f0ed36d5582768f1e358efe90a1f57eca6efa0d82b9cb65daf67dbe4eaa3fde5

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
Size 1.4MB
Sample260830-3f2wpsdh29
SHA256 f0ed36d5582768f1e358efe90a1f57eca6efa0d82b9cb65daf67dbe4eaa3fde5
MD5 f57311d5c09f53e638e51bd90691dcb6
SHA1 7da82842b175fdddd8d83dbdf95908f4f0fcb1b1
SHA512 0c216d4f07420d04c4a3ba90b3ba291e4d93ab372ce9957568ee1da0009f88f6547e0c8954042534039597b5641a6eb9ab96490d1f5ede2de5fccdc12c46db3d
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+V:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+ExA
TLSH
T108652B1DFA4350B1DA2B51B04CCBE3FF8E607B2581228EBBFB0ECB1B7926B515419255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
1052	svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
1484	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACBACBBCBBAACCABCACABBCABACBBABCCABBABCABAAABCCCABAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe"	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBBAAABBCAABCABCCCABCBBACBCBCAACAABCAAABBABCCBBCACBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe"	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1400	sc.exe
1828	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5340	cmd.exe
1960	cmd.exe
6052	cmd.exe
2768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5804	schtasks.exe
4936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
1052	svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
1052	svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
1484	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
1484	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
Token: SeDebugPrivilege	1052	svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
Token: SeDebugPrivilege	1484	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2768	4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe	91
PID 2768 wrote to memory of 5804	2768	cmd.exe	93
PID 5108 wrote to memory of 4464	5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe	94
PID 4284 wrote to memory of 5340	4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe	97
PID 5340 wrote to memory of 1400	5340	cmd.exe	99
PID 4284 wrote to memory of 1960	4284	2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe	100
PID 1960 wrote to memory of 1828	1960	cmd.exe	102
PID 5108 wrote to memory of 6052	5108	svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe	105
PID 6052 wrote to memory of 4936	6052	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_f57311d5c09f53e638e51bd90691dcb6_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBAACABABACABCAACCCACCAAAACAACCCBABBBCCAAABAABACBAABACBACBACBABAAABBCACCAACBCBABBCBCBAACBCCCCABCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBAACABABACABCAACCCACCAAAACAACCCBABBBCCAAABAABACBAABACBACBACBABAAABBCACCAACBCBABBCBCBAACBCCCCABCBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe" start= auto displayName= "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe" start= auto displayName= "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBBBAABCBCCBCBBCBACCCBCCCABBAABCABBCCABBACACBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1828

