895879819ad72d88021be59a9c4e1e5d2bad113873550674ed9ea568ff467e80

Analysis

max time kernel
144s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
Size 3.0MB
Sample260807-s8k4jsgm6x
SHA256 895879819ad72d88021be59a9c4e1e5d2bad113873550674ed9ea568ff467e80
MD5 8b33431333cfe1e96e73324050c1b4b4
SHA1 e6148263b4c597566997421d05d48f2eddacbe2f
SHA512 5ac310ee88b774425458cd3b0f9b133ff4650ebd92950123f13904868c6f83be0e2b21c8b6b28f02652034c263ae956da51004c3449984755b1f3f354e8f7b7b
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC8wq6:Jp7Dp7Dp7Dp7Dp7l
TLSH
T11DE56B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
3064	svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe
5976	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABAAAACAACCBCCCACBBBAABBBABCCBCCBCCCAAACBCBBABABABCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe"	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACACABBABBBCCBBBACACACAAABBBAACAACABBBBABBAAABCCBBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe"	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5740	sc.exe
4120	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2600	cmd.exe
5504	cmd.exe
3088	cmd.exe
6092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5164	schtasks.exe
5300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
5976	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
5976	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
3064	svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe
3064	svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
Token: SeDebugPrivilege	5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
Token: SeDebugPrivilege	5976	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
Token: SeDebugPrivilege	3064	svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2600	1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe	95
PID 2600 wrote to memory of 5164	2600	cmd.exe	97
PID 5472 wrote to memory of 3620	5472	svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe	99
PID 1428 wrote to memory of 5504	1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe	103
PID 5504 wrote to memory of 5740	5504	cmd.exe	105
PID 1428 wrote to memory of 3088	1428	2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe	106
PID 3088 wrote to memory of 4120	3088	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_8b33431333cfe1e96e73324050c1b4b4_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCBCAAACBCCBBACCBACACABCACBCBAACACABCACBCBAACCAABCCCBACABBCACAAAACCCAABAACCCCCBCCABBBCAAABCCCABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACCBCBCAAACBCCBBACCBACACABCACBCBAACACABCACBCBAACCAABCCCBACABBCACAAAACCCAABAACCCCCBCCABBBCAAABCCCABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe" start= auto displayName= "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe" start= auto displayName= "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCCACBACCBCACCBBABCAABCAABCCACABBAAABCBAACCAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAACABAAABAAACABBCCBBCCCAAACACAABBAACABCACBCCAACBCACBCABCBACABCCCBBAACAAACCCCABBBAAACABACBBACACBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAACABAAABAAACABBCCBBCCCAAACACAABBAACABCACBCCAACBCACBCABCBACABCCCBBAACAAACCCCABBBAAACABACBBACACBBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAABCBAABAAABBABBACBBAACCBCCCABCCBBBCCBBCCAABACCAAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1c903bc9b3e07cb980553460554328362bf02a439e69b4f7117e4f562e93ca15
