f7cdfe7b11284545467c59160b6ac6cb496efe584d0411d5698689b896549acd

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
Size 21.2MB
Sample260907-ph3dcsgg69
SHA256 f7cdfe7b11284545467c59160b6ac6cb496efe584d0411d5698689b896549acd
MD5 936bf260bb3f7545cb172c3afc1ea6de
SHA1 dc4763e58b08ffd68fa280604a654f561f0966f2
SHA512 d18e7d4019cb829be5025eb08ce86777bf5ed583dbda093e14efa6bfd4cfcc7b8ab12cbb5468847b69b28a173573312ceb121f1e308721dfb2d103309a6ac1a3
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+EgF:Zp7I
TLSH
T107274B09FD8684B1E97B41B04CDBD3BE9530BE218B128AEBF649E72F6933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
4424	svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe
4288	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABABCCACCBABCBBABBABCBBBAABACABABABBCCAACBCBBBACCCACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe"	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBBACBCABBABBCCBBAACBCAACABBACACCBAACCCBACCBCBCBACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe"	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3648	sc.exe
536	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
692	cmd.exe
3248	cmd.exe
3336	cmd.exe
1028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3500	schtasks.exe
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
4288	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
4288	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
4424	svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe
4424	svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
Token: SeDebugPrivilege	4288	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
Token: SeDebugPrivilege	4424	svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2236	OpenWith.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 692	4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe	93
PID 692 wrote to memory of 3500	692	cmd.exe	95
PID 1776 wrote to memory of 2224	1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe	104
PID 2224 wrote to memory of 4948	2224	notepad.exe	105
PID 4116 wrote to memory of 3248	4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe	109
PID 3248 wrote to memory of 3648	3248	cmd.exe	111
PID 4116 wrote to memory of 3336	4116	2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe	112
PID 3336 wrote to memory of 536	3336	cmd.exe	114
PID 1776 wrote to memory of 1028	1776	svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe	121
PID 1028 wrote to memory of 2780	1028	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_936bf260bb3f7545cb172c3afc1ea6de_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCBBCAAAAAABCBCACBACBBCBAABBACBBAAABCAACACBACBCACCCCACABCCACBCACBBAAACCBBCBACCABACAACBAAABBCBBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBCBBCAAAAAABCBCACBACBBCBAABBACBBAAABCAACACBACBCACCCCACABCCACBCACBBAAACCBBCBACCABACAACBAAABBCBBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe" start= auto displayName= "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe" start= auto displayName= "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACBCCBBBCCBBCAABACAABACBCBACAACCABCACBCACAACAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBABACBBBBBCCCBCBCABABCBBBACBCABCBAACAAAACBCCBBBBCABCCCAABABACACCBBAACCCCBAABBBACBBACAABABCCCACCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBABACBBBBBCCCBCBCABABCBBBACBCABCBAACAAAACBCCBBBBCABCCCAABABACACCBBAACCCCBAABBBACBBACAABABCCCACCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCCCCBAABAACCBCCCBCABCBCBACABBABCAABBCBBBBABAACAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b929cfbc5f3f530ccf989c92c37b95b24cb6405ccca6b0a98154407c8525a0a2
MD5 d3e854611840b903ebbc48f5e38bde73
SHA1 2d4170b8cb913951c9f1b51c67b6ad08e3be8dfb
SHA512 cb0da2d45060999821380c67307ff0e1336aed57fb9f93297e6690c6ee01db4292b2325ea00d3575463cd820597c391bfdf8f3519e6cf377259bab3648a55282
