3b576dafe13b48bd891bb6e7e155900ef7060e1240fe0e6701e5af6cdd3c4b7e

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
Size 14.9MB
Sample260909-ecnb5sbk3v
SHA256 3b576dafe13b48bd891bb6e7e155900ef7060e1240fe0e6701e5af6cdd3c4b7e
MD5 36b1b546a28c3a337be67affd1670ac6
SHA1 7e365dd640b7c48d6cb9cef7ad82eca7694fd591
SHA512 98b3347c2d3b4deb5a1803ba62ff7e974df34f5789f210b7dc1b88a7ffbf94e7823f211efa413d5badd7831e177debfb5c04bf455d38a004c07cedee4ee4e130
SSDEEP 393216:G55555555555m555555555555555m555555555555555m555555555555555y:G55555555555m555555555555555m555
TLSH
T117F61B5CB7E71115FAB39AB08CBAC2F66D317D204730C7EFA605B6092D269D0E439726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
1572	svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe
712	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCCBCACBBBBAACCCCBCABBAAABCBBACACACBCCCCCABCBCABCABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe"	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCBCCAABBCACACABBABABCCBCBCACBCBAACBBCBACACAACBABACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe"	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4364	sc.exe
3384	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe
3312	cmd.exe
996	cmd.exe
816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5516	schtasks.exe
6088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
712	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
712	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
1572	svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe
1572	svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
Token: SeDebugPrivilege	712	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
Token: SeDebugPrivilege	1572	svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3760	1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe	92
PID 3760 wrote to memory of 5516	3760	cmd.exe	94
PID 3096 wrote to memory of 4104	3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe	95
PID 1540 wrote to memory of 3312	1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe	98
PID 3312 wrote to memory of 4364	3312	cmd.exe	100
PID 1540 wrote to memory of 996	1540	2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe	101
PID 996 wrote to memory of 3384	996	cmd.exe	103
PID 3096 wrote to memory of 816	3096	svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe	106
PID 816 wrote to memory of 6088	816	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_36b1b546a28c3a337be67affd1670ac6_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABCAAACBABCBBCBABABAACABBCBBBBCBBABCCACCABCBACBBCAABBAABABBAACBAAAABCBCBABBABBCAACACACBBACACCBACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABCAAACBABCBBCBABABAACABBCBBBBCBBABCCACCABCBACBBCAABBAABABBAACBAAAABCBCBABBABBCAACACACBBACACCBACBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe" start= auto displayName= "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe" start= auto displayName= "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCABCABBBCAACBABCABACBAACACCCCABBBBBABACCCBCABABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBCBBBCAABAABACAAACACACABAAABABBBABABCABBBAACAAACAACACBACBBAAACAABCBAABCBCBABBACBABABACCBCBBCBBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBCBBBCAABAABACAAACACACABAAABABBBABABCABBBAACAAACAACACBACBBAAACAABCBAABCBCBABBACBABABACCBCBBCBBBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABCABBCBABBCACBBABBAAACBCABBABACACCBAACCCCABCBCCCACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 76a1e8ad5633ded34fdaa216abe7759eed5f9ab1d94048ae3ffbbaa39da7d2d1