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBAACABBBAABAABABBACAAACBBABBBBACBCBCBBAABAACBAACCBCBCCCBCABBCACCBBABBCCACBAACACACBCCCBBABCABCBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBAACABBBAABAABABBACAAACBBABBBBACBCBCBBAABAACBAACCBCBCCCBCABBCACCBBABBCCACBAACACACBCCCBBABCABCBCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCBABACBBAAABABACBBCCBCCBACAAABCCCABCCBBCBBABBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e790b33845d97f43afdb4dce4d05a25af726d9da2b80b1a30fc33b3bb3dfaa5f
MD5 3a68185ed83e0524ac6483a63b0f2c77
SHA1 6e3b9318bbfca783059fe2a72bd936a12569af57
SHA512 ec5bcde601018dbafa6f5714eddee93944f111264f5580830e00a4986227f44b49deb5b3f1ad1a7fbe72a19fc71436b3481eb2f32bd8d0a0ec1bb0899e76bf45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\FeedbackHub\qap`g`v~dtlq
Size 10B
SHA256 2dc15e0576ce21d7216d30048e6635632eac16dda6ca15ea94c61898514f5eff
MD5 8ea09fb20b2af69fa15a8f12c3e1034a
SHA1 e2030a2d7cfc8181b63d1cae9b0f39b278e7edaa
SHA512 21fa106722a8585bcfc7968d2a9e81092364c26870b799043b5da480c8bde0b975279d9cb5fbf9630a6df451d97ced7d4196e5d6c75674819db715fb6b2cc887
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.21302.1000_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 7587c0150660a771c61d686101b162e6d6664136085649c70f18d6de9d6e4b2b
MD5 39273195aeb4702e656bdec23d777b0c
SHA1 23b6d8567cd1229d1bc0d095e532bfd8a495b312
SHA512 9dec75e1333a3389ec3086c5bb05abd02da7289447482db40301975298b557d6fef07de9402eefcd85b32e03428f73a12d918cb01596a4bb3cada5b1ac6235bd
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 2.0MB
SHA256 2c2959c8f9628cfe9f6f524977224c4d4e2269e7c35006c6d4a12fbe2ff3e1a2
MD5 ec3716cea14fb4fc74897b67549986f5
SHA1 67e8e9813b2101ec7b2d6f4024e4fc26fabf37af
SHA512 53c8d49eb6522ee3fded75c0d6fedda2f678e6a229e7b77c7298bfc23d297378b5c90a61c116901419e8e42a05ab02d2028b6cfa78681b0246ea78a80127dd52
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+E9Y56gZ2HbbZt+jqpQ0L:b56gZ2Hb9t+2xN
TLSH
T1B0A57D19F94300B2DA3B41B14CCBD3BF5E70B72482118EBBFB89DB1F7926A91543A255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\qap`g`v~dtlq
Size 10B
SHA256 64d6e4d82e9a5860263052b14b726b23f476b0ff9c20ecb619c7bc13cdda7834
MD5 0c8cf3492338151db75034469d7fea8b
SHA1 ba8e4325484d2bdff2e5c20c477404abcbab66ea
SHA512 9e9a72641bf051fdf76fad1da60a32bbdf4ab04224a478fd76aa98aed11d624795f7e6607f30c0bec060dca65d912f6631f74e92b747cc7a5cacb01d097a434f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 1eb28f147c4dff558cf5dc73c9500851c362b40bc3015ea065e45addba91af69
MD5 ed6f37024a2ab5e31a43da87e83463d3
SHA1 d2e239a0afd138cfdff0834e5f0a3737e7a80a0b
SHA512 dbb35e65fb2f47c41f6fa82d1894a19437caa43596ed41c0b0b4fbcefbdde64d0d5e7cd187a0a62cd71270bfebb33d7df6e1235e243f8aa88ff30a44d889881c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\qap`g`v~dtlq
Size 10B
SHA256 df36ea09d5d2255cb141bedd5496e985621c4acc01a391160df681e25de5f7d6
MD5 d2c6d7887afea381ad0f1a4a25473bce
SHA1 a9c66fdbc30286775beeb46e0f716d1086143bf6
SHA512 d7de9b21227dafce4533f5ad121678554427ce0a8a8fa5c6f5e41e1c4950d1ed81de7688b588d08031ac0f113ecd6401fc317d3328806f12637e293521b451cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2b9fe37752d1b26e0b27626af6191ba0eca7c7e45122bf0ce91ab176164523b
MD5 61a65301696042d79fa1580f296816f2
SHA1 bc199d58442f4bcb4dcdb799a00af1dc3244548b
SHA512 167d29d7eea26533be40f89fc73fd3d7a366fd032d6d7a3332ec83f16732134f303400e4f3a0e327406efc13147b31af8c5839c22b53cc71f228255048cd833e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edfbbf3e550790382558a3032062248ebf3f02b9a2f552bac5f648879c57c5cf
MD5 20e261c8e0edb1981521388fcd4418d1
SHA1 5bc2c163c3436b53d403e7f87ca193032219b09a
SHA512 f81007668701b1fd815169e102b60fbb0a4a868a077bb119eb28875469a1464ff0485cc273a980be2610610109fd5c05b72e8f0a04c139a32fa3d1352a896018
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2949cc760d3790bf8d1bd4110aba0051b1df33d145e35e30706d9682d43b981
MD5 c3aeb3aa89ac92dfec66db524d7b4812
SHA1 ea0055fdcf3493f3c2a22ad641acde926696d55a
SHA512 9b959f3b5b8c1bb3ca99b7d610eee8e2cad684d275c1d914298aa8f52c0b100359902be1fb5da5eeb9ee3baa44e7ebb05cfc1df80e237e0cb499442bce102f7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb572ccf2626a11589cacdf77623cbb56faf15eefce649f158cca2ffcfeb2c03
MD5 6a95c2bbdadf22c316350158d410c3bc
SHA1 a45b9c4f42e66fe08c49dc96c6d1ce8bbc7a219d
SHA512 d47bf660cbc28f288930fcc3bad41ba80c04e98285a3faf5831e9ccc071160ae678a8f0d4034df0663355f3a5b1935c46648830875b8c119351dcf09b93c2ace
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e7b3455fa2026a39ae15a90cb173148ac4d65de0653e91237d555477d4905c41
MD5 71e92c60e1764cdf9cd3a7497ebf0de1
SHA1 88685275baee7fe6095114cd544202ddbe277367
SHA512 fd3f8f1c8e32f8dcbf039e5324e50687caec5a877d0f31f0397adfc4465b0156d6cfb458ce29916496bf87c6ac81c397b7bbb2cccb53529f0683fb09d4c9f9a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d7534d22cfa2edaa19ec89fb268dc8094cf3d05918eebf865055cf203b3ac2a4
MD5 d6476631895c00d9f8a3571e9988fb0f
SHA1 508e52109cd424441da940b1ca4679451ab40ccc
SHA512 27feb3f76553a1db324f7f159155fd3a3584246fd2442c088324deb4e70aa9fc32d1d8c814b30da691edb4aca76fd62777b47ccada19358f50bdf62c08075bd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\qap`g`v~dtlq
Size 10B
SHA256 6953772e182e035073bb21cce15d23a680356666e71e92b91ea69662b92b7bb9
MD5 d63ecffc3423b041e833c95882dca85a
SHA1 a8e5b934f2518ca6c234ed4f4f5b2b6c65cc1ffd
SHA512 aacdaa16bb7a2867c2813298181a9c4d22d4e35454ad392b61759d2a3f4fd46bb93b115360996b57c8d8de5e60479cb3a485171eb472639a2a48224cfa78c9b0
MD5 SHA1 SHA512

