0c8330a4c152abcda8e1512764ffa58f03692776f0b14576b55f87521656b4a3

Analysis

user interaction
yes
max time kernel
352s
max time network
320s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/08/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.0MB
Sample260828-w2bs3sdg86
SHA256 0c8330a4c152abcda8e1512764ffa58f03692776f0b14576b55f87521656b4a3
MD5 66bd4077fbbf683f74aa85c0377878ca
SHA1 5e5f93bc34b32823210b70f4a0943c3984e122af
SHA512 6ac370ca7328860fef0c03c1ee082c7a0172c5a18afea4c28d8f16294321cdb52125b777aa3c6c1fc47f13d66b6e71d06403c3aace38f183fa7bb86bf86436f5
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatglgDd79WC3gZ2HbbZB:n5Hp7hgZ2Hb9t+2xj
TLSH
T14A165C01FA85C472E97601714C9B83FA6630BD214F118AEBB7C8B37E5E337D0A636659
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 7 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemHelper.lnk	windowsdesktop-runtime-8.0.15-win-x64.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 9 IoCs

pid	Process
4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
4408	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
4616	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
5748	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
2032	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1552	svchost_CCBCBAABCCACCAAABBBCBCBCCBACBCCCBCBCBCBACCBABBBBAACCBBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABABCBACAACCABCCCBCCCACCBCAABCBBCABBACCBBACBBACCCBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe"	windowsdesktop-runtime-8.0.15-win-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBBBACABCAACBABBABABCBCCBCCCAACBCCACACBCCCCBCAACCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe"	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBBAABCACABBBCBCACCBCBBBBBABBCABCCCBCACCBCBACCBCCCBBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe"	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCCACCACCAABBBBCBBCBAAAAACCCCBBAABABAACBCACABACBCABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe"	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBABACBCCACCABAABCBBBCACACBCACACACAACAABACAAACABAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBAABCCACCAAABBBCBCBCCBACBCCCBCBCBCBACCBABBBBAACCBBB.exe"	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2176	sc.exe
4040	sc.exe
5652	sc.exe
5736	sc.exe
2988	sc.exe
552	sc.exe
2432	sc.exe
4360	sc.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4244	cmd.exe
1960	cmd.exe
4884	cmd.exe
2976	cmd.exe
3448	cmd.exe
5576	cmd.exe
2204	cmd.exe
8	cmd.exe
5628	cmd.exe
5676	cmd.exe
6064	cmd.exe
3388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-8.0.15-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBAABCCACCAAABBBCBCBCCBACBCCCBCBCBCBACCBABBBBAACCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
812	schtasks.exe
2084	schtasks.exe
5344	schtasks.exe
5568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1928	windowsdesktop-runtime-8.0.15-win-x64.exe
1928	windowsdesktop-runtime-8.0.15-win-x64.exe
1928	windowsdesktop-runtime-8.0.15-win-x64.exe
1928	windowsdesktop-runtime-8.0.15-win-x64.exe
4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
4408	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
4408	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
4616	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
4616	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
5748	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
5748	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	windowsdesktop-runtime-8.0.15-win-x64.exe
Token: SeDebugPrivilege	4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
Token: SeDebugPrivilege	4408	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
Token: SeDebugPrivilege	2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
Token: SeDebugPrivilege	4616	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
Token: SeDebugPrivilege	2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
Token: SeDebugPrivilege	5748	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
Token: SeDebugPrivilege	1220	svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2204	1928	windowsdesktop-runtime-8.0.15-win-x64.exe	94
PID 2204 wrote to memory of 812	2204	cmd.exe	96
PID 4584 wrote to memory of 3440	4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe	97
PID 3440 wrote to memory of 1356	3440	notepad.exe	98
PID 1356 wrote to memory of 1884	1356	calc.exe	99
PID 1928 wrote to memory of 8	1928	windowsdesktop-runtime-8.0.15-win-x64.exe	102
PID 8 wrote to memory of 2432	8	cmd.exe	104
PID 1928 wrote to memory of 4244	1928	windowsdesktop-runtime-8.0.15-win-x64.exe	105
PID 4244 wrote to memory of 4360	4244	cmd.exe	107
PID 4584 wrote to memory of 1960	4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe	110
PID 1960 wrote to memory of 2084	1960	cmd.exe	112
PID 3440 wrote to memory of 3172	3440	notepad.exe	113
PID 3172 wrote to memory of 4828	3172	calc.exe	114
PID 4584 wrote to memory of 4884	4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe	117
PID 4884 wrote to memory of 2176	4884	cmd.exe	119
PID 4584 wrote to memory of 2976	4584	svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe	120
PID 2976 wrote to memory of 4040	2976	cmd.exe	122
PID 2356 wrote to memory of 3448	2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe	125
PID 3448 wrote to memory of 5344	3448	cmd.exe	127
PID 2356 wrote to memory of 5628	2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe	128
PID 5628 wrote to memory of 5652	5628	cmd.exe	130
PID 2356 wrote to memory of 5676	2356	svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe	131
PID 5676 wrote to memory of 5736	5676	cmd.exe	133
PID 3440 wrote to memory of 5820	3440	notepad.exe	135
PID 5820 wrote to memory of 5884	5820	calc.exe	136
PID 2560 wrote to memory of 5576	2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe	139
PID 5576 wrote to memory of 5568	5576	cmd.exe	141
PID 2560 wrote to memory of 6064	2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe	142
PID 6064 wrote to memory of 2988	6064	cmd.exe	144
PID 2560 wrote to memory of 3388	2560	svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe	145
PID 3388 wrote to memory of 552	3388	cmd.exe	147
PID 3440 wrote to memory of 812	3440	notepad.exe	149
PID 812 wrote to memory of 4816	812	calc.exe	150