MD5 67daff5e9cf63200090314bc254fbeb5
SHA1 6daa170c2d1a7033245420745d413999e29ae7bb
SHA512 03f6939c822ef8c989d58e239b84142d549acf03ade336a5c834d0f5990505e854d0e4c65578de1a54a481a5dbe272043593246cc7d2f7605a782e5d46298d9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.LockApp_10.0.26100.1301_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 0b8cee29b814d3f94e72d8e0d772cfba7c100f395a72ee1e943ab999a6196f81
MD5 acab8d48d096bc11507051d22986b520
SHA1 c68a71c4338eeefa3e3110d441f60fda0c010bf3
SHA512 a9048e1c0101655e48f0914044d5d8d5e221540c83762e8b6172079aa4b73b84bc73465438c32235ae5c8dcccfd358572d9db84beb5e01ca0dcce9f89b4a4b6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 25db6a4d8951dba743f5e7935882fc9011176f89b27c241149bef6eb96267506
MD5 b8349383c9898860aaba707500a98c11
SHA1 ab8a76a108bee115d459e98641a9ab321ba11c66
SHA512 e65d95ba56593e2a99e6e564bd69b6305d2285a8c806d04842bc8b082564c028da0f6581fce8449248dead8be8ee3d8cfb6e2d031e67e668ae0d8380c78dc2a6
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 15.5MB
SHA256 690d291f49e03248aec8663152418038b1eec10f0589e74a844a52a4458d106f
MD5 5efdf422e141757e2f4ee8c4c3792c80
SHA1 2566771ab9ca3170ea265e8c32f77eac41beb5bd
SHA512 6b8792d76aa42779675e393aa7c1e56b026e0f716e2bc88e5cf52c6e761482596aaf5f7e36f4d89e334bc3c75ffc4121a54c66e38b29822f35f37c71380880ca
SSDEEP 393216:G55555555555m555555555555555m555555555555555m555555555555555Q2m:G55555555555m555555555555555m55X
TLSH
T126F62B5CB7E71115FAB39AB08CBAC2F66D317D204730C7EFA605B6092D269D0E439726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 d1b98f4ae9774f3647da2dbd93d30042a467ab9e12d603ee09306b46db9ec769
MD5 9630aa43da98cb2bed0f55a198f01abc
SHA1 cae6cbd4e1c3b5ff4abe11736a0590e305849e1d
SHA512 0777b873a43ed089ee063a5a7b1b6920f33fef61b39cfd2009aea9814c4b660c210e58487facb2cb01617e94b01da9f14281be8b07b4c80b0640966df0ae196e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 51ad921cad2c1dc81db9b4f30c761b06353df72ee93bf2222dc9bf8f0b0f0cbe
MD5 72ac1d204b61f34a07bd44ae2bdd12eb
SHA1 3bcf1feeef1d876ebc05a15b5bed7dbe5fa8e95c
SHA512 b3524718ab6253f1abf804511bbebca53e421906be6d6e662bc08004b36da27030e414ad0bb3aba932fb7283e4c43d8952d7e78d1c3d11661272e93a11fc1c75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\qap`g`v~dtlq
Size 10B
SHA256 0fbbf981435831cc399bcbd5e1389ff5c92cc7283042baf410460d162d2560b4
MD5 2c55ca1f49b174046e8e77060164d7ac
SHA1 685f61b5b0ed675307955ffe386dafccc7d5af35
SHA512 3dd930269b94bf1417a90a825dc98de0dcb60beefc8917e898ed95b67b26a8491278773cff8d97101f54536828a8b2bf5b011f88cde6c43e3cd22230dc87f7a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\fil\qap`g`v~dtlq
Size 10B
SHA256 c02abdcb516783e80167fbf1375494b7ec469dcf77c6d917a0593b1ae9104f3f