MD5 65f9fed8b7a004d26698170921ed2531
SHA1 29f3049248dcfb50ea8acad303561314f7d1e7f9
SHA512 bbc7895d7bb48ce51c15608532460bb0e037a3d924fccfff7a4a053af68d98e59b46ebc23f912ecff621af0529fc4cbfc7a35c3113d6ca47ceea4e0c5f8eb8a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\qap`g`v~dtlq
Size 10B
SHA256 bcc61b6e1d1b381e621cfaa3a6edea71b1dda8850b83b4cc74957fc26dd044ae
MD5 04ad7af6fbd63ca6ecb0bd98a5a8a68b
SHA1 e435aedf6a3496c1fa593e75ebde7a2586f76537
SHA512 3d435604ce988e52497b236ddb02db19bbb2ceed9c2746cc6788cd787a193ea4ca273a65d9924735d09c6d675ccdcaf5040ca4dea6a7298077f8a1ce98589390
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\qap`g`v~dtlq
Size 10B
SHA256 f2f594d09940acd3ca1c60b15ad49467f6217f4b3e58e383b35194a8f89a9c74
MD5 45805e22f22997f97be8049ce17da6a0
SHA1 484419a1f7e3a79c0b2daf3a8eeb4b155c2a194d
SHA512 01bfaf5576a8b3c80ec681d590ed03edd0c5a9e56d9e7f6ea5e7e8badb13df008a4af4d40b9c1bb66404f051e590130a7a561c17e53c966fcbbf9039ce103921
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 f4bd6da008c55b83024d3a92a3fd890c1e1e773f2a16f23fa2439eb86f2ca8c2
MD5 1474d4be4c5c6ca6471a1f1faea3887b
SHA1 7854d15ffbf9120b0aa6388871f3e7c5b8cdee27
SHA512 1c3e04c6cc9a273a23d370948a4ac3a58b642e2170d43c98c996d27a1ca08dcc7984de19258b4ced09ec8778820617d57d1060634e9bffe7fbf33f3a438f52c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{9F51D16B-42E8-4A4A-8228-75045541A2AE}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 5f7d94d2fbbed01aec616829430d1842566d90f5960daed6b8dad0096f0e4f6f
MD5 b43bce9eb16ffb705ae6f9e77b3acfd3
SHA1 b5f72cd875e5c4d77b60f1760189ceddf9034f42
SHA512 ca255bac359f520e7cef39aa444c7ec2398a659783fe5ac978028a4391bb4da148fdf8fb51b12544378a82f3d5cf430637754eb47c59b1c296f044961dbe7ce5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2\qap`g`v~dtlq
Size 10B
SHA256 77d6448d14be906300ab4ef1607a58bd4b522acd9a6e6242a0f5341b9af5d582
MD5 ac7710b4aaccf6b2256743bf322b5c5a
SHA1 55c4f951cb8b2aca96a773170351a899f927b028
SHA512 f195d65675194c07d36fcbf9a3a3d3b481d7df43bd5d6d9edfdf30326dddfdbc088e090013d6112977eee722dcf21ad592051113b8c32ca60a613ce84ef4f6e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ProbabilisticRevealTokenRegistry\qap`g`v~dtlq
Size 10B
SHA256 4dda107fd488d2fbde88dd92efb6b482255d21b3e6cca0efb6c30f069cf30b1c
MD5 1cb614df2437123beafe3fa0cd9e0b06
SHA1 f51e5c840d39221960df340d9c4821c72c747963
SHA512 0c2746ffe0e87eb59a8aa26927a9966c545f2031c8c436f4ba637d77735b424763bc6074d08ad145eabfb8bbf0b8d951410b959fa1ae1619a16e26362b4d041e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 d43dfaa8161b3dd665c476c217e6cb2a1443c29655fab3422ec83ce6d1106676
MD5 caf9dbae4429f8f22bbb61f63a75d501
SHA1 2c197e79d8e2f79828115c6e34b592eccb3c03cb
SHA512 232dac529feadcbd659d858a192a4066c839169ab2a44bc7a019f0b550f79301e700b161db2422988825b28a7acf3df1aca0779759f5d7ec90a48e8226f595ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\AC\INetCookies\qap`g`v~dtlq
Size 10B
