9d608fc2d3a519626102539c14c9131314798ca859e8d61cb559d54e3afc60ee

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
Size 17.1MB
Sample260808-edndjasxgv
SHA256 9d608fc2d3a519626102539c14c9131314798ca859e8d61cb559d54e3afc60ee
MD5 35cba680a7ba42cb6b2327b76da0e5c3
SHA1 a79b540b2a6e9f44a5be21b9366b43440693d269
SHA512 a000e32b93550156fc65990d7be23fc01c1d0d30501493a685183d080dfbfbd7bdea980985ef43abee526370cde51a826e95d2a08b52ff116455da48f4395f8c
SSDEEP 98304:lKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5aj:lqNqNqNqNqNqNqNqNqI
TLSH
T134077D06FA8340B1D97B31B009DFE3BF4A79772185318D6AFB4D8B2B6933B51581835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
5984	svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
2872	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABBABACCCCABBBBCABAAACCCCAACCCCABBCBBAAAABBCBCCBCCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe"	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAAAABBACBBCCCCBCCCBCBBCABAAACBABACACAABACBBABCAAAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe"	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1184	sc.exe
808	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4372	cmd.exe
2376	cmd.exe
4360	cmd.exe
4600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3484	schtasks.exe
476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
5984	svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
5984	svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
2872	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
2872	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
Token: SeDebugPrivilege	4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
Token: SeDebugPrivilege	5984	svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
Token: SeDebugPrivilege	2872	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5952 wrote to memory of 4372	5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe	92
PID 4372 wrote to memory of 3484	4372	cmd.exe	94
PID 4832 wrote to memory of 2736	4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe	95
PID 5952 wrote to memory of 2376	5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe	98
PID 2376 wrote to memory of 1184	2376	cmd.exe	100
PID 5952 wrote to memory of 4360	5952	2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe	101
PID 4360 wrote to memory of 808	4360	cmd.exe	103
PID 4832 wrote to memory of 4600	4832	svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe	106
PID 4600 wrote to memory of 476	4600	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_35cba680a7ba42cb6b2327b76da0e5c3_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABCCACCCBBCCAACACBCCACCCCCBCCAAACBAABABBBABBACBABCBABACACCCCACAACACBBCCCBBCACBACACACCAAACAACBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBABCCACCCBBCCAACACBCCACCCCCBCCAAACBAABABBBABBACBABCBABACACCCCACAACACBBCCCBBCACBACACACCAAACAACBCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe" start= auto displayName= "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe" start= auto displayName= "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACAABABCBAABAACBACCABAACABACCACABBABBBCACBABCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACACBCACBBCCABABAABABCABACBBCACAAAAACCACBCBCBCBACCBBBCCABCBCABACACBACACCCACCACBABBCABBCCCABCBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACACBCACBBCCABABAABABCABACBBCACAAAAACCACBCBCBCBACCBBBCCABCBCABACACBACACCCACCACBABBCABBCCCABCBCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBBCCACACBABABCCABAAACCBCBCBCACCBCCBBBCBCBBAABBCCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e1e0b48224ccb53bbe8b782976294c46f222810e63b31647fb6d902affa5d6d1