C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.15-win-x64.exe
"C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.15-win-x64.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBACBACCCBCBBBBCBCCAACCABABBABBCCBABACBBACAABBBBABABACCAABACCBBCBCAABBABACBAAACCCCAAABCBABAABAABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABBACBACCCBCBBBBCBCCAACCABABBABBCCBABACBBACAABBBBABABACCAABACCBBCBCAABBABACBAAACCCCAAABCBABAABAABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe" start= auto displayName= "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe" start= auto displayName= "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCCABBCCBCABCBAAAAACBBAAABBABACBCBBBBAABCCACBABCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Windows\SysWOW64\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4828
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5884
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\win32calc.exe
      "C:\Windows\System32\win32calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAABAACCBBACBBCBCBCBCACCBBCABAABBCABCACCAACAAABCBCAACBABBABABABCCBBBBBCBBCCCBBBAABCACBAABCCAACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAAABAACCBBACBBCBCBCBCACCBBCABAABBCABCACCAACAAABCBCAACBABBABABABCCBBBBBCBBCCCBBBAABCACBAABCCAACACCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe" start= auto displayName= "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe" start= auto displayName= "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBBACACBCCAABACBCBCACBCABBBCBCCBBCCBCABABABACCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBAABACACBABAAAABACCAABABACCACBBBBCCCABBAAACCBBBBACAABACABCCABCBCBBBABCCBACBBBBCABBABABABACCABACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBAABACACBABAAAABACCAABABACCACBBBBCCCABBAAACCBBBBACAABACABCCABCBCBBBABCCBACBBBBCABBABABABACCABACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe" start= auto displayName= "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe" start= auto displayName= "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBBACCACACBACBABCABAACAACBCACBCCABBBBCACCBBCBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBBCCBABACBCBCBABBACBACCACCCACBBCCBBACBCABABCBCCBCCAACBCCCABCACACBCABCCABBAAABBBCBAAABCAABCACCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBABCCBBCCBABACBCBCBABBACBACCACCCACBBCCBBACBCABABCBCCBCCAACBCCCABCACACBCABCCABBAAABBBCBAAABCAABCACCACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe" start= auto displayName= "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe" start= auto displayName= "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACBABACCCBACBBABBBCCCBACCBCBCABCBACBCACCAABCAAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCCCCBCBABCCAAABACBCABAAAACBCACBCAACCCAAACACCACABA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACACABCABCACACBCABBBCCCAAABBCACABCBBCCAACCAAABCABC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABAABBABBBABAAABCCBABACBBABAABBBBCBABCAABAABBAACABAA.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABCCACCAAABBBCBCBCCBACBCCCBCBCBCBACCBABBBBAACCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABCCACCAAABBBCBCBCCBACBCCCBCBCBCBACCBABBBBAACCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cbe723301082629cd9b95858f7ed69afed6344c75d1524789cd1800c9b877a7c
MD5 dbce3b549d82c2a999b16ea97f7de516
SHA1 cfe64cf64ebcedc1833141f09613bf79c5c63d46
SHA512 db6518a813f4e3bfadd67bf35128d135183856b483f3c9857683c3a598b9e0b8036a8903504dce2fcfd036aad2da209804ec4c6f8a48d42b94e4186f5c22e08c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 19a5fc0adec35a07c5738a84f3f09b24a957bcecb29c51c3b15784cd66c13bb9
MD5 96cc4bf682b28bba00a1a037b73561f5
SHA1 10ecac79bfc96112adc1a5cd45f5eba989cf821b
