
Size 10B
SHA256 311180140d07cf42a42ae821f8dc47183c527bc78144100a94a1791e9a66b796
MD5 95a318ae5724ba241b8b4cbcb13171d3
SHA1 d5311b45f55e7ec157f54e9503c72f5b6bdc679b
SHA512 008e237f91b3ea5bd50fc0e6998342440300f9bf83871eb4a8d9a51e333c89c541f17490c74075562554b50186790982d27c277edc9dabdef17a17091a2f6677
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\qap`g`v~dtlq
Size 10B
SHA256 56f786a4dd82fbe2f13078f60222108fd9e93c86fc1a11b253e1a7ea1080b616
MD5 c5bef9718665b9fc0eb0dbf2b9237fe1
SHA1 743e73263ac3d22b0575c5b722e5f6afed589e87
SHA512 0cb9a8b080dad2e02060c64e11546535e03a738563e98739c8d3e3482bb85662c246cc0d1d9530cf0181c3881876f53d62fb12d0527c863a5e62829bdd212e85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 56a0cc0b634c74e8ada345f2a7122e74c73f4d66e9d9eeae49a50488a6479709
MD5 79cdd8c2a3104f787fdc970528e962d9
SHA1 1c6731d476d7391d25f409ac128da4b1d7eb0acd
SHA512 fecbfa38c2dcfc740d452f5b5e5cb48e38f12309f858ab353bd03cf4db5ba87de9772a763ac2958cd74541592bc3b814c92889ccf1aa0116dc6ac54497b0bf03
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed30c46ddae590ce28907399fff1409d50a991181aec37066f3a58ccffb2ebf5
MD5 40b1f20340676ae3f4e1f19d48622489
SHA1 4b89b3d40080f5799b8a2689c5c83322c47232ca
SHA512 d68c961108172b3f8c402167d1d9704d8a45641a00b8dbb0c7728aad23818faef29212422a2aca02aa48b7251a73ac8a71eedf6a972097603dc59ae0bfbaa167
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2de8ba25a4102a4793e83aa8eb5bb8c53415ca70dd9388fdb7908e89b5e2e5a2
MD5 15c6b9a310efd95e0dc9c60cf20b7754
SHA1 61e4f3d9fc8f0cc1e7be461a11ad8f402ef3f348
SHA512 e65219dc6814820ad385321891fb1016eb41781e400842736423ac7d15a7e9a92f268afd3cdb7b6850e71e02d5571b77b7e723877ced797b8da21e9e2121a4e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54772e71f262993451d47115d0b4147e7b3ed209b11c2ee7da300232525a0d99
MD5 ef683d2711d32086a8befeee6e2390b7
SHA1 0dcfbbcaba4ecbca996fbb053feed8f27edb9468
SHA512 751ad6a3faaff5d898e5b21609277d66cf4ca1d43cfa2ceb0e9893483bcd6d99c280cd22ccead7bd2a095e515086adcd7008cfd81aec39f9118a56281540f6c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 18c277404c3878028cdecb9dc5715bc8eae656b64fb3507693779acd4c06f916
MD5 7e8063d9723e07b92b68336de2cd37f1
SHA1 aff60d8f404ce3712b3928d370952013c6b87205
SHA512 311f1fce1e9814fcc2b98a3ea2ac01e6a619dbd3c564ec834de55533129589621082476008a98ab86bd300fb2175f45161af247021cad11761a4681cdee0df1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0b5350a1f65c98ea2ec2ce7d551df4e62db1a96e2c8d17b38b7c9e94555d04fc
MD5 0ba8e6b061e21194c0d9915d5605070b
SHA1 779f5de4a97927e456e78eb3f5ed8071b9e9dc7a
SHA512 77ab2a83632a8519ac3c3b58c622bc8e29726efa04ad0cf16a59a0f431c6e73b4374d8bfe527d7d464d07bb308e4f7b5e1b4e8f000f0324f0dd20369d753e4ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0232cbd578bf7fed602ba61a3c9a96e71b8689dafe3c4973c03939bad2bcb88b
MD5 cf09c6d8ef0fd37e66ba2d278562bdf1
SHA1 566fc94c75bb5c8f721a9d0063d3776d3ddaf4a6
SHA512 93d151cb7017fa94289eace4f249847a8e9941a80dbbff2b8fbd81ecc3d37886c598fb845e2dfb8d166bf247fff1021a805cec98b4da8e9f27610809f954a3c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9806451a3925135bd74848217f47766a0a4537b5c0c40e73f36812839bb9d783
MD5 9bda6aa91897d55ba278bfc9a3c766be
SHA1 126e0278ed6c9152038806073c5cbc69aea4f5df
SHA512 5b18aaad6845483a8fed89115bbf709ed8465d5558cfd33a4c93634e58148fdfe902e003f4ca919d8e5395b31282f06bebd1d6a4d8f63ed428311ada216331ee
MD5 SHA1 SHA512