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 21.6MB
SHA256 39d3bc54c5356ef9795a4f8452b4c15e86a8d4850ccace877f018b078392b04c
MD5 4b70689f1242c2433823f692d07577e3
SHA1 569431a07e7a1d9ceaa81130807b8f5012303375
SHA512 da626a5c8b21e274597e036cd220da0ec0b2d2fa1af47b2c45ff0c38156ebbd683ae4ab7946ec26c70c6d8fc3f3e70edbaf0baef6a09ee367288cd8edc6603fa
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+EgU:Zp7Lpi4
TLSH
T16C373B05F98684B1E97B41B04CDBD2BE9530BE218F128AEFF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 36fb48e9f66540ef2cb3d5e35b7f570ae5315d4c2f18ad4a25e0b8d97fdc70a4
MD5 ce2dced0824d568b469b46751a45b5af
SHA1 96dc837a6b8ce3eccfa7ea689d5afbe2d5b173f0
SHA512 a6f85811ef8582a33dbf1b7a72460498d0189d7c92f9a512bb951952f3136aacc3c52b06744d7c39f9ee7e05aefdc79b2ce7ac06edf8306fcb582da44a52c3c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.2.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 9451cc36cfa132879714b6a1831f98716313d3ff8c2aac080503d7ac45adebfe
MD5 321ac0a94554be99f42f4e179c3b8e13
SHA1 2a5ce1111a606bb4877c8605c5418615a0ef4986
SHA512 e13dbe1ec4cd282dcd32b7ffd1ec04a9056ffd126bc4f275997b3500013b244fdb3b56784b64fac2dd625ef2939818e4253f9a1557ff5217c8b4dd841c9c0bbe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 541679c524d5cf501254c38fd1bc68eb06a6a73c69aec91ba8baec4e0eebb502
MD5 2be5d37f44b494ca41f839c2dd45657c
SHA1 06e22fcf8195ea7ba68fff8a7e29787c312e93b1
SHA512 f430e4ddeccd36d62c7308e5bb97b43995f43aa6ea4b25f8a1baeedb8485a38d233fd1d854d363bcac98b647471c2b4afb526c6363498e9c5e072a8deda30c36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 c59d496d724bc2bfd411c7b0a5f5eaab093ae25e4dd38343ed7df13e75d1f749
MD5 4d4b559c9ea85e3f94fdf2dd9fbcbee7
SHA1 81206cb32ecf1b1b7ca63ab5c83e51edebfceb05
SHA512 cf2f5ee6def184afa41809a0b162d5a701d25584c289a64e83bb02c6f8da17adf771914b91331c12ff901563d9d4c409cb32fb59bb65e8cc1f2313aff415c725
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 33571ed7668c3cfe9020ae6107ab1acdfcfdfb8d21b7a6850e206347062f6d1a
MD5 3bdbdf1f7da730efbf826c2c401decd9
SHA1 5800c8cac3116016992cfee52f7e06e47eed806e
SHA512 e2eabe8b3faa8f74cb48db4dbb7c895b1e6054032229f162091ce89b68fccfc31a9bbd143f02cee794196a18f56e1c5622bfddb0aee9f662ad87cca6b4355372
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Safety\edge\local\qap`g`v~dtlq
Size 10B
SHA256 cdbb0fba4b67071bd965e3dcb910d9b48d4cb59bd3404ae2631381bd2c9d0f08
MD5 c88f86b9abe3c2a4f5c9a813de15c808
SHA1 286545b5165ce1b91544f6d0f25f3fc23f8c02b8
SHA512 a42b36bfa440238c184fe9be30ee262c4826a72f99323cdff33d32d7ef42e77aa140c0756c84cf93f9ab6a432ad02bbcc3f7d1128397375dc543bac877c00dbf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\input\fr-CI\qap`g`v~dtlq
Size 10B
SHA256 3d8e5b819ee1fda20260e8cda87064aca140a9f20529482a748483810ea2da88
MD5 cbbdcd26e15e6a6904c6188a10b9f3f4
SHA1 4081ea6e78e757bf785da62c0793292a815089ec
SHA512 fbb603234c8c24074ef5a4aeaa32d346ecd4e9ce7af87b2ffc8d68738bb7c2fff4bc691913d8d9f5ad298a20c8581fec55ff7d005981dbceae4fe0e450218aa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\qap`g`v~dtlq
Size 10B
SHA256 0d7c2df2fa44c94fd351f9e998284cbdabe3bd20ce87242860853fbb7e19b404
MD5 13e8ffe7c9177bd33dada8e418ac82a6
SHA1 d536ee642212929fa54f6f656e1b8b142597ab8a
SHA512 19e75fd9dd9c2dada273fb14e341b9a584271dc7dc8f77f30c3b9e71bb4e5c1bd0bf42a849080c04308b77bb680e9e8f061cd0538aaec4ac1ef53ebcae2d90c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f0f4daa4c1c17e00b0e091ce572d48112f44e13a985b513244c4cc7582cc5d5
MD5 a12a3c62889266c131b25e9fb378aaf6
SHA1 46c978740a3f8bb0a29858b84d3d46ed065d1c1b
SHA512 817609398ba228d9e599242d0e23a0c40989e146b1982bdb62a0eafd2a542dee67393e92619783beed2443656e13f833d7a7c0bcf095603dd5556cf8c77e3ca3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab094a33686371613a9d33b4a9ae8ffad311e5b58e30ebe310f6ed5150387811