Submit Download

svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABABCBBCAAACACCBBCBBBBCCBACBABCABACCBABCCAABBACCBCA.exe
Size 1.4MB
SHA256 f0ed36d5582768f1e358efe90a1f57eca6efa0d82b9cb65daf67dbe4eaa3fde5
MD5 f57311d5c09f53e638e51bd90691dcb6
SHA1 7da82842b175fdddd8d83dbdf95908f4f0fcb1b1
SHA512 0c216d4f07420d04c4a3ba90b3ba291e4d93ab372ce9957568ee1da0009f88f6547e0c8954042534039597b5641a6eb9ab96490d1f5ede2de5fccdc12c46db3d
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+V:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+ExA
TLSH
T108652B1DFA4350B1DA2B51B04CCBE3FF8E607B2581228EBBFB0ECB1B7926B515419255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e4b06899a7c655f10bec58562d655ea2c453f050414f8a0879395a1a82b3b6ed
MD5 4170b0328a3aaa31b7f72e75b4bbe81a
SHA1 5aac881b463b625228236f0b18b27ca1b8cc5adc
SHA512 abdea8866af68781b14da7c140961db5855bb8cd114a18a2df1136ec06714b95b3b480aecf968c3b7d1884db516b7c2f86c3c65a8e64f608f0c6c24a1d85fa0c
TLSH
T1B821F761F0E8CCF7E53664CBC725C9E60C9837AF9C9CEA44131EA228A799C32DD558D1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d896ec11d4f9af6be684a39ae7a1cbff78fd4d62bfbe52ff0640748e2f0b4edf
MD5 98ea76a657690e514e0d70f05a89e62a
SHA1 daca01350ad26a80dbd5845c533b1b47713c1276
SHA512 f9d6b5a00b28c4fcb4f1dc4c9864d7d119c5ec26dc865a9625ee4a9989dc052a751cfd045b6a92a3a9f31c3d8432fb10ab83428c31d23cff60b58ae9e6994654
TLSH
T1F2110861F0E9CCE7E83664CBC315C9E60CD437AB9C9CEA441309912CA788832CD554D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4738ca1f947d66ab6f9191f9049b4189792b50da9303d2e260e9a9c55c57eb40
MD5 16b31a2d57dfa1d5b7e6a832bbc7b02a
SHA1 bc43208bb269e48c1256e5dabf97b6f42e3f1587
SHA512 3e9279e9b2e86a06c811b3454482ec090e170b0342bdc71a29a84203dfac0ca7fb3d18325e2b168ab633ac4127223cf3bea9177399e343654a84262727f65d15
TLSH
T14221D461F0E9C8E7E93664CB8315C9EB0C94376F9C9CEA54230AA128A789C32DD555D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-80-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/1484-921-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4284-6-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/5108-33-0x0000000000310000-0x0000000000331000-memory.dmp

Download