SHA256 981eec3678eb8aeec16ea08d6ac516347fac7242b68af050d5487d341f7c0f8a
MD5 9d5e5d72075816a3845ebf9dc6c0c4ab
SHA1 ae1552c30e559095654f49215c0e1683fc9faaf2
SHA512 1af0fb4390d3b0a7eab8336c5eb829de04eac43f32b2ac26a5ddd65ae20d40894785f929ed49f29d33a6f04119f182815994ae9f0bbd4f6eb590fe0e47481f46
MD5 SHA1 SHA512

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 38.6MB
SHA256 adc5e34e75d4bca14a93aa6c9a2742c1f84214ca6074d97c32bc31b90435b972
MD5 9a977f4d410b4c42f210821dc2f3a7cc
SHA1 70884d68c3d95d50665ab4232289ec3d9d400c3f
SHA512 a2d86a0c98454b61cbd145046fafbb6d8887aad5ec488c6165d52ac086873d6b2347c82abcec4043679396aa44ef46d720a984f13bd72677be25d4e65d615782
SSDEEP 196608:vBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBK:C
TLSH
T17B976B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 9.1MB
SHA256 54c5321355c69c93899759fd7a1fb27f79ba50f23a367ff309c8dd764808b083
MD5 10530f64cf1272e4547619e56684ba0e
SHA1 af2ba0e717859d3ea1b9207368099af188411183
SHA512 082aac5e9883db5615e30d225c35a42d4dc4af89e8da5aaf0eafba410ef6f5e8cf92e060c5ed653cd528f4087e1696e1207f3f35617206302bfc6786fe27e730
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7Y8Y:vBBBBxBBBBxBBBBfY
TLSH
T1FCA67B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 1.3MB
SHA256 81b748aad07edaa26097f0cfa5125621d2e912f71e9fffc9de5e19d2d07a466f
MD5 b2e7c4b8be36cd42365f4cde1dadf4b8
SHA1 3e59cb2ee07efdbbe7e9b28eec785f6968ecf98a
SHA512 9c47405c0bf286b336b7b7ed3d5702af7853d70ae235b53f9c421da05432378be2412a5461910eb9293f72f7f19afa8faa6769d0984c738b0655a68b7fc53627
SSDEEP 24576:m9+EM03afDd70iTWCa9+EM03afDd70iTWCa9+EM03afDd70iM:U+E6Dd79WCY+E6Dd79WCY+E6Dd76
TLSH
T1F2557C10B6C18035F5B328728ABFD739552CB9714F6986CFE388062E5E71AE1E93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 17.9MB
SHA256 c4098484ce99565fb60334d7c37a79d8d690035ee78e98c8ae60547625c0d4c8
MD5 c70426977ca868ab1380779855b5caec
SHA1 92bc9d1e5f41014cc7677c04793d8d35c3cee452
SHA512 d5d25c7270c425fa69880eae003e7e9b95ae458b566de2172d8cd65c9d1455b8113c553f09621ac60bd41c0716ae0e8c26b1476312c5fa51477076c86ba97cef
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7zp7Dp7Dp7Dp7Dp7zp7z:vBBBBxBBBBxBBBBxBBBBxBBBBxBBBBfx
TLSH
T15D176B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 20.9MB
SHA256 2fa9e845196d6c8d90f97a0611e4320622ce16ce05b430eafb4b1dfb0514e222
MD5 412a9ef731f098763a4078481e4b025b
SHA1 cdaa07d57338f26e37f2e7f8c3bfd8965aa5dfce
SHA512 9f3694bec8becf2183d6f3eb88ffc721df1920ebfa743eab4f3fe605b51d9b78fb10c85d49d320f856195ef6771fa55b1dcf09f869705215b23afac445c576ec
SSDEEP 196608:vBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBfn:/
TLSH
T183276B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 192KB
SHA256 aa4fe3444e9b06c8097f4e8c857527a6ea7741723fb1baf41daaf11913da9af6
MD5 6edd21b266b363155dd22af0fa2d48ff
SHA1 5cabf74b086afeecf57e562455026d8802fe98f1
SHA512 e17c93e3ee1dfaa1106c6a777bf142861326d41c692236fa5660e1921beb8108589710e9dde0b7704381ee946e4409e1ed04e0526a2e29090757adcf6f396146
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoee/zdOXikpQ3N2YnA0QaSmwoiUrqN7gk0BX3hk:m+dTTUFgEs3XojAdc90CA0QawtUrqNUI
TLSH
T1CD148F05FD424032E97730B18DDFE27E9668AA114B165FDBDB8C89365F339E2653820B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 26.8MB