MD5 cdb4e34109e234dca0f3fa96a9a9aadb
SHA1 a3f3f8bfb7bfdb20b2e657e9253f1b9ff766d025
SHA512 8f1967586ffcbeec5bacc0e97aea794e41e1a1512740a777f82f1db439ea982aee577470c678c69f06489f4b68194d3ce34265674d1fae3d8c0431dc2feb283f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89ecbf061bd52577ed406c7d5e0c32c8ddba17dab3d37bdbe570a1251b623400
MD5 5cf50610b8d6bd92764b0a2037a9e03c
SHA1 77fa046f91ac67dcae446211d01f5b87847294ac
SHA512 b1dd8ee71f9feb09bcc65b5e118be622c1f21c636b3d403163bcf65d46ff62a47cd715bb0eb52e07fd6bb556e0a9f9c0415a96f0ea7372ca02e8aa4b2263066f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 52112304f48aa79685f3165343b0382cbc20e1e7c2e38fededfb24be8c2c95e5
MD5 852b48822beff49cc3aeb1c4700cab01
SHA1 9be6610ec3d7973a02e4f4255330c34f878c363a
SHA512 dd1d0e718ebccc3617c78dba82ad59edad80c3a350e4d52e31751c9509a522fb4b0428f69f020d4546ef6c22e75bacaebfdf19882584b2438dcc7df5b203ed4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 be82ef23afe54642d723e4c99bb01d365628ade0123323baa9a4aaa39e746792
MD5 70e9d92d29a983d9e7e880d367fd070e
SHA1 87748c72bce14a87cdf30356959618be01942bf8
SHA512 85fd50cc3c8200ea88a60080ed5e0d1699c69f94ea1d5b7467985711bd688a29b6f3222b0614de73c765b8a496c222b69642762375db59e9bb2f4640a6915141
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6fe5633376027d352f03edfcda837f04e3d1d92f01af66f41c3485952798b63b
MD5 702aa0be5a0617cc3c0e5a1ac1fd5216
SHA1 7f7dd031ea4a8eef93f21f70ef842e1f9fc520ac
SHA512 b69c38b85586f71fe29b6675ecdf4d3838a4d3ea43d008506d99759bd10834f850a20b2e87e14e9cc57d3abdf594fda115d9e9c2f309408f553d33fdde43f570
MD5 SHA1 SHA512

Submit Download

svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABACACCBAACBCABBABBCCBAAACCCBBAACCCCABBACABBBAABCAABA.exe
Size 21.2MB
SHA256 f7cdfe7b11284545467c59160b6ac6cb496efe584d0411d5698689b896549acd
MD5 936bf260bb3f7545cb172c3afc1ea6de
SHA1 dc4763e58b08ffd68fa280604a654f561f0966f2
SHA512 d18e7d4019cb829be5025eb08ce86777bf5ed583dbda093e14efa6bfd4cfcc7b8ab12cbb5468847b69b28a173573312ceb121f1e308721dfb2d103309a6ac1a3
SSDEEP 49152:U+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+EgF:Zp7I
TLSH
T107274B09FD8684B1E97B41B04CDBD3BE9530BE218B128AEBF649E72F6933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 53545d4a8e0fa7e9e69e55a05393814b04e56278aedd402d2c226a0f16c5ca49
MD5 5937c1c776b101da1e03b4e48607b954
SHA1 d257a40283a2aeb316ffa74530748122c5a38e5a
SHA512 5254f8d9135babf62650b6f7d36567d22b64ef929ccebdd9f7e212178ee65fc7e9a7e6e6d86a0d80f66c750a54f9ac8d416b4ccb3e8bfa51cb2478368d424a41
TLSH
T1F22121A1E0B5C853F13128C7AE29DBC74CE43B8EAD5C9B987309511CB76AC2E4D194F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 8d8f7c4233ace519deae603bfd347e9d079c92058978168b9098e189021cd21c
MD5 10b209f94b97c657498bcdef80f6b010
SHA1 9e84dc5c42419a4ac367a55d40714129fb8ea97f
SHA512 e9e473f3105d75f8fddf7581db59d7031a0b4f10b8aa6d8010330d588ac1873e5d2b81330747f3a4531b22b7d54fd4e6755e649274d7f2f8452a2e41336bd873
TLSH
T15021FE61F0B5C893F13118C7AE29EBD74CA43B9E9D5C9B9463095208B769C2E4D194F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 80c922e14d9c7adb5382333e0f01bf011769542fc03830d1dd0ff8cc0127115d
MD5 0d789309935aca4d0cb784c85319874a
SHA1 9cec5bc55122f772f0e8b40f535d3a1510b8f104
SHA512 7c3a8ec3cbc9e5e995ff59966411351d513144e9c21c25c5cc0057f73a84af64a33f2a6339016890689f57aa80ef27f8bfa275a7323965d53580652246fcf8bf
TLSH
T1BE1131A1E0B5D853F13128C7AE29DBC74CE43B8EAD5C9B987308520CB769C2E4D194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1776-36-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/2224-59-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/4116-6-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4288-2508-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/4424-71-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/4424-3047-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download