Submit Download

svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABABBABBBBBAABABAABCBBCCACBABAAABAACBBCBAACBBACABAC.exe
Size 11.3MB
SHA256 50ec7b6039d12228319722db102fe442eabb6d305e798657a138f089fe3da1f1
MD5 2e9ac2c53dcb196283067ba97fa5514f
SHA1 4d7d49d7981da34d4ee6bdc430879a47c464f202
SHA512 ab24937ff72ebea0ef428eb7302035e3af31e1fe65ba7e4d82ae23c0e7fddd4fd1588c9d9934a39ee1c0c9b923e9abd23e927aee1dc1cdbb84cc5b4634620fbc
SSDEEP 49152:U+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+Er:+
TLSH
T196C62A09F98740B1E83B51B04CDBD3BF8A30BB2586128DFBF64DC75BA933BA15824655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 195ed5831d3c5f7f7055556c71f288d33d76cb893dc581a07d2bd4a70e81c3c2
MD5 885e9d1d1e427ab0fc42529bcc991274
SHA1 901927e2fa2d7662e9da0f6e27897a1aae71f9d2
SHA512 254f4e5eaa8ba5ee3b4de519181f26584ef724fb4fd6a007287c3eacd33b3721f8bd5784a5e9f4704873589c4aabe72fbd2bef5d6e83d6286f9bb493d0ac3ea9
TLSH
T1B911A762E066D8D3E13124CB9A25DBD7199837DFA85CDA04630A420C97DD836DE5A8E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 53fe5a1b8e74bc5db229e69123e292157270183255f9752ad3916d547123931e
MD5 f7d6980ea4e720ced77b000bc31973f9
SHA1 4b867b6c390b75af20cbb5f0833346bd4b949548
SHA512 b3e0c6ffbdb64e60e934d281f582fc2a459c32e4c7de049268ed552e6f532f91daabf78a161bf1efec2f9a35b25ab3d6d36e5a45fdc971ea72d3ab0af68ef209
TLSH
T15321DA62F066D8D3D13124C79A25DBD719983BDFA85CDB00230A420C97DD836DE5E8F5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 1ad2588b5284d8d84732d6dec45e8564a381029584da472312629270df55c150
MD5 93aa6c0fca16af617e5e4f533c414244
SHA1 0940b7909cfca5f7ac9ef632cfcdf9dc2e46570f
SHA512 5b26a571c3ece82e03b058a63804348b8ae5f51b7b5c3309cfa204494f2a41f2ee5cdc96a5397573a3bc523631bd177c142df0e5d3361faa039b43341ba95d8f
TLSH
T1D101D6A1E066D4D3E03124DB5A25DECB19DC3BDA685CDB04330A421C97998359F5A8E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-35-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/960-2903-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/1484-71-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/3532-59-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/4240-6-0x0000000000A80000-0x0000000000AA1000-memory.dmp

Download