Overview

overview

7

Static

static

3

windowsdes...64.exe

windows10-ltsc_2021-x64

7

windowsdes...64.exe

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    308s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/08/2026, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    windowsdesktop-runtime-8.0.15-win-x64.exe
  • Size 4.0MB
  • Sample260828-w2bs3sdg86
  • SHA256 0c8330a4c152abcda8e1512764ffa58f03692776f0b14576b55f87521656b4a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 9 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.15-win-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\windowsdesktop-runtime-8.0.15-win-x64.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABBBCACBBBCBACBCACABAACBBACBBCBAABBCABCCBBACCACABBBABCCABAACAACCCAAAABACCCBCBABBBBAACBCBCBAACBABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABBBCACBBBCBACBCACABAACBBACBBCBAABBCABCCBBACCACABBBABCCABAACAACCCAAAABACCCBCBABBBBAACBCBCBAACBABCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2072
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe" start= auto displayName= "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe" start= auto displayName= "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_ACBAACBCBBCCCBCCBCBBBCCABCCABCCCBABCACBCCCBCCAAABCC"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:780
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\SysWOW64\notepad.exe
      "notepad.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2036
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4104
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4500
      • C:\Windows\SysWOW64\calc.exe
        calc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3436
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBACAABABACBCAACCABAACCBBABCCBBCCBCCBACBABBCCBABABBBCBCBABCCBBBBABACBCACACBBCBBCBAABACBBBCABCAABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBACAABABACBCAACCABAACCBBABCCBBCCBCCBACBABBCCBABABBBCBCBABCCBBBBABACBCACACBBCBBCBAABACBBBCABCAABBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2192
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe" start= auto displayName= "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Windows\SysWOW64\sc.exe
        sc create "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe" start= auto displayName= "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4532
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\SysWOW64\sc.exe
        sc start "UserDataSvc_AACAABBACCBCACABACABCBAACACCBBBACABBABBCBCAABBCBBBA"
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1508
  • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
    C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:876
  • C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe" -ServerName:App.AppXsm3pg4n7er43kdh1qp4e79f1j7am68r8.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4492
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:3868
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACBBBABAAACACBABCCABCCCACBACBAAABACABCCCCACBCCCBCCBCCABCCCABABBCCCBCCCCBBBBCCABBCABBACCCABAABCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAACBBBABAAACACBABCCABCCCACBACBAAABACABCCCCACBCCCBCCBCCABCCCABABBCCCBCCCCBBBBCCABBCABBACCCABAABCAACAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe" start= auto displayName= "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\sc.exe
          sc create "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe" start= auto displayName= "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:2324
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Windows\SysWOW64\sc.exe
          sc start "UserDataSvc_CCAAABACCACBBBCCCCBBACCAAABCCAABBCACABCBABCCCAACBBA"
          3⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:1372
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBCACBBABACBBBCBBAABBCCCABAAABCAACBABBBBCCCBBAABCBABBCCABABCCCBAAABCBABABCCAABACCCCACACAAACCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCBAABACAACBCCAACBAACACCCCCCCCCAABCCCCCABABACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBBCBCACBBABACBBBCBBAABBCCCABAAABCAACBABBBBCCCBBAABCBABBCCABABCCCBAAABCBABABCCAABACCCCACACAAACCBAACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCBAABACAACBCCAACBAACACCCCCCCCCAABCCCCCABABACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4808
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACCAAABBBAABBCCCABBCCCACBCACBABACCBCCCCBCBBCCBCCCBB.exe
      1⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCBAABACAACBCCAACBAACACCCCCCCCCAABCCCCCABABACCBAC.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCCCCBAABACAACBCCAACBAACACCCCCCCCCAABCCCCCABABACCBAC.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe
      C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAABACCBABABABCACACBACBABACAABCABCABBCBBABCACBBBCCBB.exe
      1⤵
      • Executes dropped EXE
      PID:4432

