1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Size 845KB
Sample260814-xhmlxabd49
SHA256 1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb
MD5 db222b31f5185b48da6685e91c3f97c9
SHA1 8873f2215bb90cd0bd0ffa26b5489665569758d5
SHA512 582108d7f59476e2eb721841a807649c335f794cc0153395b0bbaf4b5d8a915ea4464a1f70a88681b55d26c96ee938e1c87a58ebb5287efdc20c691f41c60157
SSDEEP 24576:m9+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM0z:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Et
TLSH
T11D050A09F94340B1DD2B51B04DCFE3BF8A60AB25C6124DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
5588	svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe
2312	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCACCABBBACCBCAACBAAAAABCBBBCCBCBBCCCCABBABACCBCACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe"	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBACACBBBBABCCCACCCCBCAACBCBBCBBBACABABBACBABBACBCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe"	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1884	sc.exe
2716	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1468	cmd.exe
792	cmd.exe
5580	cmd.exe
2524	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4528	schtasks.exe
5476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
2312	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
2312	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
5588	svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe
5588	svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Token: SeDebugPrivilege	4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
Token: SeDebugPrivilege	2312	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
Token: SeDebugPrivilege	5588	svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 5580	3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe	92
PID 5580 wrote to memory of 4528	5580	cmd.exe	94
PID 4752 wrote to memory of 1740	4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe	95
PID 3616 wrote to memory of 2524	3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe	98
PID 2524 wrote to memory of 1884	2524	cmd.exe	100
PID 3616 wrote to memory of 1468	3616	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe	101
PID 1468 wrote to memory of 2716	1468	cmd.exe	103
PID 4752 wrote to memory of 792	4752	svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe	106
PID 792 wrote to memory of 5476	792	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCACACBABCCCBACACBACCCCCBCCCBBABBBBBBCAACACBBBACCACCACBACBCCACABAAAABBCABBBABCABBCBAAABACACABAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCACACBABCCCBACACBACCCCCBCCCBBABBBBBBCAACACBBBACCACCACBACBCCACABAAAABBCABBBABCABBCBAAABACACABAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe" start= auto displayName= "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe" start= auto displayName= "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCACBACCACCBBAABCBBCACBCCCACCCCBAABBBBBBCAAABCACAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBBAABBBBABCBBACCCAACACBCACAABBCCAAACCCBCCACBBBCCBABACAACBBBCCAABBCCACAACCCBBBCCCCCACBBBAAAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCBBBAABBBBABCBBACCCAACACBCACAABBCCAAACCCBCCACBBBCCBABACAACBBBCCAABBCCACAACCCBBBCCCCCACBBBAAAACABABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBACBBACAAABACACACBABCCBABABABCCCCCCCBBACAAAAACCBBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d963ec82e94df23ea71ec95484e974a86d817462f524813400c0704b17c5de87