MD5 ba3d451438a0bfa97575792bc34980e2
SHA1 9f89178fe7e05b67e3d67477da75bf7dbfdbca2a
SHA512 528ab85c0a42784b3b0730d6123d936251992fee2241ab5ddbae31df8420fcedeeaf66a52b10a0ffdcecb6b48756ea1598375319474cad1276b38a3066288a0a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 9cc1a704b89b1863bc8a763910722c5c3db6388918d8332a618e126fb58a7f0e
MD5 388f03ac1ae8b9ed81754342d24bc739
SHA1 f478f2fda40d55395e65904683f7b561e257a7e7
SHA512 ee411cb39fa07e2790791136e38c7106b1a3491cefa7319d98d4b216654c39b1a18246cfd921f05633a7cef35dc9d07dd9eff5a713c0a87bf77af80701ed866e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 051cbe29052fb7563cc1e844dec72f50cd7e4b60acbc9e0c9b1d09dc67bb9223
MD5 2efca08f384327a89df5c29b3edc9d15
SHA1 92c77738cb61aa2900c74bc8cf548d82ade95852
SHA512 28a70a3911ab812d23910e23b37fb9fcad91e8705b77989e858a8ad17d90af76e67b2318692000da8e4a9a63ac40f00e05ec3f59b91c5fdf6917355c2397b341
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\qap`g`v~dtlq
Size 10B
SHA256 b6a22febb5e29501ee000e7529b44ec90244bf18d643c9aedf6f9c12dd18d40a
MD5 208aa387c7f0dd4f20f759de0e7f3ccf
SHA1 dd6b53a37c02c58d691acf87fb8d1e55a6735f5e
SHA512 ec6492c05330eed0e0c7d9dc0e30a0b941c01f6a187d316a9972f031814241a37e3ddbf9a8844033b3225fcd7ca63949c39bc811ea3c799422705812bbe95c83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf2702f87b988f9a90bc93dadd5b92b377c5ad0732204c13494d78eafc1810ed
MD5 9024f81152f5928218d8699859dad7e2
SHA1 7f26234f1c3c5cd2b12b7641c765693e91a27a00
SHA512 ddf020ecbc07fc3cd5ede115912800a697e2323edf083ce5b4f72e558238c57239484cbf35c11135fcc363dd37fddc1c82fe0949b4d57bcc833c3598a337a4b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aac3ffed6705964c628da9f29756425cf692d4d1dd92a1e169745605efccdfba
MD5 0f14b7a4a3f976da5f4281790ada348d
SHA1 8a44acad77caeb0d87274a8f12331475be3cc6a1
SHA512 9afe1a90ea1fa29c1b8908c6fdcceb3376533f6a45ab775196038f172035598da26dc7efa9f95960f88975222f432ff3931027d8aed4a07656b2f8e02c2a0856
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f18415a5e95e754509ad2640cfe74340c75eca0bc8d6bd871ea6fefb46d60d77
MD5 9751039bd8d2f7c4d740b48abcb4dd16
SHA1 68100c37bc3616d94b190e5fe8bdd0bdb8c44ba3
SHA512 db47f8e3da5479c9430a55d12e0ef824cff734a05d6c1500bbeeed2c8fd4921c293669912ef63241bd112ebecf248449a76fd5839dde0ce4075498c6ef7e15ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 739d6413097d8c91a2188027fff09fa695359c36531c893b9e3fad3e86d78c14
MD5 e65ab134cd6e834fca0c697f92b6206e
SHA1 290e0595e2869b306fc192a9ea3fccbef303eab6
SHA512 3fdba0f18aaf55146f27d959279fd6520d2b21a02fc126390a7345eb15ced6c586ecdaa6c3b89955df542dd8cf40853755360f371c178a55e8ae25c2ec4429cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4da86f35647c4bf840d26236d8edd8b70e50791fe74047392b2d3fd155c16845
MD5 64c1069cd68a3fab15dc28817f8c3060
SHA1 4911c215442ce00911856b28fefb2ce16f4faa20
SHA512 73dae506261df9eaec86f9fe8896a46bf12c0997fda91e34fff71313e43e13412b75d5ab10317a63897490650292e5c6be767913d8f54a2b60b97989a07e9ad9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3796abf7f56a2f425238e4bea43e51126a8703b1956f423e802238b1ae4bbe90
MD5 e3afcd7a4c13299903b75217196f9d4f
SHA1 b4d129c5a723ffa5a55f8750e80995920a69e8cb
