d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Size 21.7MB
Sample260814-e3b2sscp5w
SHA256 d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be
MD5 5332b8e10a1df2bc3e376e5d88e4c11a
SHA1 174acaec727285f300309191b38ddda149de48ef
SHA512 5270c4f3dee8d2694062368c22efc974f7f1fbde16f46efc3cd37b59509e0afc8149b9bdbcd84e8c94e2263ca35e01d8d900017b6f94d28630625d397fbaa4fa
SSDEEP 98304:irBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8:Y
TLSH
T16F376C0F32ED00B6D87F8275D6968156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
4528	svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe
2528	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCABBAACACBAAABCAACCCCCCCCCCCABACBACBBCBBCBCCCBAABCBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe"	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAAABCCCBBCACBCBCBCCCBCACCABCAACCBBBCCABBBACCBCAABCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe"	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5884	sc.exe
1568	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
488	cmd.exe
3780	cmd.exe
4132	cmd.exe
2856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3508	schtasks.exe
2816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
2528	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
2528	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
4528	svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe
4528	svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
Token: SeDebugPrivilege	2528	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
Token: SeDebugPrivilege	4528	svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 488	4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	92
PID 488 wrote to memory of 3508	488	cmd.exe	94
PID 5612 wrote to memory of 1688	5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe	95
PID 4360 wrote to memory of 3780	4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	98
PID 3780 wrote to memory of 1568	3780	cmd.exe	100
PID 4360 wrote to memory of 4132	4360	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	101
PID 4132 wrote to memory of 5884	4132	cmd.exe	103
PID 5612 wrote to memory of 2856	5612	svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe	106
PID 2856 wrote to memory of 2816	2856	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBABCAACAAABACBCCCCCBCBAAABABAACACACAACCBBCBBBCBBACACBBBBBABCABBACACBCCCBCACBCCBACBCBCCBBBBCABABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBABCAACAAABACBCCCCCBCBAAABABAACACACAACCBBCBBBCBBACACBBBBBABCABBACACBCCCBCACBCCBACBCBCCBBBBCABABCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe" start= auto displayName= "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe" start= auto displayName= "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCAABCAACAACBCABCCAAABAAABAACCAABBBABBAAABBABBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABCAACBCABCACCCBCBBBCBAAAAACAACBBBAABABAACACAAABBACCBCBBBBCAACBCBACACACBBCBBBABCCBBBBBCBCAAACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAABCAACBCABCACCCBCBBBCBAAAAACAACBBBAABABAACACAAABBACCBCBBBBCAACBCBACACACBBCBBBABCCBBBBBCBCAAACACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2816