SHA256 04abad726b173a11f4d5bdcba81d22555a1617ce995ac1ff4673572c594a4986
MD5 020685410b16e454ae3ac8bca554f3ac
SHA1 b84e7c2fd1301fca18345a913a4608f321727696
SHA512 a3168ae3905da483c0423c3123f3466f4bb9ee37a4f3499ba237ba35eff378057b8ddc69998902369e90d8bdababf50d1eb7a49abcb669b9ef5d5c80c0ea3ab1
SSDEEP 196608:vBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBf/:f
TLSH
T187576B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 29.7MB
SHA256 6f9c771da5f36dc20527688a4228164a7e6da5f5059497b9699da224a06b54ef
MD5 a8b2589d992e74759b7e1fbe00f2b31b
SHA1 40aaafa9611e79a6f346d780ae43fdc2e53c8605
SHA512 4ef586776885296339f9fe1d3e546fb90216a8049aedd2ee3e2dd9e35092bc84b8732a1df16fdf3c5d9406bf5c4c4632c0088301c66cc4ca6640cbfa41136725
SSDEEP 196608:vBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBxBBBBfS:o
TLSH
T190676B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwitchRevoke.exe

Path C:\Users\Admin\Desktop\SwitchRevoke.exe
Size 1.5MB
SHA256 af1de9223d36647f0a34b6e66f92cea84e6ace016999f5257845bc40848ddd24
MD5 73a1d8fdd19e3c2dc7a35d43ba45e284
SHA1 491a04c970e3a175fa3ea9e05b397c845e97c6e6
SHA512 bcb6c4760ff2453dfca5143ae71450b64e86114439e2d37aeb23acef20a4304a4e02eacd8d305169b870809898da195d443dd86cdd30ef84e6e51afd129fa92d
SSDEEP 24576:m9+EM03afDd70iTWCa9+EM03afDd70iTWCa9+EM03afDd70iTWCa9+EMR:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCYA
TLSH
T1E2757C10B7818035F5B328724ABFE739552CB9714F698ACFE388072E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e9ecd1aa1fde6ec2a7e65e72de5d0e6af2a2b0dc0620f508b95a4acc6113e60
MD5 a7f04563338143745d1fd37a38d7417a
SHA1 adaf5e54ebcb0a94186fb62fa36753fe78a475a4
SHA512 e7aba632f04c397c3dbfb834c8453dad3398c55b0e412dce69effcec4d771ab5b7364b9f92bba181d9df00f159557044e6bd2514aa18cdb271c3dfb55e429b11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16605ab8d5459201f0482ec35ceeb1c3f8f1091cdd07648a4f76022fafbc9c09
MD5 48a9952b5de25137710104b0299ff278
SHA1 a24c25175998ea38e90c1b54257489300ce20406
SHA512 5c5d36c9f37c6dad1100d13ffed45245c16ada7e7eb40b9a66a48234b1e19501c42dc70092ee97d5d1d7f879fd50fcf5f2cc78317f63c5c1c49fec0ef1a1e27d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fbd0b5f8775537f9e1834b70781fc5a63bd9fa57aa1cb4c4ceb0cdeb7725fac4
MD5 447e110430fcc3b3d77bbec391a26682
SHA1 bbc28713c3eea9efe889b0439493f4afd9994537
SHA512 b623e14266645f9cf4178c0ba21ca7d2a8a9446098019837216c441527793a01fbc6a8fa6e2677e46fc4a4a0caa31a3536f44723cf5c8482170c21fdbe02ac78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d9f1df0cdb71a9c1eab5bd506226ba7116a133d79933fa812a4d214a6356e11
MD5 c3afe89f54aad4ce86de62e452cd2934
SHA1 3e44df4791ad5168cdbb4d752db6dd131d17f00f
SHA512 83b5277325914332b865d467633d69e9b892dce3a1875fc25ec9ad9007defc7202e57a763f3da28c4398334855c9b65b6187e9771afd5dfe4cf7ab66faa82a3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dbb1a055c32b8161f96d0457ea8cbcbcf25102cd3e59784145b55c8804cf8f98
MD5 a0f7e3bb3f3f4f2de5d3267707cb9394
SHA1 5da59d0a9e5490754d5e097447c484b2787c7fa6
SHA512 44808f5a2fcc6fcbfa397427b55eef05a479e6f1e09755b6fba078a62ac4bdee23d957788dc8bf5982c2f8ed612fb97f88f14a71006890f3268a1d3bf38ddf86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8a29ca0ba1bce21c1f3d3e54c74b6191365b5ab5e73c59dc4e0642c54bb11cc
