1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Size 20.8MB
Sample260813-e2tv8a1hkd
SHA256 1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464
MD5 8251f64005da2fb64973baa85c95ad96
SHA1 f575165373234387598afe7551aeaadccb18a860
SHA512 633d91b04c78d5691b3faba5bcbff210a05981d074afc283005cb5e02be08922823d6ec68f4b6dfe11ee6dff34975f1e00746ab3738fddeb9919a69ec84b2ed0
SSDEEP 49152:U+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESa:T
TLSH
T17D270909F94340B1DD2B50F04DCFE3BF8A60AB25C6128EF7FB4DCB5BA522BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
3276	svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe
3580	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABCAACBAAACCCCABCCBCBBBAABCBACAACBCBCACBBBBCCBCAACACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe"	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBAAACCABBCACACCABACCCBCCCCCBCCAABBBCACBACBBCBCBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe"	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1244	sc.exe
4716	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5992	cmd.exe
1080	cmd.exe
1544	cmd.exe
4264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5904	schtasks.exe
3532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
3580	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
3580	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
3276	svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe
3276	svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
Token: SeDebugPrivilege	6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
Token: SeDebugPrivilege	3580	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
Token: SeDebugPrivilege	3276	svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 5992	3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	92
PID 5992 wrote to memory of 3532	5992	cmd.exe	94
PID 6000 wrote to memory of 5888	6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe	95
PID 3772 wrote to memory of 1080	3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	98
PID 1080 wrote to memory of 1244	1080	cmd.exe	100
PID 3772 wrote to memory of 1544	3772	2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe	101
PID 1544 wrote to memory of 4716	1544	cmd.exe	103
PID 6000 wrote to memory of 4264	6000	svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe	106
PID 4264 wrote to memory of 5904	4264	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_8251f64005da2fb64973baa85c95ad96_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABAACBBCCCCCBCCACBAACBBBAAAABAAABACCAACCABBBAABAABACCABABBABACAACBBACAABCBAABBBCCBBBBACACBACCCBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCABAACBBCCCCCBCCACBAACBBBAAAABAAABACCAACCABBBAABAABACCABABBABACAACBBACAABCBAABBBCCBBBBACACBACCCBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe" start= auto displayName= "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe" start= auto displayName= "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACABCACAACBBCCAACCBCABCCBACBCACBCBBACABBAACAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACCACAAABCAABBACCCBCAABACBAACBBBAAABACACBABCCACBAACBABAAACABBCBABBACAACACBACCCBCCBABAABACBACCBBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACACCACAAABCAABBACCCBCAABACBAACBBBAAABACACBABCCACBAACBABAAACABBCBABBACAACACBACCCBCCBABAABACBACCBBACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5904