MD5 079d175818b1340ca3ab9a070465d73c
SHA1 1a8d0558cfccdd1da2321861d37af905b64cb87e
SHA512 39569dbb3f86e017456e0f396a184bf854400f6352061ae028f89220bba8c5bedfcca70658d0fa61ff4e73ec8a8747f842b168d97bad22fd15b15610538795e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 1dd3e69b28ebe070614fc9c4e535cb2c16dd168a86493e975a0222d8deb11247
MD5 5cef3d6e23e5148be4afc7d5b9caf097
SHA1 84d404bf711c9d269dea4add744f4e67f002a2f5
SHA512 125302b8ceaf863d4b826af641a7322c12f33379c1c387ce9f24886d1c242e51f4c7e326c1d7750cd7ca07a819861f0f695057b13f3a6ffa5472235061071ba6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\qap`g`v~dtlq
Size 10B
SHA256 d161bbf56f5729a1a213700960a5789afe48b152aca6364909eaf722b85e72ba
MD5 efb2b46f55396ff5e32f479adec1484d
SHA1 7974868a1be7ed93f5c62d5de196ba2f4f0c1b1b
SHA512 be791edaa83f877a74896d12b33548f1eed9cfdb01e40b23ec48d1dd12bae2ad4b4ee969c678ee1c2ba7153f562f72fbeb051628eec501e023cd51c6a7e893af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 e8dd436932ad40083b311d7111bd28ac64ede7a2de6c7b6f8ebf9fca9f404960
MD5 9f199480aa0361eff8e4104ace9f66de
SHA1 e4d93a69a9ec287d3990ca40eb9b340a4679211e
SHA512 d05d9fd25518c76b63c51c8d7a78f443f159668348e16790ee0a806b50d41055d1c63c6cf3a7871f979888a3576898ad5dea06764d888ff2da3e7aa4693afaec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 49f0fec840041f80185393a043293b1778771c666146764bb2935318c79c5f7d
MD5 48ae14bf93863b9ee9a12439351ffc98
SHA1 80992f2c2727fd618f86c313c759e1fc3ec7eab6
SHA512 01a0579e9058090193ba9728c69e22f517b9b16b2e81489ca814e97d046f4ca64688267cdf1ba998d373831a643960d7859274949c4417d3dd7f8c31134b1f45
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 17.7MB
SHA256 708bba3f59d5a9b76085d1e4edfd3b9cdc7048e4601a37e7178945e8c3db244d
MD5 be388e8269cc0fd2a5cbd347321b8e12
SHA1 45b86bca847277580c68d5bb41f4b55b18b15378
SHA512 38d1f9ba048f0932dc91f9ba60bbbdd65db6a148569910788b3b35c29634d8c24c4c22e8684d2032724a99c13ad367ce9b8e45037945222556aaeddc8437fd22
SSDEEP 98304:lKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5ag:lqNqNqNqNqNqNqNqNqHgZ2jp
TLSH
T1B7178D06FA8300B1DA7B31B009DFE3BF4D79772185318D6AF7498B2B6933B51592835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 da13cadc2e026f388f1a90ea29729d06fe09e678544477b673a80bbcd51f8b74
MD5 8250c6a071aac35784c7c0ba5b428fdc
SHA1 93452ac67255cfb14a3ed87a72e6af6ad4d008ca
SHA512 2e3db85a9b7eab2d60dd740469008b6809bd3f0a2eea11f29e17dbc744b11a86e750912e86250328a9091c6474059404025507a1d3190cd2e1ee87782e9476bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 376eb340093d46ad7fd47183de6d1982d3d1eff651bc51194867e2e437cdd234
MD5 1149909215810defc210821f01e28d07
SHA1 edaf7e5da9ef7a68802cf64dc42ed9f4985bc38c
SHA512 123cb693befc148967253d9eb701f5ef569bf919daf527049575d7ac31754e205165ca0771e95adb76b6b2b0dc2f8acc2fbcc96470a05700b1177f0e49b83705
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 da4235cf0131629826a7668ad5e96a437cc2338b66314b097ec0abf5c7ba4447
MD5 19c3e10db9be47210c9a4ef4766b23e1
SHA1 7bc7edf661b7d88e426eaa668432a033b8bfbe43
SHA512 c0e2ad8dca019a41f0f6198943498b0c6a19f354335be8e88bbcf786abd8e4997a7082d5dd20b03534f1525dac22d675ccaa84581f5bdfb3e1b97d0091fa74ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\S-1-5-21-189034102-168398478-1159367937-1000\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 d02fe6eba3fade8339d2781100e8a5f9e729052a49bd0ecc20e401e19f4d01f7
