9264e21c3e66527fda9ece484797465a3f2f4e172944cc44a33393a4e1d0a59b

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
Size 6.1MB
Sample260907-ycejsavapf
SHA256 9264e21c3e66527fda9ece484797465a3f2f4e172944cc44a33393a4e1d0a59b
MD5 664fe6f3da050df194f111d86f156f33
SHA1 a81c4ac372f104540dd3d54f583a99c3e6ee4e0e
SHA512 50d17ce47c656cf91dcac5931e85517e69171289ba8bb38c78896b0727c66c7e3d6ed90cc019c192c93e276c6da3adf6c0ee797f928be07d60afe692892e66bb
SSDEEP 49152:U+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESf:M
TLSH
T14E562B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
1040	svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe
4704	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAABCCCCABBCACCAAABCAAABBABAAACABBBACCBACCBBBAACAAABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe"	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCABAACBCABAACBCABCBCBACAAABBCBAABBCCAAACBBAAABACCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe"	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4560	sc.exe
712	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2440	cmd.exe
3312	cmd.exe
4300	cmd.exe
1052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1176	schtasks.exe
2660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
4704	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
4704	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
1040	svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe
1040	svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
Token: SeDebugPrivilege	4704	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
Token: SeDebugPrivilege	1040	svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 2440	5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe	92
PID 2440 wrote to memory of 1176	2440	cmd.exe	94
PID 2656 wrote to memory of 2504	2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe	95
PID 5200 wrote to memory of 3312	5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe	98
PID 3312 wrote to memory of 4560	3312	cmd.exe	100
PID 5200 wrote to memory of 4300	5200	2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe	101
PID 4300 wrote to memory of 712	4300	cmd.exe	103
PID 2656 wrote to memory of 1052	2656	svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe	106
PID 1052 wrote to memory of 2660	1052	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_664fe6f3da050df194f111d86f156f33_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABAAABCBBAAACABAAAAAACCBBCAABABCBBBAABCBAAAABACCABAACABCBCBCCAACACBCCABBBACBACBBBACCBAAAAACAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABACCABAAABCBBAAACABAAAAAACCBBCAABABCBBBAABCBAAAABACCABAACABCBCBCCAACACBCCABBBACBACBBBACCBAAAAACAABBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe" start= auto displayName= "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe" start= auto displayName= "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABCCACABCCBACBCAABBACABCBBABBCBAABABABCACABCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAABCCACBBBBBBCCAAABACBCBBAABCCCBACCBBAACBCACACBCBCCACAAABBACCBBACAABACACABBCCCBAABAAABABCCABCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAAABCCACBBBBBBCCAAABACBCBBAABCCCBACCBBAACBCACACBCBCCACAAABBACCBBACAABACACABBCCCBAABAAABABCCABCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAAAAABABACCCCCCBBBABCAABAACABBAACCABBBBBCBCAABCCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 6d202d8faecb538b051f4e39e216d33f000e406049dead04ada962b87d5898e4
MD5 381b6af5051baa078b1ccb50de2a795e
SHA1 b4599b1e8ef0318ae82af132a27b3b6fd9076811
SHA512 604c4149a5fdb6c1f0cf58fdc0e0585cdbed6891b8d49e5e9755645b9e1cfdc48e423ba56d9f8f9e84e7a4c360a6eba90d12bd402d5c4e27fb9bd49f5ae2c2f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 98ef57bbf2776cbd7b30232ca4fe911fe05004d0af0f28fdd64d854f4e74bb0b
MD5 0eafbd1e0da3979d909910e5671cdbce
SHA1 3d9acf83af60962581d3c93f6202f0296e142630