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAAAACABBABBBACAAACBBBCABBCCCCAACBCBCACACBABACCBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3430d7933fa65ccab95483226eec51d5e31933642bc90fe55b39443beb409d2b
MD5 05c7caef9d1437fa50f4646c55ec0086
SHA1 54aeb79ddcfb71706890cfebacb7b26a1add718f
SHA512 64e93d00713fc6fa179561023558968da41c9ef9e4f36a259559386a2f4e333048014dff7f9bc1591dc1991a02acc78921c267170c2a41a813d494428fa2bdc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\Setup\qap`g`v~dtlq
Size 10B
SHA256 3388ee6f3f9bf1820a3547e297b6f1a1e1e22b84a0eb149e4c03ee4db5751421
MD5 2307c5741bd8769b675cfc62fe7ae432
SHA1 550961dbec5f81cdd780013cb4ae0372ad9f2c5f
SHA512 1014d3b782a694b009e5e0acba6ab177399e34a231aa487fa93dc8802d778d48798bca8ade16d0bf6331f18f0b253018be64513c77dce0d79bfd156fc41c1302
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 d6f477fd50c24af2daf9618a2e439256aa7885d5d19ba37544bd42273431100c
MD5 c0a70e2ba4cb4765cc383ce37b3b494a
SHA1 f4f1283431abda777d863026f4607b8bdd9157dc
SHA512 beaff5464ba725ca0fee826ce25c1f9592a0c1c1c9902be2585d7835e109bd60fd73c7b40691a2935eae07869ca7af767951c029327951abf2f3d4841df4f489
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 70aa93d8a539844f65c5706b9b5f9048c09ff5ab4deb83d873d3f448d2464a17
MD5 211ad452ca5d8b7093ee02b521e5e2db
SHA1 0df0d2c486fd53161649d2ace7b1e011cf8db0a2
SHA512 4af7cf1c08ae8fa9d97f785b226241facc34496411f180fe92a172b4126c3989a558a6452def49605661fa787c90f0580d9933a9d24426be084b29fc81623afa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\qap`g`v~dtlq
Size 10B
SHA256 c535e5f8bbdd182d77327cf02209d646ab0ba310d9175cf882f4adbdf138c1c2
MD5 d8132d59a45fd64d7df1c64b2d9d5a20
SHA1 41f4ef3ecd3f51e4c135b20baf01b80ca216c0fa
SHA512 5591d6a2af9578c7a46a9c0088a186be97a94488fb347bb63ad91b2f8dcaa8b0e00d71371efa10ae07e7c9a07937cd61c6c70b70a94d125fcc55a760a884d76d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 21.4MB
SHA256 22073f6f968f1550cf487193fbdd835a71b0dbccd5fd719d3b4aa31c70f4558a
MD5 0b630d2c588f240033902486a74ba4be
SHA1 38fc5939e56bc9fe55d11ccad708d68ec7cc2fd5
SHA512 b5458619e09361ef856c2050ee8c6ee7a23a21300a99088da5a00eeea773228af16774bf767938ca027dffdf071fc0718d9d84ebb2797b6adb707e59b30f2413
SSDEEP 49152:U+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ES6:WgZ2Hb9t+2xc
TLSH
T15B371909F94340B1DD2B51F04DCFE3BF8A60BB2586128EF7FB4DCB5BA522BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 d75eee151c25472390f874d438eb8a5aa7f48536b77067db9875f1b109939e76
MD5 d16113465f7ed35b0369bc3c978bef75
SHA1 93889a14ecdc37fe188809414c19b41dad563f21
SHA512 7dd165e9d2283c6741e8cb2855680e3bbf511705b3701aded03b70f3ecb1d0cb450217930d57d8863bd9aa86804f7d4959252eec727c2828ecca622563568f5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 0915878c82f4589accfe656dd2d1cf0706fb9aba27975c4554b7bcd3333aa473
MD5 660dee1e85fd59c64560fdefdc9553ee
SHA1 79fab64c1ebadb5b76c7f69b30e8c9f4ebacf453
SHA512 d9dcfa15147cf36a30cb43c83be9e593d2c575af775ce08f0bf3c48048fa36c0af41f915c6fe6a12a88463e6b9a0a82446ae560c156adf1dd0acd762b76e1967
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 9d5f4280987f4482bbbc12769df060546f228cf96bb02e01c4ffd3d378fe523d
MD5 a96f6fd1eca00d93568a1ba2dc202a3d
SHA1 ef7b85a94384a77fe97677b2b658c160ffe19bb7