SHA512 fa0ef0a107f8e41587969a9e66b1e5d0f569721b762c4e46785935a0f7df4ef9f81276ef48f80c8c7689c1ca319a896eb85f6848ac7a11a2388749aecfde6391
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 16.5MB
SHA256 0670e434e9a0d47a3b22c2f8ba5f168bed3873ce349793ddf90c69ce2ee19a74
MD5 1afe96c391944013dee716936e2fe04b
SHA1 ed4a91f201f8690558d9bb0653d6d24d8a421c6f
SHA512 889926c6443f871b36092aa6bd609f16d8b9c713bcfefaa9bbca885b6a8065fd50f34993166579bfa0dd79087d9946aa27b7161658635c3b6500a156782b129d
SSDEEP 98304:n5Hp7hgZ2Hb9t+2x75Hp7hgZ2Hb9t+2x75Hp7hgZ2Hb9t+2x75Hp7hgZ2Hb9t+2z:LhgZ2jXhgZ2jXhgZ2jXhgZ2jh
TLSH
T157075B01BA858472E97601714CAB83FA6630BD218F118ADFB7C4B37E5E337D0A636759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\qap`g`v~dtlq
Size 10B
SHA256 cd076f95559f2dbf0e2a76b77b9eb3b320b7ad49df8e06d1bf926e95faee9cb8
MD5 0f7292878a2cd74fb8e7e05fa2ffb583
SHA1 4679f586027a858a716fc7853db4f1670ebc080f
SHA512 a7d8aa1a1607894a7215b3e5478bc45bdf311c7cd469fbbce36787868477985f5a8d76bf0cdbc99a4620f98d11f20182efada509c8cc8a6147d6d7f8f09b9fd4
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 4.6MB
SHA256 ba0182fae4463c5648ff3f59dbce572d66da49ed4868e1e1ebfa94156c6642a6
MD5 68fa51d24fffe6f4a33751eb63607d6d
SHA1 732a270ff3a1e0e6407d39c1c6a1442e70aaa058
SHA512 7a31a3f664395267696b6dcdd2955bc1a6e465a739b354b5e5f7beb1b628fb6141fc0137f4e6f444d4a3c3ffd94474b446de56bea21fceaa9cf8d359cb0b8a9e
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatglgDd79WC3gZ2HbbZK:n5Hp7hgZ2Hb9t+2xmgZ2Hb9t+2xp
TLSH
T186267D11FA818072E9B601714C5BC3BA6A34BD214F01CAEFB3C4B77E6E736D06636659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 45486966b544fa13597522dd7a6bda26c715c24ae919199ce1dd77a5011c8717
MD5 eaa7d3ee2385d72fd897a6d0dc4f9d2f
SHA1 2a096c1ca3691f4cfc868a203e19c61b2f4e0d55
SHA512 75c2a707803b25d4162270dcdd9eabf5c17fdd2cc552bb6a17564e0d415d4c0e28c6752855fa52c9471acb3ba7ccdc7c124cd74a265200b235f3b434aaccb020
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.104.1_0\_locales\sv\qap`g`v~dtlq
Size 10B
SHA256 1e937c0704fd21781eb4c0b919421e7b5f4d607cc4a723e49e4b9efc982a742f
MD5 aec957b178571c52c50ea6968ae59916
SHA1 ce96304f1eb31efbaf92eb84e38c12d1bd6eef1b
SHA512 e089c2afc8f143a5b519416d057d7de50a543a01f6835afe3a7ef82f53975ca1538bd5ffccfd5462d723bd0e5f790b2bd9b5d99242591233718e69ace79b80ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\qap`g`v~dtlq
Size 10B
SHA256 0a23b443a6e3eec02805fc221971e8f4b8c9381d58c013ed03f848035169f802
MD5 0b4318dce5af456352d45bf6b700f557
SHA1 aa4d9fe9670d1d3da86585625dfb5e93b05da5cf
SHA512 d54ec75b4ac80ef3bd31e0b969a57a0aa0dec25a72e82c4b41368c49bc9ef73f28551c014be2365b2b2fd2611936ea3d24ddad3f8fb324b975ecc2976b3321e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\es\qap`g`v~dtlq
Size 10B
SHA256 0a6213738c86a1438e0ec658b6ceb0935ecda07c47e0dbd92a1f48862d665645
MD5 8290fc3c3af2d3789e6a2a316f57d530
SHA1 387ba870dd4e3630f808affa937df7805a6d98d3
SHA512 4a0bebfc0b14631fe335ab8708e1338d2bdddfa74305d2a84fedb45a6b30ba0560d3d3e37f96b6b8cd270b3d47bbd500a89fe4dc9a3aaf46fa4f956fef8990ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\AppData\qap`g`v~dtlq
Size 10B
SHA256 237bc9e803a2185d026caf38e887549e5e4f60df4058f122e56caa7465fd0811
MD5 a26774a8ea664b4809b341bd26bb5ee7
SHA1 df63f2b35098fdb891147b9773b4bf40ab4d8770
SHA512 3e2c88d2f27f07f10eac0d754fa20ece57c7121829ae1224ab8ebea234c9b36a17aaa6e88e034688808ffaae6b3c4c22657335e465308001f470b6d2399f7d3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\qap`g`v~dtlq
Size 10B
SHA256 cc213882d162c3721d13822486b03c948373d84603f06f8627ac2191b53441ce
MD5 f503114f9ae21391c87ae466f6147e8f
SHA1 5f8b5b5ef171f6c5fc0c5e093f5f786d517e7804
SHA512 26d6442a90552622a4693c09df2125661d4ff43b1517068fa158bf933421b29ad8653b1e51662f4793f0928a048a9bab8117114cc2c6fe72f1b40d843d89cc13