SHA512 cb7dbd7f848110482694ac5933a9235d0019ab972e77ceea848d0306547c0892f3beb4df2734f4434fb85c134fc7cae65cca6ccc1ed70439b117f01002b104fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 678791f1e1d067befc5ad91e7a8ec7d30eb0231d8226e925ae937cb513ca4974
MD5 9d768a7db6dae611bbe57ff872ef0fe2
SHA1 5e3037f575773ad936a83b3a13f9eceb394e6dee
SHA512 b6373d2430b028b8fe44e378aaf2ea6010a4885e1cb92ae4cdc6179816f65ae12c52fbb8f44bf312a0e8a605719c911352427875913fd6fc866172d252ce8ad1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 ff53fffae782ebce7dd15a901cefe292d12303fb22838cf2a21e8b812433becc
MD5 4fc8089a6d23e714e965434671228126
SHA1 bfceeaae39d45eb98cb581ca1ee851af8e40c4b7
SHA512 cb00cd9a361b4273e07a6462dad325139f3f251c1acfcc590709864aa988cc2b14d05d79af657fcce234c5dae3952a798c67c1a0f9aff9bac1b16303b36c2ca6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 4ac04201615e36d20e40cf6ea94fce97f10671bf411b84f04580f5056af751b7
MD5 a393a49e4acc0bf2999275dd7e2472ae
SHA1 5c87216cf2b380a6b09bb96cfcf31a946149fc08
SHA512 d519a5f08408c2139c4bf350c328ac5f68fb793abe66373dc59d68dbeff438c59fc062382285ee2ae5067092d46e700266f0837189a1215d398f684dcd71553a
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.7MB
SHA256 831532513e2e7229ad0e728d96510c648c6e1e710fc035a6b44bc8547295bce5
MD5 b16e8367cc17f3eae81c86fe92c4ae80
SHA1 adefa3e7cbd5eef3f8a4d67d19961917b359087f
SHA512 b08c3548c34fb331f18b29ac21e5d96a8ad1c93b418a0941d3d375e65ca60d77f60735c0d4ab1ca1fb9c02360004c9f2fd204c005ea52ece564f53d65cc60387
SSDEEP 49152:U+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ES0:rgZ2Hb9t+2xd
TLSH
T1C8664B09F98340B1D92B10F04DCBE3BF8A60BB2586128DF7F74DCB5BB932BA15429655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\uz\qap`g`v~dtlq
Size 10B
SHA256 bcaeb9a145d404eb3b5e254ea919934dc80f16691d7ed91f4879fcd8df0d18c6
MD5 f5225047862a4a9debc22c9538b986a8
SHA1 047114dc1fd6f3b84b209953c27fb66154c61724
SHA512 5cc7a586881feac2cd8981a66e856a65466dd2914c3b1ae9ec7d9bc4ef274880bb088fe50fd59ee8209c2f2d6d0394a5f53ba8fd3d69e847bfef215feaa85286
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WidevineCdm\qap`g`v~dtlq
Size 10B
SHA256 6cdec7be642a36f56b984ac377307e62b29d054a92080d050ece0c8b699f3903
MD5 eb5c1a264292033843eb077e12f5ce61
SHA1 bf32ecfbd2a230770485adc78b8fd81ed808ee7c
SHA512 15129db609324967006433ab828f029b5f63f2b54f9eeb3e7e2c662b3e5b902b29b5585320b664dad034be6493b580ac3893b88100ac5fd630a599d6b8868165
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\qap`g`v~dtlq
Size 10B
SHA256 f0fb50ceb917ebb31d1c5523e24ce5134555ce90498aedd4e7edfb41bd59750d
MD5 c4dcde787fc75282b11a5effad1b5f67
SHA1 49de1efc3c6f0ccedd3c2c203c103c46149db71d
SHA512 09876423452352f88b346786ee4748a3c98676040aac00b57de336ec5d827158bb6b17a68553cd004bbde28222a1899c65761344eb83602f5fe4da856a5cf4e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3eeca7b1c6a723d3b0f640dca1241802a6b64be4a0b29dab67fbe98b363d488
MD5 464755a3bd1fb4ef6cdc2930322c9b64
SHA1 74af04dd53430a1f791a26074305fdbd589c56a9
SHA512 a0e569dd8cb044fad0c747c309d47feeb6a39caba57f4c765eca1555d29f1ce7797b0cb85bfb162bcc867e2f3cde220e9cf145af4c2a8b6a30eeacd439dc05e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f5549771cdd438f40934e83e4d9ac827bf2adb7597e73a3b4510354057349ba
MD5 82621644fdb8c58737e5cf41bf982e74
SHA1 313c0d9e9029005d9615d1d907f527396a9b0c59
SHA512 ce22d383d5b803dbf5445172f0e4e1edeb74e067781ad00a474cadd5f876a80e9c945d12f6c863c0b5de451668d26ec8bcbbbe0b128b3bc05179f5be484c26c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec2b82b3e9b9fbc7e64b4fa40772641b4895e634a88848680d5428c077ebe108
MD5 45c0cc84b9c8d015130aa4e8f7f4ba78
SHA1 3e3034f660e2eb83808d21554b9280802f284792
SHA512 767bb82d76cc15ef457e274f66ab592badb62f5b3642fe4568e3f81b22a6867134412f5b545a6fb4feb4ffdd9e93285440fe1b3c53dfc96a5c17054370a46f7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 247a94cd1ffcecdd29a5baf04af1830cbf9260f2b2edd789c9afac3f91ffd1d5
