53701a56da61ef3302e3de7112b6a1eb7cdc4a2afb160aa7ab42006ba3d37b1c

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
Size 5.5MB
Sample260810-dfp5gazelf
SHA256 53701a56da61ef3302e3de7112b6a1eb7cdc4a2afb160aa7ab42006ba3d37b1c
MD5 1e38f6b05343d4342b9e4b2e78ccbb57
SHA1 8f0c7c077fda70851b2b3096c32ab5f9a67e01b4
SHA512 7673bf76c38460333240f4b67dfccaaca24e5b316faeff7e14355cf70df1487ef8f48bc82684b992cce229dadbb9ba41f265d4ead513ab5ca20385e490a3fee9
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1PszUp74:vBBB4xs6BBB4xsm4
TLSH
T13A467C11B7D18035F5B329324ABFE339593DB9214F7885CFA3880A2E5E71AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
460	svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe
5332	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBCAAABCBAACACABABCCACCBCCBABAAACAABCBBACBBBBAAABCACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe"	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACACBBBBACCACBBAABBABACABBBBABCBBBABCCCBCCCCBCCCACCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe"	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe
1864	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
612	cmd.exe
4536	cmd.exe
5548	cmd.exe
1796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3724	schtasks.exe
592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
5332	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
5332	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
460	svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe
460	svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
Token: SeDebugPrivilege	2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
Token: SeDebugPrivilege	5332	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
Token: SeDebugPrivilege	460	svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 612	5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe	92
PID 612 wrote to memory of 3724	612	cmd.exe	94
PID 2376 wrote to memory of 2400	2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe	95
PID 5044 wrote to memory of 4536	5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe	98
PID 4536 wrote to memory of 1864	4536	cmd.exe	100
PID 5044 wrote to memory of 5548	5044	2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe	101
PID 5548 wrote to memory of 2772	5548	cmd.exe	103
PID 2376 wrote to memory of 1796	2376	svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe	106
PID 1796 wrote to memory of 592	1796	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1e38f6b05343d4342b9e4b2e78ccbb57_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCCBCBCAAABABBCCAABAACCCCBACCCAAAACBCCBCABACCCABBBBCCCAAAACCCABAAAACCCCCAAACBBBCBCBBAACAABBCACCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCCBCBCAAABABBCCAABAACCCCBACCCAAAACBCCBCABACCCABBBBCCCAAAACCCABAAAACCCCCAAACBBBCBCBBAACAABBCACCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe" start= auto displayName= "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe" start= auto displayName= "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBABACAAABBCACBCBBBBAAABABCCCACAABCABABAAABCAABCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCACAACBCACCCACCCBACBCBABAABCCBBABAAAAABAABCAABCCABCBBCBAAACAAABABAACABAAABBCCCCACABABCACCABAAACCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCACAACBCACCCACCCBACBCBABAABCCBBABAAAAABAABCAABCCABCBBCBAAACAAABABAACABAAABBCCCCACABABCACCABAAACCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAAAAAAAACBBAABBABCBAACCCBCBBACCAAACBBCACCBCCAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 67e0dae62fbfa48cd601d2fca566a68bb1fbf33194640e737dc5000c9a42a9c7
MD5 97ee19772064a6e5120cfcf0c620670d
SHA1 46941c608a4abb34f0cf0789605f3932537fa809