MD5 d9f26e9a3e1e7ff45bee259889c17526
SHA1 7a12b25ef4aeddb74c9fa80b856bae84e5d9e22c
SHA512 140d9b7863f93ee35cc4ba96e59e4bc77d7f61bea1a624b44b82a6963e92f594eab20f494f689d83a87a050d5c924b7123d9cda5924be78101952954fd14959f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f690feb39a92cf7fd9c99f8fba7fdff79ebc0abf6d98aeb2ff8b69ee05f4a836
MD5 1c4887e4fcdc004500ca036c30aeda59
SHA1 8835fd778ba33d5b5b45354b9ee7852e271acf11
SHA512 dfc9a45250fa6203e85b833dd4fdcdc6fafdc10e1f2cf6ad4c02963d7b2f6a18e47acae1dfe153f3269dfb16b2d674893aaf109a94fb8ab0a5344d34b864a1a7
MD5 SHA1 SHA512

Submit Download

svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABACAACACCACCCCCABCAABBABBBBCAACCBBCCBBBBCBACBAACBBA.exe
Size 3.0MB
SHA256 895879819ad72d88021be59a9c4e1e5d2bad113873550674ed9ea568ff467e80
MD5 8b33431333cfe1e96e73324050c1b4b4
SHA1 e6148263b4c597566997421d05d48f2eddacbe2f
SHA512 5ac310ee88b774425458cd3b0f9b133ff4650ebd92950123f13904868c6f83be0e2b21c8b6b28f02652034c263ae956da51004c3449984755b1f3f354e8f7b7b
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WC8wq6:Jp7Dp7Dp7Dp7Dp7l
TLSH
T11DE56B1077E18836F1B329724ABFE7390839BA714F2885CFE788065E5D71AD0A935727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 6a9f8f8fa7dd390397b286a7ffb1c0ba04b571de4b6f0feeb43aa5cbd995a374
MD5 c8abb01c325420250dd2b8d024f83c8f
SHA1 4c2e4b77800b8dbeff9f8d7792b39bf5d81ebd5f
SHA512 699e10f8d6dc41eff9f24bcbc8b06698d8ed745706905323d9f04180838e48c6541261760f52c29124e42aca6fcda89de687a1b403e5676636815a303640ebf9
TLSH
T17E21D861D0AACCA7F43268CF9725D9C21CA4775F9C9C79489308C218ABCAC338D5ACF1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3c57d79792f79673a1dd61e0b03a27d7a9cd631b746582d566945e5e5f138d7d
MD5 00186470eb656af4bcb6314390cf2531
SHA1 92641e16a6bd4a6b0e2cd12a6ff6139dde21f5bc
SHA512 6f4dffcd0b95c0e1de862a6092832e561ad1ad6ec7c2807c2968f3a637fe6d7613e27669df11bd412b44b58c6012962d9cb9b6da6faec2aecee9be2f00292db9
TLSH
T14C21C951D0AACCE7F43278CF5725D9C31CA4765E9D9C7A589308C119AACAC334E9ACF2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 dfb9809b7917040052abbf20286519496a2a673b8f0b5dae52a18f9570f9fd3d
MD5 15e9a5baa6fa28d0ee105c8cca72f965
SHA1 79353928782d8c0e890f836f6b91d93a92dc80d1
SHA512 f747e70ad62eb2a6890d75c069e449cc2d9f9b2ae9017529f4f4b06f63484c8db090f0dcca17e4ea5f8c45aa676f0407cba70cdba114efbe7e4db095b6e3e08b
TLSH
T13C11EB51D0AADCE7F43278CF5725D9C21CA4764E9D5C7A585308C219A6CAC334E9A8F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-70-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1428-48-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1428-95-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1428-21-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/1428-10-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/3064-2377-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3064-80-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/5472-47-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5472-69-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5472-91-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5976-869-0x0000000000920000-0x0000000000941000-memory.dmp

Download