SHA512 670110fba9e74627a4107586a7f5cce1758afe6d4ad6769ccc649b0df4d2940ce239443e94254138ad9a683a4638eadf9ee1d1aa359a73e39e47a8165446ccbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 cb745e78694483698e42ec94757e494e82bf9bb590caa0052eb5cefcf481941b
MD5 8da77f0b8ba0cba1e03bccca9be7a0ed
SHA1 3c64fd2160fa1ffd6321dd8614166017d1110ca1
SHA512 4fe5292f281e092570218f3f67a6b7676a7d8d4e35a9a2fd61943dc54f427cb46a7a0415af75c488e38799351b97dcef1f4b85b27faa980e1d019b2c5ce300c6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\qap`g`v~dtlq
Size 10B
SHA256 516fc1d8dfe33a7a81db1df5a03b28bc82d6e2cbb1c89ea7382036a9e6045397
MD5 b5d1511a5c0eac6d7d3d26a4b9a02f81
SHA1 bb9a38dee38582c2be462c512a6b43fae2d84621
SHA512 1fa37a2b9d4e3482eb691d32d0b4f19620711fcf39fd629668d54e8044c8749cd2d07402d24f558e11aa9ac634cb3a0815dd1f214bd92307c47dcd62f9dc578b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\qap`g`v~dtlq
Size 10B
SHA256 ce1e57cc870920adfa612619bc0216e46f29b985c1ee8e6cbfaf26d0381811a2
MD5 11a62db7d9728173549b00aef327d6be
SHA1 5fa8f1fb8244fd2f21c8b9cf1f9ca4c68d0b0291
SHA512 01298e5fab2ba2928b5b4549de035663b09bff019b5fc7b514c743ee1bb18846e40ba8779dc83ff2ae605f5e780d9f29e09548711ff2d7bad0bdbab2088966b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ha-Latn-NG\qap`g`v~dtlq
Size 10B
SHA256 8260ab1881e4d37c83d949810e8114f65b200c4f4c9ab0e3d3ca2d23b46ab5f6
MD5 80b082b6415318f16315db4acfa1d90d
SHA1 11a599c39df0ca79b2c9bb291f82cf2d90d6d3bd
SHA512 ceb64da59c7ee8bb77dd77de5c54ba7b2b25f0c57e8d9cba8cc2ef99d68149ae5f3e3d9f336ed831704f09efab0aa09df833db1f0e87d306652c9be98a417b89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 4322f2863a72ca084265db63a8560e6539ad42867125716a57a48efaa52d2573
MD5 b36caf570ce3847beb44b4a044fb7dc8
SHA1 2b084302d5740f08feb224c6a65442cc46328f16
SHA512 106524f5de37830bf1f24432fa2a3e9d90dd21f0f03cb0bacf653c4f3c3c054bc510808ed70972383a3ce05caf380ec4e831091aae76d37babc002c72a5dab3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41dff47e9856c7871749c009483efe68aff0216ff0f5384f733972dc0749bd98
MD5 22fcae8678759b82bb44d3517d70b4d0
SHA1 f1b3ac5f1b0db25bd6d0afd2dbd6950ecca11705
SHA512 ab8872f261622d8b748a771e1045b486a8c979299e541b5eb346befb0c7894700d77a12f0c651923eed3a2dee25c5ee480ff845313191a964331691bdb9f16d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30d784f4c156c3615f4a37a33b596da8afc16d626ccff3c43cbdbc9c27e8a3bd
MD5 a4d7bbbdc4fa63c4b216490257a3146d
SHA1 9480ce5fae66626b7314c1dfdf4381dc909058de
SHA512 5761e1d380fceef312b8b3455c9eb948a9122ba0b1337f5b9502c276880ca41f3473264c7d995d5dece898c071993fe7bfc668209ce33886258ccddf80a4e609
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 470ddfce265a58f4e4cfb815b5771db32e5efef2a7307dafea840849e8d30d84
MD5 e0bcbb0f96bb11199c124d78550678a2
SHA1 9b04fdd899f1b3ae41e44fde38cdb9c0e1f11671
SHA512 13db3e2c5b647b49faf1c45cf5122c1c9842299a669a902b50606c47195cb4c36d3e24ec61c37766fab84dbd6e748e8b9267c4c15d7d1ac19408511c794668ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8127be46046b93cf2878dcca450b51dfc7592fc840ddbd9fb4ed53ada9c0de5
MD5 549a56346ea65dab7a1d174c2a18645b
SHA1 8fa60dc3ccdeff029b31943f60d8619ff8dd248f
SHA512 68e0b3cebc5d14541e25ead93af3cd1832eb0569dca0f0268d804bf6576d671a790350c69a5c13e76f52251c7fb3bc9281945613a2218af6f74fe066d295afdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 321de87669315910113a04608a5ab70d082f9c390f6cca35a335f5e9b2163c72