MD5 fb7bb33027734d436f9a1308d72cc873
SHA1 52b027593bfb5582ec531be9774e40985db47fcf
SHA512 9cd7b9347c298910a53fa899445eff5dc6109b744ad0b65f25e755dcb5aca1e29b4d2a1d424db6a7af5789a55a3a31de45e4dac3c13421e3ef293b53bf6dca4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_10.0.19640.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 32415c18e2eabd85d84a709f8aff1a01b091c19d3aad8a3cbdc15fd38f379647
MD5 6df5edb39455686a65bfc03d9eda8eb5
SHA1 19c1e2bcfbf35712a80cb8991a56c8a9c46d3543
SHA512 bd2e30ab83ad5dba88b09f546c32a6ac19ccf3bb391bb6594dc34b75b6113f29a4613670215080e59afdeee806e2bb2607594a5ad3b53719cce919aea0500360
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 d661147875f333a6fbf87af8b79879e7e493a665f4c1ad21e096fc03b0a7585d
MD5 54eb9cad188efd2f2dc00a565c28b3b8
SHA1 0e547df11064e9f7fbeb519dc5e8bf21f3a916ac
SHA512 375b99b4bd3a13d5e7587e37f9d2691182b4f9cd9f67904d4c0b83e346b9eae37b5fdb3d63e7251bf2dd9bd94b36b63ec0333fc65d34adb50d350d2425188fdd
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 85887381c71ad4716226dffb2ddeab4cb7c3dd8678def623a029de41a5b6c4c9
MD5 cc6486f33aa0268540f3807be95da652
SHA1 b4faa07a80bc0998c85161fd69a58d710a68123a
SHA512 72a9317e25bb36a1a84c6e7e993d50de988ab5ffeb75d1cea1fc08d0190ddf194cc0b996cff61ef86e32709fea1463b30cf88c818a78efa9f8b93189b6372309
SSDEEP 24576:m9+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM02m39PZfePj:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Ei+EcgZ2b
TLSH
T1F7658D25F8430072DD7A01B14CCFE27E4E64A72487128DFBF78DCA5F7932AA1653A256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\qap`g`v~dtlq
Size 10B
SHA256 81930d78b9bbffbc48c92d3c633fdb19f414e44b1c704c0ea62c7c8d9780e189
MD5 5542f41e311fac2037ba03a3c1243a8a
SHA1 a32635a3ac945eef13e838029f566f5067539309
SHA512 5877f6c5752d89200f20f3b827f32948bb30020b2e5b99592a55b5542e72bc906072371e538b065355a5a42a87294537fde35c705cb04e6ad2ba4f0e5e741b0d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\50bb7329-216a-4561-8b1f-062f1a2250c9\index-dir\qap`g`v~dtlq
Size 10B
SHA256 5e684b7fcd0e42babc49456e5b1f4431a6f6fbb98577ae05d220842e15ec05bc
MD5 d4731f972c4b5fd1aab94ddc3c673aa0
SHA1 3a33e5077deacda7c0dc82a7a60e75b2d6362be1
SHA512 cc56d65ae81b521a04c14f1a91cb7c6a9316016c62f47f93847643a2090141809aae8c628b5a44d5c0b3dd8aa97878864963463a5f461c165afe38bc1c8e4382
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\SystemAppData\qap`g`v~dtlq
Size 10B
SHA256 ed5f2c96853b4a3b499d055483d5ec3f805450e1bdf0f71a044f44f08d5cc34f
MD5 1f9e6df09419af89ae01d10fd2de3ec0
SHA1 0d58eb3a9faad8b80bab9c6580339fa57aece55a
SHA512 536b0d8f140a174a129eb8bf5f38cf71e2c2f673dfbcab0d5f864c770a721ea65b7d73e5babae1a323b4c7dcf9b40c3731905da759821a8c3adf631a5a95cdd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\5oj1pt8p.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\startupCache\qap`g`v~dtlq
Size 10B
SHA256 4137106cba02b6b161da00c78aae5cd2a1567bf8e6b79ff23fac78de2bb1cfa6
MD5 0e6fe0d1072e39b0b5b9f01f8529ad82
SHA1 cc0e9ed30ac00ed7a39d87704bf01df9463fedd5
SHA512 5188e08e4d9f91e50ae155c1cb4c41d16ea414081c6899d0222260dc010b328efb2d7803d182865dc21c8d7964dcae4f7fc420ffd1f2acabc81b617fdf12bc2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a6e4364a984c1ef73dd1545a4494c57942d3716d4062f0acd2bb13c1c9d102b
MD5 7718ee2b5c10e6791e93aca57d97e9ac
SHA1 f121a16653204deb3d8da7375939d822b64f5397
