e2f9806e033c55868bc6cd703e8b16df16cfa51a1c9eadf9a76347dff15fc897

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
Size 5.1MB
Sample260828-npcwlscf74
SHA256 e2f9806e033c55868bc6cd703e8b16df16cfa51a1c9eadf9a76347dff15fc897
MD5 98ff42620a8ad45673b952c0cb38d17f
SHA1 0f3ed3c1ed97859d2ab801e160c7679db3035caa
SHA512 a737a5400a70f0b1afce64f316593a525530483bdfd24d925b81209014da99aa30bce0c3567a29608215a10c748e6ebf77b7898f42e93ad12b6e6a47639a8703
SSDEEP 49152:U+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+Eewqp+Em+Es+E7+Ew:Zp7p
TLSH
T1DF366D04F9D34872E97B10B00DDBE3BF4930BB2586258DEBF68D8B4BA933B905425756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
2000	svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
2980	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCABBBABCCBAABAABBABCCCBCACBBBBCCACAACBAACBBBBAABCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe"	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACCAABABBABACABACBBBCBCCAABAACACCBBBCCAAACCBBCBBACBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe"	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2976	sc.exe
944	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2956	cmd.exe
4160	cmd.exe
2424	cmd.exe
5240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3424	schtasks.exe
1092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
2000	svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
2000	svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
2980	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
2980	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
Token: SeDebugPrivilege	5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
Token: SeDebugPrivilege	2000	svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
Token: SeDebugPrivilege	2980	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 4160	5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe	92
PID 4160 wrote to memory of 3424	4160	cmd.exe	94
PID 5940 wrote to memory of 4284	5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe	95
PID 5152 wrote to memory of 2424	5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe	98
PID 2424 wrote to memory of 2976	2424	cmd.exe	100
PID 5152 wrote to memory of 5240	5152	2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe	101
PID 5240 wrote to memory of 944	5240	cmd.exe	103
PID 5940 wrote to memory of 2956	5940	svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe	106
PID 2956 wrote to memory of 1092	2956	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_98ff42620a8ad45673b952c0cb38d17f_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBABACACCACABBCCCBBABBBBCCABCCABCCACAAABCBACABABCBBCACBACABAACACCCCBBBAACCAACACCACCCABBACAAABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCBABACACCACABBCCCBBABBBBCCABCCABCCACAAABCBACABABCBBCACBACABAACACCCCBBBAACCAACACCACCCABBACAAABACBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe" start= auto displayName= "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe" start= auto displayName= "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABCAACBBACCCACCABBCCCCBABAACBABBCAACACBBBBBCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCAABBACBCAABBBCCABAACACBCABBCACBAABCBBBCABCACACACBACBACBAAABACAAACABAAABCABCABAAABBABACCBBCABBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBCAABBACBCAABBBCCABAACACBCABBCACBAABCBBBCABCACACACBACBACBAAABACAAACABAAABCABCABAAABBABACCBBCABBACCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACAABCCACAABAACBABCBABBCBBBACABCBBCABAABBBCAACAACAABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 b76e6ce7979fe5c46f0fcc893046785900cfb95297e12760e0cff08ed9ad7144
MD5 5f8a1927b2acbeec08bce30f0e878c44
SHA1 aa0d809175dde6e823e032ebb1408b6f4bf0954b
SHA512 608f9edf7ee8e33023d3314ab0c18b6a09b03c7bfbb77f573c49a61cff088f60ffb9e5af456c96509f49a9c22d49af233598609dff230481e3d20c7b764e4032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Features\qap`g`v~dtlq
Size 10B