MD5 d1f39e3bde1e3dffa17b91e0c69851a7
SHA1 34fb0b44ce07ffe44e01f53387bf203965cbd857
SHA512 967dff46f84b5cdb30a1b6ae982f8ffc565ff2c6aa2757ae5fd4bbefd14ff647e36f1b31ddf61fc6d9f8f69b0ef2f812b54d217b91f4e8642dbbe7ed7263771a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b2c58aede618283ddfa52da8eda21931efe86fb851cde005f0f87519ef7e565b
MD5 c9b191fe43e50042d750ce6c1aae37d1
SHA1 96a054ff9b8c6059b4b9f753e80b78f25e720e7f
SHA512 9eeb97cbb7a0772fd342972beb2189db0c99ddabe249f34d1b44834956a0856539515046f6f165cccc5345d291c361fdd009ce1ae8bf88c701f66671b727c1f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e6d5c56a06af6211d4cee0fc75025c2d410a5f49bcba51a48a2e4f050ace57c7
MD5 373b3ef5842dd72a76296d171066c159
SHA1 7bc2a7f2ba152f40e23ce80ade885011c08ea683
SHA512 2f221361eef84020b81d7ce882d962c414c023c4b792002c72c10bb79e99e49ecb1ef483f9500a4d2ceceb9e93f93507dc2a7acfeacdcc060d9dd0370baf0a8d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df4b6afd12a89762a2af04a5ec582ee1ab89b56027239697346448c230653363
MD5 1fed6780dcfff457f886cd857a65d63a
SHA1 b264d56001f1d482d3b032de1d5d820d0e1ce215
SHA512 d82743534e0db2902f6b0ba7788788df4d3fd44261f1f8c3dfa3aac728a42dbab7e15e04c39180bb2a819793198653578fc6d4e41ac3b8ec6e80c1749345aad4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Music\qap`g`v~dtlq
Size 10B
SHA256 88286679f6c54c1916603446bae58966796adbdaa986c5a6950a8157e04d9a3e
MD5 e47c88aea008d02847687183b5ea89b5
SHA1 9d6a3252affac178e77998862f489eb9f1b86d7d
SHA512 6836d2f6bfc0fa3831b3de6d67d9fb910739059020d2fb9067b5a792338a941884b02d86cdcff307eb484066b7453a424ae49061872e3b389be7c029be1f165d
MD5 SHA1 SHA512

Submit Download

svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACCCCABBCBAAABBABACBCCBABCACBCCBCACACABCBABAACBACBB.exe
Size 6.1MB
SHA256 9264e21c3e66527fda9ece484797465a3f2f4e172944cc44a33393a4e1d0a59b
MD5 664fe6f3da050df194f111d86f156f33
SHA1 a81c4ac372f104540dd3d54f583a99c3e6ee4e0e
SHA512 50d17ce47c656cf91dcac5931e85517e69171289ba8bb38c78896b0727c66c7e3d6ed90cc019c192c93e276c6da3adf6c0ee797f928be07d60afe692892e66bb
SSDEEP 49152:U+ES+ESgq+ESm+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESf:M
TLSH
T14E562B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b4172fc6a43d8faa5e624af4adfeb4536fcdcd77e57243c2ff0813f1d8b7d81e
MD5 0913354d71094189298bb6fbe5535a4f
SHA1 a1224f7c24f4e2a4b87490bb3309875258d0ba9c
SHA512 e6b340e708dfc9e493d021390ef3cb8c752c8eb8bbda2a37b2b6f193caf0f63354684168fd7e7e56ea46814ccf49a21cedf725bba9533624aceb2df4a3a7f493
TLSH
T152210871F0F6C853F53128DBAA29DA871CE53BDB989CEB585345011CE3A9D398E210F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 7617a2db2d486c7d719bddd434515d498538556fba9d44d7e2dbe410fdbfee51
MD5 66f99abf5ea42b2e171bf9bec798551c
SHA1 9430b94f26869209cd13b84d70f9b6c46cf93490
SHA512 1a7d8dc36425cedd4aac87128b955cbdeb586bad7950d4d2d1226795f73be257a0c0e6b293a617d99b123e502730fbb4719192ee21f8f27eb6d5418ff94e71d0
TLSH
T15821E731F0F6C863E13124DBAA29DA971CA43BEB989CAB5853454118E3E9D3ACD250F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e133038a3f0621091347c252a2a8375072ce45b6d0c23f75e74ec056406b7d90
MD5 975abd188fdfff20b94e32179e93f357
SHA1 48bb69e4f52cf1b6d14a609c541b66b4a1b963a4
SHA512 072ada318358bd81f49653616d1c43c25de0940c0d5c010c69938f6ac4fd2fa813ba09783a359f6771915b3ea1231c145bc6737756d385fac48b4b87ba913022
TLSH
T16C112731F0F6C863F13124DB9A2ADA871CE03BDB989CEB585345011CE399C399D210F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1040-63-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/1040-3966-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2656-33-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4704-2859-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5200-7-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/5200-0-0x0000000000460000-0x0000000000481000-memory.dmp

Download