744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Size 3.7MB
Sample260816-e5alrazzfs
SHA256 744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62
MD5 5b5bc861556c454602a556c219d6155b
SHA1 70d25458976c8165a665cfee53b7066ffb887cbc
SHA512 afddc01bd196c95900075563dbd217242a24510bd951d58493f583ae3b296f8157520774f4c88592ab2e9ca0b754b020cdae17427c5505c87e5806c3a57f4720
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E6:Fp7I
TLSH
T1D2066C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
1720	svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe
456	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAACAACCABBAACCACABCACABBAACABBAABBCBBACABABCCCCBBCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe"	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBBCCBCCABACCABCCBCBCACBBCABBBAAAACCCCCCACAAACBBBBABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe"	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe
3724	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3300	cmd.exe
2708	cmd.exe
5100	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
1720	svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe
1720	svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
Token: SeDebugPrivilege	3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
Token: SeDebugPrivilege	1720	svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1140	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 3300	4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	105
PID 3300 wrote to memory of 3696	3300	cmd.exe	107
PID 3312 wrote to memory of 1524	3312	svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe	109
PID 1524 wrote to memory of 4928	1524	notepad.exe	111
PID 4388 wrote to memory of 2708	4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	115
PID 2708 wrote to memory of 2772	2708	cmd.exe	118
PID 4388 wrote to memory of 5100	4388	2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe	119
PID 5100 wrote to memory of 3724	5100	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5b5bc861556c454602a556c219d6155b_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABAACBBCCCABBABCBACAACAAACBBCBCCBABCACABAACCAAABBABAACCBBAABBAAAABACBBBABACBACCBCBCCAABCAAABCAACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABAABAACBBCCCABBABCBACAACAAACBBCBCCBABCACABAACCAAABBABAACCBBAABBAAAABACBBBABACBACCBCBCCAABCAAABCAACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe" start= auto displayName= "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe" start= auto displayName= "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAACABACBCCAAABBBCACBBACCCBCBBBCAACCCBABBBCBBCACABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBCBCAAACBABAABCCCAAAAACACCACAAAAAAABACBCBCBCABCAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
1⤵
- Executes dropped EXE
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 22.7MB
SHA256 73d03e0c162d9c96ac5c766e6014d34ff16158abf195069c53c26ce9653987d8
MD5 56ca9bb1391697059b99d8e0312f9389
SHA1 3f50e94b7b89dadd31a4b777f1915bb24335ec1d
SHA512 03da226a6c4ebe048ad084b48919056f39fc58466b90eb50037a4b8d80530487ea25be6fb97ec749491f4f0de22a22ce39347817b3bb6cdfcc9a646d2986faf6
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+Ec:Fp7Ap7Ap7Ap7Ap7Ap7RAw
TLSH
T115376C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 26.4MB
SHA256 c1e9ae8ece49865486141ee0c47bb56b0ee91d4beea92d900ea641f2cef01429
MD5 b5091aaa1663c6e411182610344ef330
SHA1 faa14cd77769e0d30da79261ca50582293940c2f
SHA512 6f5486bb7a482fab72db39951221d3c9ced86d8ca85c76163d04081ea6ba1e73cea2a9b8ff81ae0f20bcc2b6c91c011733e2b797879db4b89a6f7e976614b745
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E9:Fp7Ap7Ap7Ap7Ap7Ap7Ap7RAu
TLSH
T1FD576C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 30.2MB
SHA256 c6ef5c273ef4bda5abfed0b0da1a2d8ddd4f80fc8c683005b07d702c1864dc5e
MD5 e58fc77e994f6cef7082893b2d26db7b
SHA1 b501848b16c7f14aa29b5cd6ab249c7582accdba
SHA512 448e7e62846e7a21d87065d38dba249e0c9c622f8041f59a8bab23448af729cbd8e3d9f9ba4d41d4352f3669cc8064215cdb2deb173fd34157d8daa2f694eec5
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+EA:Fp7Ap7Ap7Ap7Ap7Ap7Ap7Ap7RAm
TLSH
T127676C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 33.9MB
SHA256 1af1e22f54af6c6dc3fd30242dff84ae84963ef12ff3d82a24048b68037a15a0
MD5 504aecbbe0a879d4320044bcfd7fd83a
SHA1 281474343d4e7395f48da1a3c3a62a907370d0fb
SHA512 9cd31d8d71719d5b1da6cb5f2a765acc7fc40d7673e6bc41d1588f98f4230224247eb17a6ed55de21afe2b6eae7c5ddef1dfa3c7992f17724f7fd452d174579e
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E2:Fp7Ap7Ap7Ap7Ap7Ap7Ap7Ap7Ap7RAf
TLSH
T171776C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenUse.exe