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 973ddebfacc7080ba8787090053f147b0c6e3026ffb040323721e51beff52e4a
MD5 21c73933d4a8397073fdc16069e3ed1a
SHA1 e0a2522aa3426941390cfdd9cde1bd049aab64e5
SHA512 8f5fe136b2f2cc15355e98f707466f93f11b1d06f78fa6ebc5c412189c941dfa9d928ff27cdab272b009560d677a58bdbe94ed0bd858f799ec8bec3f670cad23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74c240dd83736eceac158c5b98ecf030610f18220c2ad3db52539cd1890d9e5e
MD5 66e6f604a95a772ca638997c43fd898e
SHA1 c244895d528a9c07de668e1ebd2a8000802d326e
SHA512 447cf2a29f4ebb1c023826e3c2760e01ea888955d89e77b431b924aed9f6754805fde999c8038ff29a5618b4d0b5efdc278ab370236bc239860c7fad77f88abd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5a8cc82358d5c4689ecf25b702b5b531c3680d56534b188012ec303e5c8419d
MD5 99bb066c7b507010da559741bbf40471
SHA1 1b43ab6818b7dcb23f924e701027deac6bbb09eb
SHA512 3df750ee9047742687915c22de344bff60de64e94ac0e27758e467e2194614944a85c8ef769fbb4c73d9eeb7d1a5228080cec9977606c0fc13505d9a1e028fb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7588baa34c806a6b7bbd13fc9eeb2723053297413bb5bec5e42574fd787ddffd
MD5 2064edddf5be247ec65054526260a846
SHA1 cf32965593586cc2e647c592b2577e84a75ac020
SHA512 983dc040e208cc796337420df58b9af69facb63af848b864968ee7062a3570a86f65e195a9f4137b3e0656cf5b5039ad6136ac2c7acc67f62e0f8a446210fe8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f14eaaef1547a0309df8deb90e45b4b6cfb2815b9a125c8daedad3c9f97aae3b
MD5 262deb2de5ee0fba4f5723e41d8da458
SHA1 e7d7192cc266d15fb973c4b4e90e8a62717458ee
SHA512 17cc3e7168745388a4bf9650d4c9e7b868d488259e9dc5e397187f583c8e658d608be4334f16a9ddab948b8660a33beacafbf86f52d3a0d7612cd6444061783d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0010f3d6e3e21b0628db06c24b7e5fd0b94a64be22a4b5bdc338a4f362355d91
MD5 c226d73477575b75875770c58c49f3cd
SHA1 09c14eeac3eec39e214401c61602bc2fdb6672b0
SHA512 24e1eac5e03cb3bcefcd3ca98bf6a29572a6399d549d859a47212b6da19989e850cba72dac1512dfc046fbcc74615b21580ae0f0f19fafdf573cf037e904b7a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b147087a5d506f9528bfbd1b9baa3ba62668876621e55af43131aca3dfa87d19
MD5 cc117d9af9c687404e6010380d6a64b7
SHA1 f0012cf73f85dee2429eebf4a466dc09315c7571
SHA512 a4df6f3e70626c8cb6546da0011b0e9b2aceb6d9e0027167d57213d22c607ff1ca585e3536f1d4d48c9b1f86713e9fa0035c176cb96cdd8832fa4a37bef96d35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6516109b21c86f5c414e07c78103b2c88c664be611e5056b36066991d5010722
MD5 d7e871237de55fe034813f961733418d
SHA1 2757b35cabcbe37810fc1ce946b41fcaf53970dd
SHA512 d99f2debd8ebe4494c94bbfa689f622ed15497a3c36a0c8009df91fa673800928b906e6b724ddba361bef06efe0650e4d63c9f0b0967b37dfcdb991f387f5406
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 008455f29e8f574a40ff5fe3f80ab9ef2577d89dc7117b0103d814f484afa725
MD5 40d7c038cae588f8915065f2fa57320c
SHA1 998ecf5cdea0fb5d7d37a15d337f22aff0db32dc
SHA512 638ff84567feae07ecac9b47223b11cc459ca1cee6df17ea567bfc54323ae258668d6f47a5033b08ea8d2a786afbeba7b402adb4547bdad9b424e533845d3252
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62aa556ae18244a8f4eeb71b5e6dfbc18a25a482d46ebf1a61196c13b69edf1a
MD5 8c393c1d7ce58e2409bc75bea8f5576b
SHA1 1afd19576fd57a324dcb5dec0a3af0b68fc89818
SHA512 9d89e99b1c11da17b170663565c32ae2efd4edc11dc7b06015b112f2ec84ac26dc6f65544894e47b0e5908183db27dace0102abfb40061b175b1b5b71057e089
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6d415df93afd5c41dbfeba233a85550fcdf9ba90b535259bd7e2225d81b9be19
MD5 2f43db940f11914d48907ce5f57208b7
SHA1 187cc359ca33c4fe0378e68ac6b06701d475106c
SHA512 7a9023668501d9f196ec7ee7881f736c3abc3051296aed47935fcc7e2028e5e5a01702a2dd72de90f743673000dee25398a629a2a2cf2c6a090373d4d91c0ab0
MD5 SHA1 SHA512