SHA512 d12ba1fabaf8b0229515cbdd9a3bfa49242e0d0967b23098cf4e4ec527809a6f88f30d31c6c4f0c4d41f7f4c7f3e6f08493af1b7e3644d4e883b8f7b5e687bbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b179ff6fecf38e28742128a5f0fe87ae3a3ff17e69981881e1582c162de75174
MD5 73498b1bc6305322768525cffc536c1a
SHA1 4bb090c1ccad3a16836a1ee966af736c7ada54f3
SHA512 502aa7a1e6456f7a726f6e29d83350af47fddd00603aa8c8838fce467f17ec072ba184b2b8aae2881cb93ecc85afc1d8b61adbd41c70f70fa3ebf0830e0c0739
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Documents\qap`g`v~dtlq
Size 10B
SHA256 12fdd28e227686103d1f1c038d211cadc20f927e1327683235c048ac228bff06
MD5 0f484b61082e7e9224efef2aee9ea75a
SHA1 adfbdd8f8cd54578c7c8966601a46cce7d748b19
SHA512 f9cfc2162d32a0cf7070bd4d95cb0242dfff252e4fb7e2d75ff9c3ff65fa40943e5e9634638768b8c7bc4f9433c44b86da91e37547bd833bd1fe45900b1b4c20
MD5 SHA1 SHA512

Submit Download

svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAAABABCABACBCCBBCCABBBAABACACBABCBABCCCBBCACCCCABBCA.exe
Size 14.9MB
SHA256 3b576dafe13b48bd891bb6e7e155900ef7060e1240fe0e6701e5af6cdd3c4b7e
MD5 36b1b546a28c3a337be67affd1670ac6
SHA1 7e365dd640b7c48d6cb9cef7ad82eca7694fd591
SHA512 98b3347c2d3b4deb5a1803ba62ff7e974df34f5789f210b7dc1b88a7ffbf94e7823f211efa413d5badd7831e177debfb5c04bf455d38a004c07cedee4ee4e130
SSDEEP 393216:G55555555555m555555555555555m555555555555555m555555555555555y:G55555555555m555555555555555m555
TLSH
T117F61B5CB7E71115FAB39AB08CBAC2F66D317D204730C7EFA605B6092D269D0E439726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 61ad629ee1856b4c42c5faddd47398f3d004db9ac7733e653cfa3af12dbc8324
MD5 9c82211777f3236c29320d8527870470
SHA1 d6cbc6d90ff8479b8b15bd5ab7967eea2ad797a4
SHA512 7e050b72f06a8b942948245f93986c32e7d73f8549bfcf5ba74c5de4178937a279a7658f199aa70e7861a3530fe2abd4b02b94e32f5f413d0f5f5996fa9afc88
TLSH
T12E110B70E0A9C863F031D8D7A629CFDB0C947F9B585C9B20121D4218FBA98778D0A0E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 02e8653185b1e55a1aaf4b31cf1e1115a521c7f106df8165beb7b5dfde3e8a95
MD5 d0b40852134a2fa372451b54e3c912d7
SHA1 ff90c3f04f35ec4521d43051f9b171282ed5538d
SHA512 e5f9a2dde5dc4a3a020dbf13f8f7bfd0003fb642d81be4e0e8c0fb0a11587529eafebab2cdceee031e1f19a5e313ecc366efa91c699caab45988ed993c40effe
TLSH
T18521BA60E0A9C867F031D9D7A629CFDB0CA47F9B585C9B24621D4218FBA98778D1A0E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4663b05251bccfc986cba0ff66a561644b7cb6e8ae2ac3031780d4aa9d59b1a4
MD5 35e5cf11fddd49339a87c90292a228fe
SHA1 7eca57c8ce1309007618881925ef27ee3c52a498
SHA512 528788c1f3f62fa6f97e588cc897c59af7740dbabd82f51b9dc29ae06871be9632bd27749f9a6e24885013ee35376df2c61a89e138576b55788603cc2b7d611d
TLSH
T18A112B60A0A9D853F031E8DBA22DCE5F0CD07F9B585CAB3422094118BB65C774D160E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/712-1461-0x0000000000380000-0x00000000003A1000-memory.dmp

Download

memory/1540-6-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/1572-67-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/1572-3967-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/3096-33-0x0000000000380000-0x00000000003A1000-memory.dmp

Download