SHA512 4551fc90a1c0444e3fdc8a4781fa8533214156fde3f80a64849a0515d9d8b4e0b694159c30b9c2dec7c40098a22d5765936c2c9931146a9b2fb6cf5c85b5fa3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 4b5d696dbb52a5f3c11e832f86cd19a3514d4c4e14d24064a09548d5f3d73a98
MD5 f9f01a515e952a0c30adc0b24e4cd463
SHA1 e3686445905695b2eca128c89a40084342e7ad96
SHA512 eb8210835e52d5980b8791fc610b0fb766bbe13a356cef1126baf0af8cd67d8add901933fe264ed60dd6c091a8b87cd92ea1141909c110dfcba8501d9f30fc47
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.IrisService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 524e7d7005dd850eb167a51db8e62c39fbeb977ad3d30cb89356f142104f848d
MD5 e32cd04c61e1a6c7ac220cc646bea766
SHA1 b93fa8e07956237c12ab53464387c306222224c4
SHA512 179cc7335d4c53816226078532d0fa018274480f4ee518a7d91999f532d1effffd67e5574d797aac652f4b268b9a2ef727a6c1a8791ab44b130ce73bb35b8a24
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\windows.immersivecontrolpanel_10.0.8.1000_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 83b9f2669cf1c8262432219ac4ff1f912401591078a22a1a2d5ec1f8981d6e34
MD5 bb3466b4f6ab0d8f3a5e92aebe45f157
SHA1 250fe61d32ce8ad0b8f166e150e2a5aa9d08f6cc
SHA512 e29c9bbea2210627d9daf86a24df8c724af823d422e4c87baa08048d1b124783a00896ac95704d3d6bff5522a6108eb0576f8f9af16bb6bc990d6ac114b01ac0
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 6.1MB
SHA256 ebc55c8cb7032d178b6e63adaaa412187ca991fbf8af1b857621de84be246a1e
MD5 592c6af9ab9db3faf13c84515a991a8c
SHA1 afeb36688fa9867a7bf600e087fca16e5a903410
SHA512 e4495cee90e916305453c9070063a2f07ce030d3265bf1da55ea73dc336312aedc5a739633c983cb8cc6599d89716faeca6d3837d0e6abc8866f9ddb25f3ae36
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1PszUp73gZ2Hb9t+2xz:vBBB4xs6BBB4xsm3gZ2jz
TLSH
T13F567C11B7D18031F5B329324ABFA338593DB9214F7489CFE3881A2E5E71AD1A93571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 83ba2cf95a86984370e176fc4c7a1ca63f15b499a976975d023ac21eefa61891
MD5 33e67f0fac1276fef28471dafa80ec82
SHA1 ef92fd122d3dcf33c24bc17ec682db440ffc83e8
SHA512 1914c97fa6a4a6475662abe945f587d6f95464e7f88f7685d38c21ad473830dcd0cbb697a2845bf0bbd778a38c16d2303e3bc85918545aa6f8aecc31502bf65b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Feeds\qap`g`v~dtlq
Size 10B
SHA256 24b5e5f2ab24f33b699905b18bcd8bfafe82596cd8cd505c74930c7c44c5826a
MD5 ea11ab7e43023bb9c6ca17f1702ffa75
SHA1 7b652eee40719642b8ae28a119c765c12401e3c3
SHA512 0c3fad046b06503c6c1f3b9963d008db9273a7bf42fa4049676936ce094fa3ad9dc5d0a86480a041e18dd6c65a38ad9d34b213b49aba79cc06684b27b1501841
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 2937f1b164a01f706709396cd3697b359fe7b03614efbd65194c623308e96395
MD5 89f415642148fd914ee6e8ac4785e7fb
SHA1 b62371842ae3efd2502bc57e4c0a4d3459d11513
SHA512 62bbd1a6608c82e06f002631a9c858b2f14d352f3e25e4d8c33d0ef1fd514f798e0227fddb5cfaaf2b4d63c6b1d71ba861553c85956de4b914a98388020e0e8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9955df700b96fbb56f4bdda7b54c95e77260cdc68cf4530e660a3da886d2070e
MD5 2f33ce919cbea613a61e82443b458e2d
SHA1 21dde035ea73af48e89b3b0f58bc75bafc791ceb
SHA512 b0c6136d2d798587251afa6b2f9223b6516bc6657f93f7ee3ab61248277af98b8acf9e2a5cdff11906456836643c9ee5c10aa27808e0c6da7f53024f6359d40e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1eb665887715e63f4609d0d00b29164f2934bf8c4ccbfa15621f5bffa17fa53b
MD5 8200beef857d05cb075f4620dabe183f
SHA1 dbe4d93c223cc66912e3cce2f3c1ec06fe0e4dff
SHA512 f5075a6f5cbf647bd728e3a4560308c3f07089c2ee942ab68cd8bce5e8da13fd1f8162e16117bf230e27ee2589ce87288a62826038660e5fa117fe63129bd2e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5be73cbaaaa53b36d8e87b5f374ecf0898bb281a4f4a5f510131bbaedc11a01
MD5 ce95f4661299f69431454c9038325e0a
SHA1 1bc00c254b80639fd3026c528ac79492bc5cfa1e