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCBCCBCCCCCCCCCACCCCBCBACAACBBABBCACCAABAACBCAACBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6bd972f6bccc69c1ec410344f499a0353f6376cbdeb2603adb08c5e260aca4a8
MD5 ee669182dee1b595f42adaab8d32059b
SHA1 f0d70e1425d5c6ad9377b05eb0b8e12411ceb728
SHA512 6ccc0fc69376721cdae8c42d33d362617fd9b6baccca74d9f2e834924145505af936e9792c6a0227ddf78df39e3cd70c165234ddc7ed01b94a692fe02d323e23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3e46f7e940bff128c84d2c4815500f339b4827d5911edd4c51c54e32e1d6c0ab
MD5 0a3780f952166aba17195c77e0b39b0f
SHA1 5d5744b1ca20fc2869db430d2a2c847fc5c53eb5
SHA512 e0f4ef2a41a1d48faa6e220d7d7708dfa853055a4327127e9c1ae94a270a3d2543fde63cf35307a66e7e19112242058cb2cad0cf2bca4349deccc6f962351d3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 d66120798a886f9d0768df45c9356a010577f2056ae8e35f31f063953b8494ff
MD5 dc2f9ff609b4058f9ef64f4b897ae069
SHA1 c6a8fbec19d173d41eb4067d24b7507869a7088a
SHA512 07101460f9f661fcf9af8bb834084a2f36298bd9338581c5df73dc4e7f56fb3da01b8b411ae3eb3fcbef3c904b60358bf0f146949811a9cebf9b89bb7d6ce81d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Models\qap`g`v~dtlq
Size 10B
SHA256 8600a07a09db9f9f2509afa230ec1aa17a99171405c8286a5dbbae24076337c6
MD5 00401611500ccd8f4e112cd77a1350b5
SHA1 e2026d415173ebe5220ec9fb3257aad8e45894a4
SHA512 662f25d71eac3540d18750dfe56d15f4c98b8bad3ebeef4dfd4753a04cd4667ea62b53552f51816bb918310b8a77ba2177238bde6ba03fee1c75a31002815270
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 a10ab565551a2bb547a5088a2e221d079823e988766980c3c18b8aaea786e8e7
MD5 f2a3e4700001fadf61f1a7502a562cf2
SHA1 4b6cfc8258e053315b4b347ddc8eb34d69bdff95
SHA512 e48bc91f84ffd9073df3129994ae84b24a5bda7d58a3c8b1be736bba0279915cc822c2eff28fe552126285b7eb04d0f57d267b80391dc93210bb31a1fc18d7e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 1e815679ac4aa464b6f83abf012f51bf3154dfc461d10aabe2c87743fe2319ac
MD5 4c89019fc601b70b815a9df048b130c2
SHA1 b760e23506698ae6d982f6428493809f8795b8b1
SHA512 4285f61a797173833994af32b76fc063cdbd7ec0f914e9ec34536a1d99e41cd49ac48e6c709531feac26df4c609ffbb07711a65f691810dd3ff8a24c5f397213
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.2MB
SHA256 fc8a798b53574ad4f25b86425cf62a151a9aaa3ea68095136adb859d7e115834
MD5 298f157660ca6292defecf6ad816bc0c
SHA1 f1b855bac8592e00a07ac13d78058d4b6b597cad
SHA512 6323f8d9c0cfe84284cd0561f22ebc996e006a2e574cc57804e8fff644d36f07e3430fe12789004078ff5c521ad0b202d55c17f0e12736754e8f4269e52cd730
SSDEEP 98304:irBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV+:XgZ2je
TLSH
T1AC376D1F32ED00B6D87F8275D6928156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 47c1eeef423d2285022dd97e0b05116690fc5dbe481482805535ba5321d23367
MD5 eb28f2b45572e3bf5b9770e9cd961550
SHA1 a24cb2106518e400df3e3760d1a678fe2dc15420
SHA512 027d16a70d3462dca047d3298cb806dba5730f4971cc7bd201899283eae322e53d457b2ee28939ab9349290a12350d7abfed19360ab8bd548424ade97413eb5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 34815b1af4eea36b9bf54fd2d5adef70c923b519fe8b4462e6a8bf546bd92062
MD5 178c74dc68a8f808bc045a58092fa2d5
SHA1 268a967670d66f9dc7c033bf5c388928bbdf1617
SHA512 8e062e62465bae6416dbf8ab08e4cde3537f490fd89a2894c5e3f61abc05441e65610d83a59a987a338c43e2f038a7a04e88fb3457e84b9111f3771600866a46
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 ff864c3360213f0c9e81d7bad4e79f304d015115d587b19a835157d1120d5580