Submit Download

svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCCBBCCBCCCCBCBBCABBBACACBBBCABACCCBACBBACBBCBCABCBC.exe
Size 4.0MB
SHA256 0c8330a4c152abcda8e1512764ffa58f03692776f0b14576b55f87521656b4a3
MD5 66bd4077fbbf683f74aa85c0377878ca
SHA1 5e5f93bc34b32823210b70f4a0943c3984e122af
SHA512 6ac370ca7328860fef0c03c1ee082c7a0172c5a18afea4c28d8f16294321cdb52125b777aa3c6c1fc47f13d66b6e71d06403c3aace38f183fa7bb86bf86436f5
SSDEEP 49152:U+E3+E3+EI+E3+E3+EHqatgl/+E3+E3+EI+E3+E3+EHqatglgDd79WC3gZ2HbbZB:n5Hp7hgZ2Hb9t+2xj
TLSH
T14A165C01FA85C472E97601714C9B83FA6630BD214F118AEBB7C8B37E5E337D0A636659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 04d5330b1005ffff90d40b97322fbe2bced11fec7a5afd924f52a610bd2a7836
MD5 1472deba18151afaf967e147b9eb513b
SHA1 fa8b321aa92e914593ff70f127115bb9affbb010
SHA512 7aca38c730b2fae765d69bc54cf4e578413865d568c4c00ba226c649f66c898ba5bda8e325775b9359b033cbfec02bbb106fe7babb2a87606e4b069f89d93828
TLSH
T13721F9A0F4F5CC63E52368DF5729DAE23CA437AFAD9C994233085208A785833CD959D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 1d7ed8df017fda2451af8bf69c8bd404c6a1c123a6063130da3cb9884999b5c8
MD5 91e4071d2e3386cf104bdc09e7198058
SHA1 52054d7193996d7c3a11ac80971931c49328782d
SHA512 8f5665f2b66ebb5def71a2fc33e8565e01d92c9e1ca787afa621ed6d5c2be35e36f6ea0349ca8e89307a0d79dd2b73e3a09a7d4dc92f7ca6d08a9e672603a870
TLSH
T102212BA0F4F5CC63E53368DF5625DAD23CA437AFAC9C9A4233085318A785833CD959D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 10c2ba3f13821de202cf834e6ed69111474c6982d58a0835ec3bce4758d9b941
MD5 99df56abfa382f2d13861c99e52ecf34
SHA1 5132c864fe8a3037618a7dc967dfeb661d0fd905
SHA512 173a6424f110e853dcfb24dad3bc02102b6c778960d5f7ea65cf769b11f652b2a96de82df670d057ee922e39b340bf94d8897ba07c938c7315daf188ad1cc2da
TLSH
T157410890F4F5DC63E523A8DF5629DAD22CA433EBACDC9A4223094308AB85C33CD559D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 2KB
SHA256 294f16fd20d39e6ab23e330cec53cb1be48afba5b30faf1ec5bee280a73cbb57
MD5 29ef3fa135bd0373adfc7dbfa49c9828
SHA1 d8c1dfafd80d73469f90849ca57eab0af6985cf4
SHA512 f027f37b26b59785e538daea6e3532c7567ba9dec22eddb39d9212bfe9b01a788bccdce82dfb780b26fe19839b6d305d3138f66658feee0b1f3005e2315a45ff
TLSH
T126410790F4F5DC63E53368DF5629DAD22CA433EBACDC9A4223088308A785C32CD559D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 4KB
SHA256 2202390fb4640b92cf1e386bb3d1754237eb5798a946a5a52a0de40d52c12c51
MD5 8e21f6c7aad153e8b72eeeae27edeaee
SHA1 43b88d1bc3013d8be96c0de2a3235889f48c074b
SHA512 163d3cbd713485981762c7ddcf7c2c9dafb00c7bcf83e917b74674da0aaaf72a6056f11e2c26c82399d13eb6a136c52cfd3f2fbefe884a8aab8ad5df111e9fb4