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          qap`g`v~dtlq
          • Path C:\PerfLogs\qap`g`v~dtlq
          • Size 10B
          • SHA256 3612817c0e0a20daf7718c284cac552ec8ab6a720a607920dc086ada1ab2d21d
          • MD5 SHA1 SHA512
          Submit Download

          setup.exe
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
          • Size 4.5MB
          • SHA256 51abc81f9aa10eea50edf5331c3d7fd823456e54071e5577606c6735444b7214
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
          • Size 20.6MB
          • SHA256 ab3649af90fd63ee3555cdb3e873e1c2180dcec546fb6b558da2f04e9a12397f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Adobe\qap`g`v~dtlq
          • Size 10B
          • SHA256 2c526036649717a27b812bc597f21ee1d27a5ab3493f74e04e74f2b28a7daf70
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
          • Size 10B
          • SHA256 96751e9959e6077068c53a6a525b0d74f7ed39eeb8fea0968f1bb8cf41da1f99
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.StartMenuExperienceHost_10.0.22000.37_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
          • Size 10B
          • SHA256 a008d7c235d74e6e498f1ef5d53a0222c0a42b9ed6f1b546411c354282cf3966
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
          • Size 10B
          • SHA256 a46b268b29fd26a88691efa14846ec4607dc1a2790b0c9e783cd2f01e7898f44
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
          • Size 10B
          • SHA256 a645cc59b4d6f8c5e1a7b6eb5a1dd949d35751d14aad279ba2a78931ec91a57a
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
          • Size 10B
          • SHA256 92db93d78905913ca4a3a5007089256e782d415c13be0f4aa669d475b4c8c376
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\ProgramData\Packages\qap`g`v~dtlq
          • Size 10B
          • SHA256 193383cdde511f2b607a46b7ba163fad9a97470bec48b1921349d67438054e98
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\qap`g`v~dtlq
          • Size 10B
          • SHA256 7044eb16d7052258de44aa0f72a089118077b956f6f5122dd4071b7075c97398
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\21fe119b-cfbd-4e7d-a241-ecc2e61e5323\index-dir\qap`g`v~dtlq
          • Size 10B
          • SHA256 de37def6bdeb807ce0e04f4eae797cd5afb41eea700840fb69725ec47c5190bf
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
          • Size 10B
          • SHA256 cd4c208c61e3f7d3fa285b53794eb473c49e9e7fab9934b4a5434d17d9b16b8c
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
          • Size 10B
          • SHA256 704e787ba64fbbc55f314d17c73c0f23bdb214fd5658f37c1081791c72305804
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\qap`g`v~dtlq
          • Size 10B
          • SHA256 6ffdbb46f447ff0287b434e234885bbd8adc040d9c320cb644a50edc2c2e106d
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.NarratorQuickStart_8wekyb3d8bbwe\AC\INetHistory\qap`g`v~dtlq
          • Size 10B
          • SHA256 0293345b88cb25a71421d4a53e1617e77be44e60c7e9511da738127710caaced
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\INetHistory\qap`g`v~dtlq
          • Size 10B
          • SHA256 dcd1327c66a7a93847a148f99a40b865d8acb3adcdfd8f98b11a72007c9114e0
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\AppData\Roaming\AssertClear\qap`g`v~dtlq
          • Size 10B
          • SHA256 385bc519cce1d90f7315d678f56e90ec3140f1b0c110b3d0008e25a9e8fe1ddd
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 5255541ed970a307bb79a3a88212bc6cfd68e5d8441991136c5d8448b5100345
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 5b112c3490c289a1d1d2fde453c6fe8f7abde0414728e6c001355e03e7666cc2
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 750f41e194f6ae0d30cf5d0178cce2f703995924b75162afa2229a4b56e76a3c
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 8d3da21c1239fd1a2892ea6ec4f15de1cddd618af02c1f029211ba8ec0193815
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 ecde9e374f25cd9b6095d7dd19d0eede6dbb8ca3ac3519319abda57a24a17594
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 6fc06ebacf2582f855b26c17af3e752ff925eaf6cb8bede476b765f5078470d7
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Desktop\qap`g`v~dtlq
          • Size 10B
          • SHA256 0a6213738c86a1438e0ec658b6ceb0935ecda07c47e0dbd92a1f48862d665645
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 a482258d58dd45ac56828c2ff634e2331ddd679b9f419d6796209a84e120d242
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 c1931dcc532806c78f2d7b7cae02183002179ecdbeb316c633dc06ba5afc693a
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 9e77637051523f21e9858f3c95a6ce04b26f705e590883877cc2dcfeda2c6c83
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Admin\Downloads\qap`g`v~dtlq
          • Size 10B
          • SHA256 cc213882d162c3721d13822486b03c948373d84603f06f8627ac2191b53441ce
          • MD5 SHA1 SHA512
          Submit Download