Path C:\Users\Admin\Desktop\OpenUse.exe
Size 18.1MB
SHA256 4989b265b71e1403c8f3408c8137e7b0364b6e0ab75683ea0fc67f0f1f56ccb1
MD5 e5669fda4139e2a79fa8516bfd3cba97
SHA1 399fa4d8dc20314fd9ad0a6c4cc35e9a32baaded
SHA512 ffe0aed5cdc1ce9ee5f262144f621188af330c7a760c7697b1ce0293bd0816625d4fa72e524ac4cfed07d4e5e0a6c084c0959164f8c638b151c42eb05b528cba
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+Es:Fp7Ap7Ap7Ap7B
TLSH
T171176C14F9D30872E57B11B10DEBE3BE4D30BB25822589EBFA8D874F6833B915425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 403a0adf7644e987831839eaae9e66f7796d9db14da8ca2faec3c2fdf04ec581
MD5 fbfaebce0b9260add42011f78eb2a4c6
SHA1 56eb4d0e375db80bad3f1a8f28b8cc4cc27a60ed
SHA512 f404f6ef208d8ef702b7a2e2bf9462eb09331568e6d8aa3625159999c8c52ef68e0475fc4554d774b0e073b06f0083e692f5465845f38d0bea9b67843d95aa08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c1cea59af09e7cd9a8d25d9541bb6ca5f7180041bbced524d8f1ac5c9b3e282
MD5 5784444f1de4027cf908c82c980d6f43
SHA1 27057f958bec1f67a7f1247803890adba66e7119
SHA512 c1da2d5bd65af4116a80752ab276826653965eafa7cef589ab20209f45be3585b263208e4d62413d18facd3541ced5e75373fbc8717b7478327798814261ff22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c486d14196f74dcfcc778242e507d5df28b234c6b318475a73ddac5f42ef4a88
MD5 7bec1ef44e313f8d45f880dc997cde46
SHA1 ac1c94cc15a8b1c9e68909678b3a74b8a14d5189
SHA512 b66acb8c957b9ebf4b04aad6fb274ceac2fffaa603a030b190744b1126aa0e15ddeb83e12247dd9db4b86e530656b2a4258ddd6aaf582169bcea7f5214d8869c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ee2440aed5d6981ef6d69a1b2dd39d94943b276bd2808b0a47c9ff6814ce29a
MD5 df387f366190d7e07d9efaaf9cd98f2d
SHA1 fd2ad88be312ee5a888c5655807d3ebbe5f97050
SHA512 1e1e7c11e0629416ad14dca5fd16a93c3a43233819a186b59581d68c61baacc2b1cb95d0b4d5d47d7ab9f0ce15133bc751adb252425ea6ed6fb42479c09cfc83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf18b44d74d96428a258ff48a11e776b6d20c08fdca877dcd1d40dc21d4ac655
MD5 1e5194eea9e79001af84a737f38fb38b
SHA1 1d9127bb095f99fa00c3283497a5d61ea21d61bc
SHA512 de4f4ac2217264d5516d3ac15ee5ef955e924927e1d5194c459866833cf15af44c9e4c42ab6fc69d4b69bfd3fe15f44fdc68b768d1fd08796f9bfdff0fcdfddf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4c633f71933f625adaff5c2b1f4f5c196bd3586f6f7568dbd84e8e1aa60fd2a
MD5 2196c6edf8295a3990e41a23a4bbced7
SHA1 16d481edc7c0dd926fd3a1e2f37aa8406a597ebf
SHA512 1b9721f7c36f312ba6b38cc8d630baa9a77e283950f1ef291f6f1e0638f140a41a06be0e660d9be547e75f5e05b531263dbbb846fa383c8c16ba5b6fcfd2a8b3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9760a946e65c3b1595368f1b6121b2c4a3fbc7091edd8f77bbcb7322c0a7e24e
MD5 3c7d5400570ca072814e866efabfd230
SHA1 8f9cbf48085c50caf55139ef045c2dc156be4477
SHA512 16aeef5ef159b26e8c9e24787c317607d25ffe8e12e81e327eb2705bfdbb4338acf6ebd2ab28be7db87826f4c167fafe298a38b05fc3782eb8dd8d0660de145d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2f5d3d8d0f7101692a95dfbb69b02b7d3b8c19e0d490f96fa46df7b47667b6d7
MD5 6189b084f306e7343420b9e366520fb9
SHA1 ac68c6e4c4aced2a2cd85820b2a92d9b8c9d4efd
SHA512 8dde06b9eccf2cf6684ed17dadad502bc1d4e6fbd2d1011b6c6bf1046acdc55a9445800bd5f89fa9eea57093d1a4b01fb3a6eb0d5226046b158fb6dbc280f9d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0ce5b1425124849273011b9200fbcb8d5d92c089e44cf892fa6015c44c6711e3
MD5 0b372d2c9836ff62e6cee3a85642854d
SHA1 11b0544abb81917a64ab6ac9fa114eb390114f16
SHA512 a1af0abcfa821f9cb4f73166b02bc3390ae8e56a63a9e4554f509aeb4565f3eb21a0bc5642dbdc3e2bfff53988185a047f8ba6bc8e2a8c4520b13638cf96355d
MD5 SHA1 SHA512