SHA256 403103a7c94847811fdf96f300b385771ceab4ba4771edb99ac0dc6ef54827cc
MD5 914e9d0f068cbbc2e976bc48bdeefd5c
SHA1 04d3aba435634a36a9d7fa0b3cfe8a26e57571de
SHA512 b2a7bc5882f491a37ed5d60a842bcd0192f74c6308c18ff6eaa61e67bd877f0d2236f7365d89d8975e3e0e90578788d3bcf9088781f754371b730f21859250c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 35919c717341dd2b66bdb21a1658f210679347cafebf6935760b3ae3f005cd8c
MD5 25df3648d0f3288d3e1175b21e7f2b0b
SHA1 d992b718f07059996517bd3cae3452c4e014ef98
SHA512 08e48b52190f95367b689843e224018c8701253543b2e15d2ff21486e5af3998e190b6a518c289b395a28b91da7e18b0bc0da7ba557fbaadf251757a1af0902f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\MicrosoftWindows.LKG.AccountsService_1000.26100.1742.0_x64__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 ea6fada9da843fc33d6e6c19cdfe8ebac69e1413de2bfd8871b6ed4b5ffd2983
MD5 d071aea7bf118de77abe4f0c1e5b7440
SHA1 ab50ebbcd5dbd64b28e4748148430fcaaf41c8be
SHA512 0f96eda62f78ac65b6b2d52d8375ce1dd64112b294565b0d0475b574bb98f0d939ea699ffe99988c7122d00e6a852945cfef7de7de6558ea9ebc1d2600ee7543
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 5.7MB
SHA256 80477abeacd5d90e9229dabecaab6b28034fd452f25481842f0e377f6de6dd61
MD5 ccb7bf954ebf22b7e6d06d5d74d577f8
SHA1 c90a9a8ef9f04e917f4dec296b0aa3527191db62
SHA512 6545a2b459e4ec2e2c5b96c61ad80c676ab779feca399a9f29e0eed2fc7c7309b6308c373f8f1cfe538418868eb16e47705a0c1b48668487449e557115ec2397
SSDEEP 49152:U+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+Eewqp+Em+Es+E7+Eo:Zp7IgZ2Hb9t+2xk
TLSH
T175567C14F9D30872E97B10B14DDBE2BE4D30BB2582258DEBF78D8A4B6933B905436752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 5d062918c70645af5331182b4df2eeb3ba60725dc3c2e075c814d3c0274e3550
MD5 434b897b322c47a2661be1414eb2296f
SHA1 be78480f2eb6ef79d51c9256c7952b01bee7105b
SHA512 4a605a23ff7d2234fae503d790c66b1c66690649103afbf192631ba60d670cbeb253d04bf69cda6b637f83379b16054056bce1d3c000b6a6bb3d48a327a6a9d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6f53a9f055a9cb2118564c95e53da0b106fc93f8ce8e6512b63fa0fda5331dab
MD5 7d722975e0493134fa815c1b812f2dee
SHA1 dbd252be4c7b9103df0cb772d3b84098021e7f66
SHA512 6baa3311862633418b0bca04c61cf6dd91dc4727a18d3cfaf6575030cc22fd362523dc6a7b031add24d5df618c594e2035b4ce649f66056ee29ad126d9dca032
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 142bd209a30f2de5577b53e9694937ad07e3576b501773ec2e680eab5318172f
MD5 5a723418b6c554c40c63184a9548747f
SHA1 b3b64790f0a6195ddb509d9df1ab76a734dd0de0
SHA512 320617c738efdc2adfec7814b7b06f2a85887cc967f44b23f97c14a5c3905eaa4553013a028465e1179fe52f99cb6b139753a24403ed3d043b0c5bd080c21472
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b621608c1cd98ae0c2ae6682254c45337bd49bdf8cd4cbfec7a916cf59dcca5
MD5 19919f42adb07b29861ab6c553ba25b0
SHA1 8b6c74ced1c38ae8a212589b484a731e6afc6b81
SHA512 1a0a0fa0595c70bc83157d1a59fd65d798a1a4498d53b9a79798e86a7d597af8eb16c28698129a5d5bedc39aca6e8c7d3264c19c541757d38ea5e233ca29d28a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 419bcd2f26a207e5e981678394c1ea33b287b47e31f4b6f9310c092ce89cead6
MD5 967aec4b4a55f02aca3d37ebd7be4c82
SHA1 8462c673c6cde42e3bc0b465c9bf45ea51b76567
SHA512 fb855e5f5f659d58c27363f2d039fb5ecf9df6fbde9d399fc843e81d006e91aaa05a98da5f71f7fa5aed807e760cbdf93c08f7ca7f629cd1a8868caad1cab8da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 630ca96fd84d1b85e2b7fcad3cc7241c58c2b137ec04318bcf4b1ba66c78a536
MD5 9ef654ff45d28a03ab8bf3a8f0e43b91
SHA1 c347d6f08b644d4619a10abe72909435e6ed5746
SHA512 69d991f595306d5cbe6a81f89c2b962a4a84c03a2fddfc4680566d10e7a08b6bbe6bf0ad16ec5116cd2c52f6c21db4c425f6a113977cc511bc02a2d279dc1e4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 68343bbf6a58d41d64e23dff462b5375ba3ff9f1b00c214999a034918dcdedd9
MD5 b5ab8fadb246b2804f5ab55acc40e4c9
SHA1 c79e9c9866982d50603ac2eaa12adb33b5886e4a
SHA512 60dd49c06194b86ff1beefee05d82de4b615160dfd5536bc85050fda5f98171eaa212e3d80ff623dfeb2e3fb145eddafca1d789b04576f9a04a428ff01a1de9b
MD5 SHA1 SHA512

