75a4b07c51f8a7a0d6221603c4adc6749ed293d5804e0087e3db64ef9494dc8c

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
Size 5.3MB
Sample260808-b5bbhabb32
SHA256 75a4b07c51f8a7a0d6221603c4adc6749ed293d5804e0087e3db64ef9494dc8c
MD5 25fb8596df090987e0e676ffdb28a065
SHA1 b4147513e0de051c9703317b8b55962a8319c53a
SHA512 a6a539d07b64239fedb5dcd6c01fc2cd4b4127ed7aa1899e7dabe7caa076f94f007113b91ec63978a68874ddb2f3c38e610f009c12d59dbf707b7c43e3b01db1
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7mp7Dp7Dp7Dp7Dp7qp7r:vBBBB0BBBBor
TLSH
T160467C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
3472	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
2080	svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBBCBCBACCCCCCBBCCBBCBABAAACACCAACBCCBAAABBACBACCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe"	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCBAAABCBCCABCACCBBABCBABAAACCCBCABCBCCCAABAABCAAACCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe"	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1704	sc.exe
2612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1316	cmd.exe
3200	cmd.exe
2180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
2080	svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe
2080	svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
Token: SeDebugPrivilege	5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
Token: SeDebugPrivilege	2080	svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2180	1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe	96
PID 2180 wrote to memory of 1444	2180	cmd.exe	98
PID 5436 wrote to memory of 6136	5436	svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe	101
PID 1848 wrote to memory of 1316	1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe	102
PID 1316 wrote to memory of 2612	1316	cmd.exe	104
PID 1848 wrote to memory of 3200	1848	2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe	105
PID 3200 wrote to memory of 1704	3200	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_25fb8596df090987e0e676ffdb28a065_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCCABABCBCACCCCAACCBAACACCBCABCCCCCCBAABBCAAACCBABBBCCBABBBCCCBBBBCCABBACAAAAABACBCCCBBACABBBCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCCCABABCBCACCCCAACCBAACACCBCABCCCCCCBAABBCAAACCBABBBCCBABBBCCCBBBBCCABBACAAAAABACBCCCBBACABBBCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe" start= auto displayName= "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe" start= auto displayName= "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABCBCCAABCABACBBCABCCACACABCBBCBCAABACCCAACBCCCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
1⤵
- Executes dropped EXE
PID:3472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACCABCAACCBCBBACBBCABABABCABAACACCAAABBACAABAACABBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 3.2MB
SHA256 81f1ae082d42071ab3fea4bf58f79a2f3ecfddf02d30d0fe795890105aaa0326
MD5 220f054707dbfe038ecbdf62491988d0
SHA1 99e9eb1950cc4249ea748d1797db604883534c0b
SHA512 85992adedbc9ba56688d49483fbb0f6945f8b4b19e7e7861bf9e9005ca702d3e9f75aa1a55af9b635bd7283a654498bdee159a8949d06b87c1183795253b9bb5
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCD+E6Dd79WCY+EJ:Jp7Dp7Dp7Dp7Dp7mp7Dp72
TLSH
T1BFF58D10B7818035F5B328728ABFD739552CB9714F6986CFE388072E5E71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 32.0MB
SHA256 ffc4ae518f5bce481285acd647655810899e2e4ea6591562ada0be826fa45210
MD5 dc297745c785f3f35a4c902f974b0156
SHA1 a52d6374b6729315e93c9852438159cd0ef7236e
SHA512 e9675da97ddfbceda10f633ecfeedcf7d9eb7531bcee8c488ec1399e75ba0368581c6c179b65656cff4b299b8d35284c78a341d611fab2bc770b9152108788e8
SSDEEP 196608:vBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBC:Z
TLSH
T156777C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 37.3MB
SHA256 bd5e61e9979ce969d89f48445ea644ef99740455052a6c2985cfe234a0e8aa5e
MD5 a9975898053bca423a4007d016f08761
SHA1 733b3eccfff8195ad9ba9b3a3e08e21576af9136
SHA512 9d6782f84f1e3712e1caef2dea8c1c6c66bb07b9d727b77cab26869fcb87cc14d447d106291cb45fa53cef5846fe7b575ed9478f715f65aad01ea3c074c35771
SSDEEP 196608:vBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBA:z
TLSH
T17A877C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 42.6MB
SHA256 cbaaa3d90936cb64e652f2b0203a6f4c975e4dc8134353d10dd555d9b0608199
MD5 b39b61dde64d3b78529432093adda018
SHA1 7e67a85983c18f5dbb77fc0e3407a98620d89743
SHA512 eefba3c16e34e68bc89e9557eadc510039e4b5b71f8156dc8755fea070b90757ff8ff14586ddb42b63cc021e33c7bd8de466bb424356f85d4bd11d327721fe2f
SSDEEP 196608:vBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBp:K
TLSH
T13EA77C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 47.9MB
SHA256 5f7fe5d6b06f7015ef6da8a4ad6b81c63cf59b23b585ab2b8710c9f7b6b40b26
MD5 7536a24ff532017fa343d07a82a58770
SHA1 f58f47d1093bbd41264db48797bcdfce80b0ae33
SHA512 42fc6bb4777bfcc522732b0abe1c75e0a408f21192949a69e89fc2d2f4ef32fc49fb58d0005bf467a7dc7a495bcc14e7725f418d36327265d6ce8288f96d6bd0
SSDEEP 196608:vBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBBBoDBBBB0BBH:U
TLSH
T15EB77C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoCheckpoint.exe