MD5 8f91a45a702d30db8f39e9d7c8aa8999
SHA1 53d47371f6ef73747df7a9a1ef66cef4cf926aa8
SHA512 d0ad006ea124a2ccccc3d036762eec71968bbd85838fe8720b554a1eed87f96e2aceabed74aa66f501729b7436f5182bcc2a4c58df0b27e95edce7d600ac6439
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\qap`g`v~dtlq
Size 10B
SHA256 f14df43f820ae8f14eb391a90597f6f780518055405d9f5e274d6ced584bd5ed
MD5 c36abe8e25c50fcf7e51b30780313f17
SHA1 a00a7ff167d9801e406aa9e58bcffef5f96c9045
SHA512 1db9f3013b49b0c8ccdd91089e12f7d4bc427ec27b6b296f377551b190078207ccdbf19d1b2def1233e1abea77b98b5abe15483275af5e4f6b34a9c0e1bf0682
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 10d584086893e9f91119339b62995636f4ea50c983cd2bb613de3434106e6645
MD5 ab4ad776ce032e001c8d0a9da66f5c63
SHA1 f60400f700d9c5c3c4f75f707a2bd36ae240b882
SHA512 7251de66db1acbde886dff3af5cb7ea9320c97604a98ee75de567918b62a6f9f5ec2fd63d9faa4c45f5a8eabe2d39233f80463aba2d7186987a3364ee34b6d07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a594992a5b11bc9737df55aad0e082f2d9a3f5f6f696f72179c960f97de7f417
MD5 23a5017a4ce1b4fb57adda46d02a2fb2
SHA1 8a2f65d2d5d1bc7814fca96f7bb1999b10d7eb30
SHA512 b696a69fa97c1dc4351067af6b9b0e21bd7cfa6fa4748f09f1bd6816fe5dfbccc9a309988589e70cfe5833300db743c26ddc4c233792a596940e54f1effde001
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\qap`g`v~dtlq
Size 10B
SHA256 cd62e7b91682056b017bcff910ecd3647ec3177fa0898667c1158e7a4c19803a
MD5 fd1d8efa2cd6e59003db8c7d7476289d
SHA1 80fc92e701f29ef08dc42764bdccddf7dc28eca1
SHA512 ea15e8ecf2ef0bb34625bd09f7893919c946b2ebd5a27f82f1522b66ca974781a0a61c443a3d117102449c5d2edfb9614194ef29d64767ceb20240c0bca128d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\306iswdk.Admin\qap`g`v~dtlq
Size 10B
SHA256 57a03d97cf04fbff9357c38c702a2861683d0ffcfc734a12d14e84bed58dd4e2
MD5 56fb35359a4cbd75c1eddd6e1fb22ddf
SHA1 7caea05d54b5098e6b8b498229cb81372c00205d
SHA512 504bca6ad3199d9f10beb6df0a28bf539e94d4178ffa827cd3f9674592262c668af8f9eed66ec129837f1e0cb8f956e70af82739e897fcd1422ec856443fe3e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78b2d7746b395c04abbff5a8e1b2c68064eb5a952bf78b80c3fbc1d68c9182bb
MD5 80b940dea69ff4c86e77c144cd7d5e6b
SHA1 c3229bdbee5343107d5f429dfc5e545543431828
SHA512 670488c1513cf178e5b4eae2d0c2bae2508f41eab67364c1a6d1c6a243f47166d5c658d9d6f75fbe6022ca16d03a09118b2b0fd24210cb571582bd2d859f86fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3505beabe6e64f844abf7d262c40ecca0740a3311811a3f5a3b2007d84ca7edc
MD5 de87d8fbb09d5d05555a8f294a68cebb
SHA1 bc4c3a660ccae7b11431e5e77fa063c3e2cf626f
SHA512 bba5daf1288126e16cfbdd548b8203f333338b49c5f82dfdafcaf9e47fd179c5e2cd28b300889a526192c259f5d73e864006b52da9d8bdb63e7e947bb5cd9114
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8a34ec9e205a98cac29d127b15d8626c1352be79c4303f74698f6f132defa49
MD5 fd75f612de146644f0d72ab4bea57194
SHA1 b08f2e1824d3b20aa8c055868b18a0b832458736
SHA512 b3281fd009f9471ff5ac4287f2deb09c32b2e1265e6097e727b2b5175d9a7baebca290ae2e07218b3c9f6c77039e0dac52a6aba833cea7f9cbd9dbfb9c14196e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 49946648d4de9d24862a3315867373f0d9649d70dcc412fcb47a353a704b6176
MD5 5451b2235c707b27b73963bfb705b08e
SHA1 55e635cbb3766895dbd5544f6535b1fdd421e098
SHA512 09e8cfc702cce5532f68876bc59f1c49e1bdeafd3fd733cd3db908df16dc2fd7a580e00fbc732d087546fa989566d592aa0bee4e4923838abaf91725c8f0a03d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4238f485d45d25b23db0dcbcbe764ffb6e9e551422b76d12d03cc94cef4d608d