Submit Download

svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCACBCBCAACBAAABBAAACBCACBCACCACBCAACAABBBBACBCAABCB.exe
Size 5.1MB
SHA256 e2f9806e033c55868bc6cd703e8b16df16cfa51a1c9eadf9a76347dff15fc897
MD5 98ff42620a8ad45673b952c0cb38d17f
SHA1 0f3ed3c1ed97859d2ab801e160c7679db3035caa
SHA512 a737a5400a70f0b1afce64f316593a525530483bdfd24d925b81209014da99aa30bce0c3567a29608215a10c748e6ebf77b7898f42e93ad12b6e6a47639a8703
SSDEEP 49152:U+Em+Es+E7+ES+E2+E7+ES+Em+Es+E7+ES+Em+Es+E7+ES+Eewqp+Em+Es+E7+Ew:Zp7p
TLSH
T1DF366D04F9D34872E97B10B00DDBE3BF4930BB2586258DEBF68D8B4BA933B905425756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 03fdd7b5418fd9734123a122b2a3e90e599ee43f1156eaa09d75f9ba5613f996
MD5 cdeb2c867a4d458e7a9f92d53eee08db
SHA1 8cfc48979cdee1a71844e459e8b4576a0ed96438
SHA512 76697651276c5786a719328e2aabbde6f6923e2f8561566966862cd1603a16cb74fa01c7bcebdb296f0b4c15401a06429d6c64d1c4a0e291789d613f1c0c1079
TLSH
T188210572A4F4CCE7E523A887B611EBC22CA431CBEDDC9A01630C4218FBD5831CD598E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a31aea56fa7f7ace508f7c67636b6880026c0486b2f34a41f6c74acbc3e95428
MD5 54696d4ba31f9be4b1913604bf12f020
SHA1 67b33e9f4db1ca62ec4066db94b73c829d20fc97
SHA512 b007608b837254de5219d0ef39d3a397b99bcbe1a7d5144dcb39cbe3d75007ed890e4099e2e1c164b0475eb6ca2a4ef8d66136f52dd118f7d1210538148ebbc7
TLSH
T14B110873A4F5CCA7F533A8467602EBC27CA431CEED9CAA0523080218BBD48318D598E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ef398c6ef6c4708b7a819fa6668a529730a1e717b7d34a34f1308e0b6b7593d9
MD5 42bbf22c463bd86693b7f22155a8ee7a
SHA1 7d93453790b08fed2b4c4b4ecdb086c837d5220e
SHA512 f2f6637c60907c6854273f0cec0dd6c6387f82b12651b43ab5c4296d04745d11cf132478ea855c7a6f54e28fd333f7132c77b617b51e9d1e4864fb545b9a942f
TLSH
T16C21C872A4F5CCA7E533A8467501EAC26CA435CAED9C9A1523081218B7D58318D558E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-80-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2980-2768-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/5152-6-0x0000000000EC0000-0x0000000000EE1000-memory.dmp

Download

memory/5940-33-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download