MD5 19c32cb9931c125f85650edb28398642
SHA1 ad9d3b844d0c96211365513c3174a7721925fb1e
SHA512 f8f26e1c1c77f74448737d4019de11b04c6bb15bea1ba0e69bf61bec14dcbc1f31e51a7f1631b2943646772c04d203a2bead720e0a85ef71be7b7bcaebb002f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 081b29f1bffa12f7000bebc148a87535a42f360e36832e4b6207b8e61d556c51
MD5 91b976237aa9b748a187b55b5862fb20
SHA1 ff4b485d1f7eecb204038041c247c85935974d19
SHA512 3c44877cbf6de71b59dc9d192d4d0e6f57f43f50d61c9f01bacbccc49e3786ea46c5c0bf4c241d6a37637396a6a454197e0783c76e06fd390e986af82d399b4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 16ad7eac382aff81c669a1cc96719d4f268b9646823dd7e3b4f4a805a8d9ab5a
MD5 499feb7249753c46d444ace483a16a7e
SHA1 9f21f5b7ba6cb4a4f0a0dc19cc94d7d880291725
SHA512 dbc091108731aff6d7a1ebae139383c265da86125d75881f27aac3c955bd27c53f1bf1fa2b151f92bd19be5feaee20afee042bb9ee0ffc647659a5cd9c803870
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\qap`g`v~dtlq
Size 10B
SHA256 156967561e3e7be5f5e0adbb3c4a759f72fbf363677e2c57b62d8c1dad6b3718
MD5 c4edf4e9bcfb52e369366045d607a21a
SHA1 e023ea9330c35fc7e1d6876c43656bb532c532e0
SHA512 0ae0c7b4d25bc21c84bd620663b24dcf47dcebbf55c6fb5d816c04bdd7ef756074b89edddc28a922b35b91f0d9ecfe3bbcd25ed22cd739320e7925f582d837fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\qap`g`v~dtlq
Size 10B
SHA256 d203926c9f80506b7f643a78d743ee866ee05deac959b315505f90aef3893a5a
MD5 814d988ce538ad373e68215a8dfef93e
SHA1 afc8069f3feab8b416b75c90a23b12e13318b06c
SHA512 f99b9993551d30ae73213e2ee5011cc01d132a84f86be16c89ba8f094299fda2d0d14839f2f5b399d41096492f3ec9a71d0c1e780b90bd83ea1c6129f853862f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\qap`g`v~dtlq
Size 10B
SHA256 ecc11c1194644bb4da162032df42ad462bc17bbdd397cc2afc79ef35626cca85
MD5 307897813df40651028e96c5f6fea93c
SHA1 13dbe4bbb0ceae02c85ff57f1dccce5a4aa10839
SHA512 acd168d96b95f283486162258c3ccad40d4504318c6cdb580843730a51b616543b22e74e25b45e80fb7c13141af4f8cb5c393e20f515a74341cd9ce3c17fe209
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 301a0663137c34b2b63d2079ab73a7884eda939fd19234e4a323c818fd79e78d
MD5 c96776221be0cd7b569c49d65ca85109
SHA1 b6a7722b2fc2424261ed47e1727b7099b1f89e02
SHA512 c00318abca475eeb1862f25f6a341cafa0ed8a6aa905306cc987ac292cd3faf4fee67b529b3765e25fdaf82c7dca5ab9501e72d5318a573efc0d7465c7e69192
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8218e944eb58f198401fff1c50436f56c83536f51261bb104897a9806cda9bf1
MD5 1f59a7854f4eae21f5ce6eb6665bf3c1
SHA1 caf78e6e2622f615ff71e747f46fd9d289f366d6
SHA512 3b4dc877e7f8cd7199aa3d54e6db43ab67c1a7c137af6d0745cd34f51f12c4caa53ccb736a0fbedc50ecdc06bf04d3047962e77ac125bc009575ccbf5f24a3cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b6174ff35fb057454c68a466a97c5a2a8cdfd44c78b73fcb49b5c8e8381ad45
MD5 c738e574c401bb03df4e02c1b1c54ea8
SHA1 85e720b3ac412050aa6d485acba81ec6cfe7b75b
SHA512 7a76c9408448718c64e04d2fa0b43cb1d2760ffa6a023a7449b5fe98fe29f88690621fcdde8d29bb99469d773555c6a933362f91b2fa3ab020c88f876b056c4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c0384ca2dfa4ad670aee4f02c9e5649c4ffe6f46cf47b9ee87e9981948361873
MD5 46a8989987cf2ab03e5ee97299932669
SHA1 a49402e5504c2b615bca995421408df700800573