MD5 03eaf149123a27e5d2db644685ba08cf
SHA1 74b48e9c9b3483947a0e6c0e72bf91c7a6844927
SHA512 4364e4c8bbabaa110a12bb50bc37154737a6c7a031e5a411bd2980b2371faad237bc070b2ee4f115518e475e9f8970dbcde7fb941843aaf73ac8a986fd168bb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b7fa7e191c822ad571c82e6e26ec3915658993533a2f8aacbcf30368f852042
MD5 7d343456732bd336ca50f3580e3d86f7
SHA1 e649ad76dca3d1715ac8fedebb11fc92559d8e31
SHA512 29d057cd59789303ca6e023934a37d807785b899a42c81cdb682dd793d87761d19361eb98f46748faed9da85ab435269311ebd66b0d9bfd2613f51cfae3783d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c1b839ef618934dcd87dc6a050ff462585fee318cfc4b68f6e8539cb0d1a64b3
MD5 6ac516999294648a6296acb9cf813db8
SHA1 d07dc62fcfd29a10bc51da29da940e06406e42e3
SHA512 97db4a3cf35793e147a6e13a421e049f2b0ca1a4b107d094d7f5a769889c4572f7700d2424dc0c9d00cd092c81616c311879b014ad92449f28a4499f58047f35
MD5 SHA1 SHA512

Submit Download

svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAAAAABCBAACBBAACBCCBABBCACCACCCCCCABAABBAABCACABACAC.exe
Size 17.1MB
SHA256 9d608fc2d3a519626102539c14c9131314798ca859e8d61cb559d54e3afc60ee
MD5 35cba680a7ba42cb6b2327b76da0e5c3
SHA1 a79b540b2a6e9f44a5be21b9366b43440693d269
SHA512 a000e32b93550156fc65990d7be23fc01c1d0d30501493a685183d080dfbfbd7bdea980985ef43abee526370cde51a826e95d2a08b52ff116455da48f4395f8c
SSDEEP 98304:lKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5auKRuy5aj:lqNqNqNqNqNqNqNqNqI
TLSH
T134077D06FA8340B1D97B31B009DFE3BF4A79772185318D6AFB4D8B2B6933B51581835A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ee2ba4cb45608f4bcb15eff4e96e63fd69dc17b92bf5003c5bba8ed3a077dedd
MD5 81b772e3eace3317e2232dfe983e74e6
SHA1 bb1b1b73a26d66939c35e589927f5c36db44a4ef
SHA512 6486392cb049939b9f80817bc03c12ba309340d1f54ed7d8706a2da8b4e8571b031d67053f89d3f44b43b2c4a5fd485dd24ecc44b224686fde067d024c54fdcc
TLSH
T1A621D820F0E9CC13E52368CF9A29E9E34CA4379F9C98691593594118BBD5C33CD46CE5
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 82143d46697f0462ad226a42470aef90fd8bc84e270a19c4a9a8523c9ea93f84
MD5 6370b2a5665066ddc6a6d2c1a8c0a8a8
SHA1 3d3ea43635c345011f7a3011938693d8db20634b
SHA512 2933f37d8d8f0bf85e5fa2c1f123866b99d0ad5d4dd052b254b83d643d58f3aeaa0f030c446cec23b80a72e67f33df55e0856f9e6a5968ee34876bff8482adb2
TLSH
T152110410F0B9CC13E43368CF9A29E9D34CA4339FAC586E21A3594119BBD5C26DD568E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d97d30b1d8ffcaf61731ae42b6db42f45adce65426fce0f9d07dc9c915fe76f7
MD5 e9876f0cadc693a77c98b90cfb59ffa3
SHA1 979eb794465790d12e4c5695b39d6fe66f5fd597
SHA512 0e5573565646c58e78fbdded8b5d4453a0195326934e5bd837a92b0d257b72f543e50fb0245f1d15d26c34523e637f9b1c62ea39efbdc30bc69b27dd298e2875
TLSH
T103212660F0F9CC13E43368CF8A25E9D34CA4379FAC586E25A3594118BBD5C22CD46CE6
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 eb00317c895e618433a4f8b5bad13e4543264fe91cb6d10fdf02db82de54f331
MD5 57d62b5f10085b9798c76e728bb4e592
SHA1 ce00fb890067f042de4968b6ce8ff73cd722b89f
SHA512 4c5e2b8ba6e234ce2f6a115aad5ab9b5b19d0b44b12acc4853091476e435385ab8a88500e092d5921f7af6838398b6f75448249d86ff603c3c945dda1202ff58
MD5 SHA1 SHA512

Submit Download

memory/2872-1512-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2872-3929-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/4832-33-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/5952-6-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/5984-72-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download