SHA512 15045f621e2eab2d45356f1054419eb7c05e3334e467c28936e732a93287ab313670831bf9a69f178d532ab50b316efdc1be25e3f767fb6fd1c4da2a0fe9cf41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6eaa4d906ddd2aca1e20cd710df14355f5b8795e202681b2f3dde13c97550636
MD5 50f7b438b494a56c65dd6843cfb55838
SHA1 567cf709c43b08fe2ed3a39038faa432ee62de0e
SHA512 52abf92940179c55bf33d23b6e06b6550a4141764640024515add8177631af992d3930d47664b71bc77e12f54f9dc2de27b0a23a197e85e946b6885476bd5c4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8abd131ba09b87b86591bdcc61b3cf13a79a161367d3c69f02851fed64f4772
MD5 eb207ad65e7dbdb1c137675c58367e20
SHA1 d3a8f3da479a39c8dec2011d505bac8b145f3b41
SHA512 32e51a2f8d611fc32572e8ac62bfec5c28c785df0d2c681ef793ca72f002d9f68447eea9ca74e5787674cd147cbcc569cb9a0f917d7c422f1846f87217be4959
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d0e8d38fa4f229547dca9773b967bbcf7812c7a5fafb8340729d3c0e06392b3
MD5 7999368e44d954ca7aad018639d281b4
SHA1 a7bb403a09c3a9a2df3bc9150766f2266c3ac9e2
SHA512 3667e789b2447fab645faa11523ab2919ec812a01243706ffebe8220a460e54dbb7f7d458d49ac5c75c7d5795a7a141898fff33e25e849bc70231918a66f7d5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 07503ce1aec1f384df70bba3a671873c828f0d939a31fe32ba41680326adc723
MD5 f24e8061de2ed38e8b19958aa1b981bb
SHA1 b30c0ec6cce62d0cc2301d57274fed19216119c9
SHA512 bd98a44df01b918f7104bacfc9a8f4e69f6b03bdc3c8e7268a19d5d6786c1ce9c76d2bc8ed95ba7879804f87f2befc6c5f92de4c94a4003f495d4c75299a78a2
MD5 SHA1 SHA512

Submit Download

svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCCBBBCCBBCBBBACCCBBBBBACABCAACCCAACCBCCABCACAAAACBB.exe
Size 5.5MB
SHA256 53701a56da61ef3302e3de7112b6a1eb7cdc4a2afb160aa7ab42006ba3d37b1c
MD5 1e38f6b05343d4342b9e4b2e78ccbb57
SHA1 8f0c7c077fda70851b2b3096c32ab5f9a67e01b4
SHA512 7673bf76c38460333240f4b67dfccaaca24e5b316faeff7e14355cf70df1487ef8f48bc82684b992cce229dadbb9ba41f265d4ead513ab5ca20385e490a3fee9
SSDEEP 98304:Jp7Dp7Dp7Dp71W1Psz4p7Dp7Dp7Dp71W1PszUp74:vBBB4xs6BBB4xsm4
TLSH
T13A467C11B7D18035F5B329324ABFE339593DB9214F7885CFA3880A2E5E71AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a4c896f94058ec762007ff1864443e0adbb194ecac0833edd3fb0db6950c37ae
MD5 a3c0d4cc32d44ce0478dc753968f76c8
SHA1 c9cae4cd2ec3fd7441c8e8b1fa12695a46643558
SHA512 0f3e61a299438111818ae5ec009ca2ddd7b146a362b17d7ef266017da84d02a4e0c845b06c00f7157e3e992f18a7625d33c934c7b6a88bc3351485acc5dbd464
TLSH
T1FC11A122E4F9CCA3F933ACCB9A2EDBA20CE4369FAC586E045344421D6BD5C31CD558E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 d7e8a2cbe9e1a2311f92106b9681c2bf9d98a124ec29c80930571b4581659ebe
MD5 621b998c14f2ca084f1cfd2abfa87828
SHA1 ade13aba192b93541987ed172a5272d67d12d46a
SHA512 87b8827f9f8c2bf9af16c9ec568a31cc34127e777099e0290fddeb6fed2b0efe66905c9762780e2deb54e196371d4b756e0e13d5d593baae5d112b68c4434e40
TLSH
T11B218271E4F9C8A3B933ACCB5A2DDAA20CE4369FAC586E045344521D6BD5C31CD558E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7b7d0bf885bcf572f6dd2622639f56f09a66a0051caebc58a60bf84d42ef8a79
MD5 b2cc7d40c772eb0b0f075519218937d7
SHA1 360886f9cc132f0d12f9c909663d6977d6ec21d2
SHA512 af5f276b1f99b0091e2b7217ca3f02cf12400798cff7801bb097ee544e4c5abcdebd702d3f919ed0c4eb2e4ce9d3688156b705b715345b1f40bbb7c4d511f115
TLSH
T1E6119161E4F9D8A7F833ACCB5A2ADAA24CE4368BAC546E181340521D7BC6C21CD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-68-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/460-3932-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/2376-32-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5044-6-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/5332-1530-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/5332-3934-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download