Submit Download

svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBACACACACBBABBCCBCCBBABABBCBABCACCAAAACABCBCABCAAAB.exe
Size 3.7MB
SHA256 744c0e3879d49eafa30c2b1e0786ffd74b741c8cce86ede094b8d8e75fbbbf62
MD5 5b5bc861556c454602a556c219d6155b
SHA1 70d25458976c8165a665cfee53b7066ffb887cbc
SHA512 afddc01bd196c95900075563dbd217242a24510bd951d58493f583ae3b296f8157520774f4c88592ab2e9ca0b754b020cdae17427c5505c87e5806c3a57f4720
SSDEEP 49152:U+ES+ES+E1+ES+ES+Ek+ES+ES+E1+ES+ES+Ek+ES+ES+ETwqp+ES+ES+E1+ES+E6:Fp7I
TLSH
T1D2066C14F9D30872E57B11B10DEBE3BE4D30BB25822589DBFA8D8B4F6933B905425792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 1649fdacb088eaf1707681832a37a8d5d0912f750553976997523d6896ae3d7f
MD5 e0deb165f3ef006fb6ce7ac1c26bc3ba
SHA1 87e5e2274155f39e58ce2f02e4c41e67ded46ea2
SHA512 46ccebaf02afff75b1adde501b495141743b29aaa9078b7175afdd23728a85197141a62e1d5eae4caf6f27c2bb6547ea68080a50b3e39f8a513c1074214bdf86
TLSH
T157119876B8E59C63FB3328CB531FBF921CA1379FAD9CAA58130542199385D30CE598D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1524-79-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/1720-93-0x0000000000AE0000-0x0000000000B01000-memory.dmp

Download

memory/3312-75-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3312-51-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3312-102-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/4388-25-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4388-12-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4388-76-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4388-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4388-52-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download