SSDEEP 96:ofGC1OBiVqG8E+Q015diTWql3x+Ee1c/6i/LO3ekH/b+wu1fyLiyCpjp:FCvvF0pq3JeaszywdCn
TLSH
T147911A61F4F5DCA7E53368CF9725DAD22CA4339B9DDC9A8163098308A7C5C32CD459E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 110f3b8a6b8d89ac718e1604e2d087e15f7e67253fa3593b8f72a52453ee567f
MD5 ad0c92e69e11b58a13312a1b5d68eed7
SHA1 418ea66a5bc146eb50602dfab091247e85834ba7
SHA512 5098b6e5858aa5fba3c88a20d4322e8173b8d0878df954353d664b612075e1a71e5a4fc0f0e90cc5d994c8eeb3e53a190dd9a28709197e4e23822a880c4f0db5
TLSH
T1B3110690F4F5D853E53368DF57258AD23CE037AB6D9CAA9633084218AB85C33CE959D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 f484c558e078e0f339ce9e73628a130ffbe49cd34fa25a41bc16827103dac3b2
MD5 f58da77a918ef6e06e90af0718c06bf6
SHA1 b3246e5b2a5bae297e88341cb9ce9e446837087a
SHA512 0bb7f4e990b33d200da81a307b08e73c977027d9336d76094681dbe0d3d0d4af1fa2d466cb766b0b246da4c9210075d4a94b11a840a073707bdca94c6e64fac4
TLSH
T103210BA0F4F5CC53E52368DF57298AD23CE037AB5D9C9A52330852186785833CD959D2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\qap`g`v~dtlq
Size 10B
SHA256 b4f454e8a7b87cd1aa08cd021f36faa618b095653b0d43a4e5d2e51003a9b0fd
MD5 40e618e118a769e671e6f289bd60eb61
SHA1 d6d125b8cba871118171159fdee15cea35ae7f1e
SHA512 82609676b554f1c6cdcb1779518c3a490ae83c0f41dea6b10d88a0f5e3fb9dec2f31e521fd7a97869cf7344ddfc2afc30004da2e81187792ea33b8a0b967a970
MD5 SHA1 SHA512

Submit Download

memory/1220-6613-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1220-5413-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/1928-6-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/2032-6664-0x0000000000860000-0x0000000000881000-memory.dmp

Download

memory/2356-2672-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/2356-71-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/2560-2729-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2560-5360-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/3440-5399-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/3440-2705-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/3440-6653-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/3440-52-0x00000000026D0000-0x00000000026D1000-memory.dmp

Download

memory/4408-2670-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4584-32-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4584-22-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/4616-5351-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/4616-2733-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/5748-5405-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/5748-6598-0x0000000000060000-0x0000000000081000-memory.dmp

Download