Path C:\Users\Admin\Desktop\UndoCheckpoint.exe
Size 2.9MB
SHA256 823b29915c1585d71fcd2fb3066f7e9deaa43af20c35b11d87f30fb7d4a322a2
MD5 5b110b87c703c3d89fa391a33f1c53d3
SHA1 64e09a6f300879749ea5b16d2e666309b6939a2d
SHA512 66c7d1aea978a1ae15921d837ddfee42f8bcbb96f1676ae36170a5231a33d039f9842c2d9fa9a955d1b22a40873bf913be8d3057a908985ae3bab00e9605e42c
SSDEEP 49152:U+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCY+E6Dd79WCD+E6Dd79WCT:Jp7Dp7Dp7Dp7Dp7mp7p
TLSH
T19BE58D10B7818035F5B329728ABFD339552CB9714F698ACFE388072E5D71AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93ccfa568ca930ca874549cae777e4ed8ed301f90c3d37b51e3e4f9947fbef93
MD5 67fa7983675991608b9a6b2e655f0899
SHA1 5e8f1517c46ef81af0c57e2ab670b38823687945
SHA512 2b54929538af6cc8158ab42c0446be6ce3ee62845bedc5dcf274bbcb4ce828a110b25c3d0e73617752502aa167fcc2a5b0acaf72f0eed8225a8f4c5e4b945469
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a1ac7719d75574be4c6c8693fe4529c4cdc0ff89641a2e85d03a1b974faaf18
MD5 c089853b903803ea049a83cb4b664487
SHA1 e2a75eda5ea15e067b1e5022e07905a385b4f524
SHA512 16d9046282ec82656b3c89c546ea4b457ec87d7ca9252d8fad8380ba44da701ca5f4173409d4841f39287d3ab24d4a9760aa5bddff68dcbf9bcd681ca38c9fb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4922762d94573f24945327fb15a7995b66fdddfcb91a30530c16162736c7d569
MD5 43bd3ed921e782a69f591ab2baede155
SHA1 ed8c8d4651a7ca0ef8f104b614249fb33f08c178
SHA512 69ce72c9f07e5ea41afc16b53a58af327dcd629e18b9b54425ef23edd8c49722bc5d9f71566203a25fb63e1bf0e252daf69acdc6f76ae786db539eb691b9aa40
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4779e67522f1ffc189a3727fb07a7ced14cdf07041ee342c1325c5bedf4b4897
MD5 3caf35dd66cb2f574ddcb12431d62341
SHA1 522f2c9b69036236ccff2bef8005a315d1c74fa5
SHA512 63b2566080d8b3c9d608d760ad9bd463d7b6073b76e98b84eaab0f09c1b46130f6b386e91e76095fb77db1a7e5b582867420e34e966e7af811e0c3fbd40a35e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e818f9b929afb8a3c54c4adede9bff2112b262c05474eb675eb038364363f796
MD5 b7668d2b1e473c4531dd4e9e59fbcb3b
SHA1 f90b9080360ae6eb5aa34b384012e5028f804034
SHA512 ffc01adaf1122c0b850688a180d19629c2711351e5bc9fb21ea962f1d82d234fa0859900695267425d501610f7a666b39b5d2a8fb89d6c9c8d6babc951a48739
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c9fb4ef035cd68095fde03fb9df1ecab36bc3f0a5c3a9a3cc80ff895611c15b
MD5 9a12bad6b8e81a0520c9d3a3e13cd653
SHA1 ae990b6dd7e45299f8dadf8dc11ebeef55f2a987
SHA512 5de47b8de73527ffdd7247ecb3c9d654769b97ef5bb8b0ff8efcb5ab04f79a830ad8d6b8b2814f4675ad7edc9cbf79974eae785ca843861d55147eebbffca604
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 88adecbe10776dff21815dec07c77e991c50b325d5a87dab5df4e686bdea1bde
MD5 cca9c0cba14bcdba3a4b650011bf4a5a
SHA1 0dfcb236e0e45647cd8d7142551e887e95c8c62f
SHA512 998f1381c776d3e5506fff80e0ea8e1b55897956ed666c847dff7e955b592619a083a523df0317ed51be5f696b3aadbcbd8812fc3b9d7d667827286f67f01f38
MD5 SHA1 SHA512

Submit Download

svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBABBCCBAABAAACAABCCBBAAAAACCACACCBBAABBCABCAACBC.exe
Size 5.3MB
SHA256 75a4b07c51f8a7a0d6221603c4adc6749ed293d5804e0087e3db64ef9494dc8c
MD5 25fb8596df090987e0e676ffdb28a065
SHA1 b4147513e0de051c9703317b8b55962a8319c53a
SHA512 a6a539d07b64239fedb5dcd6c01fc2cd4b4127ed7aa1899e7dabe7caa076f94f007113b91ec63978a68874ddb2f3c38e610f009c12d59dbf707b7c43e3b01db1
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7mp7Dp7Dp7Dp7Dp7qp7r:vBBBB0BBBBor
TLSH
T160467C10B7818035F5B329728ABFE739552CB9714F6986CFE388072E5D70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 fab3222cde6f8554c5b9b561f51de0a0cef7f0f77104c5e94e32661dac3504b2
MD5 cc45c5bb1c692c606c35cc7604fd1742
SHA1 724830c71a965c4280a54de44cc527cc7729d3a9
SHA512 614b5ac113169e25db8efd0be9b3a31f212c9205ef3ca25fa1ee7f99335dc453855fd680d2793aff52f02a162c04ca4a3f0e188697ad377ae0f9963c248cf414
TLSH
T127110421B0A9CC17F6332CCF9E29DAC28CF4335B9CDC6A01E209411867E9830DE19CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-22-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1848-34-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1848-86-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1848-0-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1848-60-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/1848-11-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/2080-109-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/3472-94-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5436-72-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5436-33-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/5436-51-0x0000000000450000-0x0000000000471000-memory.dmp

Download