MD5 3eb4ec1a75c1712279094dfff8275b64
SHA1 611266ec598eb2c67006d40091fb69f80e67cafd
SHA512 b3cca2d7c1d8d4eecf97094622eb6d59a1ad608a8ff3dc96053f43090fe3db592da76ecd6b50a30167ef7f8c812d53dfb72bd3d3a3ff9807381f2871e56ab1fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b41b72eeca997f49e388743eecc858c314b684b2ba361858b24d94b8ac5f584d
MD5 1cea021c48b20909b8a1ee9c7319d1bf
SHA1 616643ecdbcac2cbc1cf74c0c9dbf37384ecc77a
SHA512 c42690fde2ff0c8c1cb98e5e0aac6a73ab7b634713b1a64e6768995781daf7bd7560d8bd26d0cd0329c933aec13a0e1bc66ccb51457173187b075ee7b4947aec
MD5 SHA1 SHA512

Submit Download

svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABCBAABBCACCACBACBBACABAACBBACACABBCCCCCCCBBCBBAAAB.exe
Size 20.8MB
SHA256 1d243673792c4adbf88a71a8ac212f7087f35c6773dbe7e8e4b7cfb74a643464
MD5 8251f64005da2fb64973baa85c95ad96
SHA1 f575165373234387598afe7551aeaadccb18a860
SHA512 633d91b04c78d5691b3faba5bcbff210a05981d074afc283005cb5e02be08922823d6ec68f4b6dfe11ee6dff34975f1e00746ab3738fddeb9919a69ec84b2ed0
SSDEEP 49152:U+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESB+ES+E2+EE+ES+Ek+ES+ES+E2+ESa:T
TLSH
T17D270909F94340B1DD2B50F04DCFE3BF8A60AB25C6128EF7FB4DCB5BA522BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b50c496abbabcca25112fff978546e6aaa9df7e95e1dae605b124e5592e0b6a2
MD5 a990e8956d65bbc3d83a4785e3378d1c
SHA1 fe757bbc87ebfa463ee835097c307086317272cf
SHA512 38d28fc84545093a4968d3e62191a50f391db3564a312a0fb2c31ae39e8127b9414f932ae869c8a34a353f1780bcc4389c585035f4743b00f08fdd9cba0cf935
TLSH
T16E110B11E8E2ECA7F92364CBFA3A8B821C94329F989C794413098319BBD4D73CD494E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e22dacb7565852f2ded54b603fbad7bbb50a195b4abdcaf96893fd5b740927cf
MD5 8b3f63e95344628085e2ed1abecd0199
SHA1 f6df1d91986063aafef6b1469d3bac818b06fd5f
SHA512 edad81faecfcac5bc8b0c748c1f95ab31b166edf40cccd73b425ff42c87f5ea6f56ca0b0c5943bfa4bf10c4598f05395cd60eb86afdbf058f99aa3ef283326aa
TLSH
T1D5210C51E8E6DCE7F92364CBF73A9B820C94329F98DC795412098219BBD8D73CD494E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 736B
SHA256 74edbbbb8856d91eb3f24bd6600b79fc6f8aa475ad3c14738ce5de3c8185239f
MD5 bcd63f7def34c6998f88cabb36bd0dbe
SHA1 23415b2fdecfcd64787dc22a006f4a7c967e0ab3
SHA512 2f5b07327ed05314ab9d11b9ae634df3891619fbb20c2723f40bcc6fe5833ff3b442b737c449f91d9a1f4f4e72e3507c5145c7e741d5c517d4520e51758ecce2
TLSH
T14F01F901A8E6E893F83328C7A73A4B821CD4329B58987E482205431EBB94E728D554E2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Public\Libraries\qap`g`v~dtlq
Size 10B
SHA256 4f4764264b16380ad22b378480f1c01362ad14fa303202ac1d8ac42e576de37a
MD5 e0940d11f2ffb040b6a05b7c4005c2be
SHA1 e9d651828c08f936b31860631ec804d3f5ca7091
SHA512 2dc283e45ddc4b5acb8b30a63d64f1e2c99634c18d6ad53fb78929881c7e409c441db9d2f855289ca7adfba6482157d80aeae466d745531374d77d59eb25527c
MD5 SHA1 SHA512

Submit Download

memory/3276-69-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3276-3922-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3580-1522-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3580-3923-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/3772-6-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/6000-33-0x0000000000950000-0x0000000000971000-memory.dmp

Download