SHA512 5bd900f8b7369952d58400b4e9a9db16fcbf29199e46abd1e98664d8eb75b414286446bf579cd9b8a82a1a85cc617e93c082056d13bcf694b8b688e8585f1a2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a65d27f964276b9f6c4c4dc072c4be1ea64ce8018e1948dcd1861c101dba91ff
MD5 4bf354d5cc7b5069371d9161aa36a159
SHA1 272db09fb7aaf8f36624035c72d623dcddb27aa8
SHA512 9e77277dedd371cbeefa1b9585035c819f1cccb2780ab262fb4abc9fb6bed008b7d829019b8edf89e952ac181177afb80f8573a75e206c6f149c4c41a680109f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e23619b978cd4455fd69b37ba38156bbf57d1d2ff40c19329bedf2bda409a385
MD5 fe7e0dd504482d75c461b1d7429308f2
SHA1 bb762c0ea126b382ff15f9b925a294678f3dd120
SHA512 35181c3d1357ddf8f89d7de286f5506dc39e0c6bc8d5882cec4ec11b1ca9f444d557663a198186c6c067d5521d67be0c57457c7be40f4ae94e937b5cd9f09949
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e12282ecb252b93df4b9832b594d6c59991671c59f73b4de4f245773e4e16012
MD5 c14ce5bd8a545cd15fdfedad37d70901
SHA1 5df04b61127bd1d993f24997ad9b1114bd7bf98b
SHA512 31b59ea5ef6fdf6506f092cdbff29bc10842c4d6a453b656961fa1c560180f146b8c757854b6b7f6218bcb49244bb0d55abc02dc3100f580af2be2696295f219
MD5 SHA1 SHA512

Submit Download

svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBBCCAACABCAACBCAACBCAAACCCACCABBCCBCCACBBBCCCAAC.exe
Size 845KB
SHA256 1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb
MD5 db222b31f5185b48da6685e91c3f97c9
SHA1 8873f2215bb90cd0bd0ffa26b5489665569758d5
SHA512 582108d7f59476e2eb721841a807649c335f794cc0153395b0bbaf4b5d8a915ea4464a1f70a88681b55d26c96ee938e1c87a58ebb5287efdc20c691f41c60157
SSDEEP 24576:m9+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM0z:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Et
TLSH
T11D050A09F94340B1DD2B51B04DCFE3BF8A60AB25C6124DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 028705a6b197b1b1cb825d6467c6c57f64dabaaa8356114d8d059a93dc56eaab
MD5 2ea5f0a6c0fdca236488f1b76be01f17
SHA1 4d3a0e75ac590bfc4da60d0a80c945a951405653
SHA512 8090623bf7baa5bb83398aa555476bafcfebdb031028d1786498d5b5e0e715b747df719f7498c85a6044dd5d3b7742ba2c9ff17f2ca42d196da6bf30cbcd0b69
TLSH
T171116220F4D5DCA7FA6368DE912DEB4308A4B7AF9C989A181309D2186BC5C33CD1D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0a8eed8ccd3aa0a233f1bab4d13799b06e538a843ed2023e08ca0ddd43b23494
MD5 750caeba89bdbb3a6c0db6d8125c1eb7
SHA1 bdb8b9bb78c0c984382fe412fedbb5461d7a7eb8
SHA512 10e629879b1af8a9181d0470ef2a59557c8062d7db00d4914520f6a374196b3835f0ae616ceccfa38f2dfed70247f1c12163c44592775316976760f1c3e01f38
TLSH
T137215360F4D59CA7FA6368DE922DEB430CA4F76F9C989A181309D2186BC5C33CD1D4D9
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 889069a23c27e369c98a6914dd5693045677c50e3d561c3257181173841562da
MD5 db32248515f858840e3102400f796397
SHA1 659368c132b2255fb1369640fa1e918ad8b6044f
SHA512 9958be1da14c9a07cce594bee6a7952f0b2fcf00c8566e504e3f84dadf3f4cdb57d7a1bd114d0ec5d533926a47ac2da03092b30e815c9ceb607a6493507174b1
TLSH
T19A119650F4D5DCA7FA7328DE9129EB430CA4F76F9C94AA182309D2186B85C338D194D9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2312-1480-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2312-4048-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/3616-6-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4752-32-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/5588-69-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/5588-4046-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download