SHA512 7edd20876ad395a86022ad21ba837f1cec47b2261c91b3d0c1b0fd0bdbb33b91bf9c98039ddf9e0b38f5a07af3b649ff45beeb6471a202139778ba3b9ece71fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ceaf6e3233359681b1aa395cd8bb11ba9b56b1e7f52260a74217d950f81fca40
MD5 fc08a6294392ac381ba9faa21f8ed4e3
SHA1 ddc0165e0867a07e5bc414ef15bd08e27eb195c8
SHA512 a9459e0ca4160e6f90e1bd1339d1f4b46b6bf0bf7f3236dfbea6fdc50b95addc0839c646fec72ab2ef524340ffe8ad70b1dfe5b499573962cde0c058bef0e72d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ce50283fd11e20fe1a03eda2c1c48fc761e4f97d4375c8d5d338647690a407db
MD5 d5af9831c33ee32c4b7617b2c5e647b0
SHA1 3fed1724a14936024b390e320d40b1648796c153
SHA512 81597e4889016e905e4b676fad0e8bb0fb4c6c7cd6f57eb87e66f9380abcdb93f8c95a90b8c821a65a167740218e29074667b036264b0c6ec5ecbfd8fc9be273
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 09821a51393ac5adcbfa08614980a29563417b6b57a3d9a6130d53dac0dc896c
MD5 94fbbbfe67a87351e6a175daa0e12668
SHA1 fed1bd60eb30226efbd45490059d87b45cb43356
SHA512 15065db0a830bbd69790f4e5fc129e182f5b126b9de08ab2a405a5b8a250086c82507b4f25cc3f80cb27d6aeffe236a2e132de3cfbfcffd25346af2d4c2cffbd
MD5 SHA1 SHA512

Submit Download

svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCCCCBCBBCCCCCBAAACBBAABBBABCCCBCBBCBBAACAABABAACBBBC.exe
Size 21.7MB
SHA256 d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be
MD5 5332b8e10a1df2bc3e376e5d88e4c11a
SHA1 174acaec727285f300309191b38ddda149de48ef
SHA512 5270c4f3dee8d2694062368c22efc974f7f1fbde16f46efc3cd37b59509e0afc8149b9bdbcd84e8c94e2263ca35e01d8d900017b6f94d28630625d397fbaa4fa
SSDEEP 98304:irBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8:Y
TLSH
T16F376C0F32ED00B6D87F8275D6968156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 253d0109ca51748a56e6134f925992cd989aca66199cbab91559d498fcb5334e
MD5 8ad250cbae0548ee8860f81da9f6823d
SHA1 d3754996b8f17e52e2abe1bdc27174a4b7760196
SHA512 dca46b8343d1ffacaf91849285e162098111cb28c208c754987557118937ffa39bff4bfb8017e929573a87a5ae098038f441b523c383f72efa66b63632115362
TLSH
T16E21D850FCE6DC27FD32A4CF562A9BD318B4B757AC58AA94230C422CBBC5D324D514E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 be59e6967736a9fbcb7c5f8ac872d3f5c59b96344acce38df21aec2eea7e8260
MD5 52bff8b87c8f3d24396be391341ce5f9
SHA1 aee12767f8faea85dc75cc35d227ed8c2c5cc94f
SHA512 38401f84e0967a85d008d7b1a9a30cb6b3f7d9647f926f5a9378d30cd1517638b3672bbf32ff177793bf98dc35c8f70c9728880618ddbaa57becf5c08389cb32
TLSH
T15621F750F8E5DC37FD32A4CF46299BD208B8B797AC986A80230C422CBBD9D314D514E5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f2acded7062deed6005b97b27bb212f52344fc56c560421a076e67a379572000
MD5 defe0b75b6bc9208b8c0c83e8f153bf9
SHA1 cc0f292d2939e82212088da95789b17500c9585b
SHA512 2395a2d16dcd3e82380a706d0dcc49bf5cc9f784efef32382ad9da28e1926ea7a8ddba80c5a33cb652e5515d7b65852402003b35b704a18214a6cb5f72a7a9bd
TLSH
T13B11E751F8E6E827FD32A4CF46298BD21CB477476C987A94230C422CBB85E314D514E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2528-1513-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/4360-6-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/4528-69-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/4528-3768-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/5612-33-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download