          qap`g`v~dtlq
          • Path C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\qap`g`v~dtlq
          • Size 10B
          • SHA256 7b6f518f8ee2cfaaf5dc5238066a73a6ec357645265ffd185ad6a71e4bc7146a
          • MD5 SHA1 SHA512
          Submit Download

          svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABBBABAAACBBABCBCCCCCBBAACAACAACCBABACACBBAAAACCCC.exe
          • Size 4.0MB
          • SHA256 0c8330a4c152abcda8e1512764ffa58f03692776f0b14576b55f87521656b4a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 4KB
          • SHA256 12c88edbd5ea02ed3f362e3a646863b73d28c1bcd5d1a5ca19e2ba0b58810118
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 20ec649befb0db398c6c7db9a32b9462d1f5439abd4c85cb20b1a62ae5519bfd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 1KB
          • SHA256 576511f5d86a45a43b1c0649a9cb3224ddcc6eec032fd059533f5dbe885dc79e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 2KB
          • SHA256 525558f77d519fecf477362966d1673c3869f4d45ca8b0179b6d3df468d3537b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 2KB
          • SHA256 c9145598cc6cce0628fa2a083cfeea7a40209cf2263e86193a6d56b4c1ea5ccf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 784B
          • SHA256 51ddc5cfc086c42f67d6482644d3300cfc4bbddb74dc091e87a97b6e251498ca
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          virus_log.txt
          • Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
          • Size 974B
          • SHA256 7b48a0f56e0825a16b21e8f33cf94a81b4289b0a7968b40a715b4c87661d5752
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/876-74-0x0000000000CF0000-0x0000000000D11000-memory.dmp
          Download

          memory/876-6058-0x0000000000CF0000-0x0000000000D11000-memory.dmp
          Download

          memory/1032-6-0x0000000000BB0000-0x0000000000BD1000-memory.dmp
          Download

          memory/2144-6122-0x00000000000E0000-0x0000000000101000-memory.dmp
          Download

          memory/2620-12244-0x0000000000BA0000-0x0000000000BC1000-memory.dmp
          Download

          memory/2620-6126-0x0000000000BA0000-0x0000000000BC1000-memory.dmp
          Download

          memory/2632-12295-0x0000000000BD0000-0x0000000000BF1000-memory.dmp
          Download

          memory/3192-6091-0x00000000009D0000-0x00000000009D1000-memory.dmp
          Download

          memory/3192-66-0x0000000002730000-0x0000000002731000-memory.dmp
          Download

          memory/3192-12271-0x00000000009E0000-0x00000000009E1000-memory.dmp
          Download

          memory/3192-12336-0x00000000009F0000-0x00000000009F1000-memory.dmp
          Download

          memory/3204-1383-0x0000000000BA0000-0x0000000000BC1000-memory.dmp
          Download

          memory/3204-80-0x0000000000BA0000-0x0000000000BC1000-memory.dmp
          Download

          memory/4204-38-0x0000000000CF0000-0x0000000000D11000-memory.dmp
          Download

          memory/4204-25-0x0000000000CF0000-0x0000000000D11000-memory.dmp
          Download

          memory/4432-12301-0x00000000000E0000-0x0000000000101000-memory.dmp
          Download

          memory/4432-12310-0x00000000000E0000-0x0000000000101000-memory.dmp
          Download