05472f8875f6c5f9de676732a99c5cfc454e93a51fcb61c38bd81e9e72d3edaa

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
Size 790KB
Sample260830-yy8dzsda79
SHA256 05472f8875f6c5f9de676732a99c5cfc454e93a51fcb61c38bd81e9e72d3edaa
MD5 29cb77a717c25a377090ef7b3dd7a17b
SHA1 798de4f45800d5f3b589ffe5c78030eeff55e6a1
SHA512 74ebf938dda50095138f55d7c73d4f43893a4fdf5ec6b6d4df3c887d5dc795195cd8817bc418ce8baa2efd9315ab931932b529e663cb7c738b23a0b8cebd0d81
SSDEEP 24576:m9+EM0q9+EM0qL9+EM0q9+EM0qtafDd70iTWC8:U+ES+Ey+ES+EzDd79WC8
TLSH
T1C3056D05FA828031F87714B14DEFE37E4528BA218B258DDBF78D4B5B6932BE1A434716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
5696	svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
1448	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCBCACCAAABABCBCBCACBCBAACABAAACCAACCCCABCCBBBCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe"	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCAACBBCBAAAABBAAACCBCABABABCBBACCACBBBAAABACCBBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe"	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5548	sc.exe
3076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2744	cmd.exe
4056	cmd.exe
4656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
5696	svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
5696	svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
1448	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1448	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
Token: SeDebugPrivilege	1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
Token: SeDebugPrivilege	5696	svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
Token: SeDebugPrivilege	1448	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 2744	5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe	91
PID 2744 wrote to memory of 6084	2744	cmd.exe	93
PID 1068 wrote to memory of 4416	1068	svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe	94
PID 5804 wrote to memory of 4056	5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe	97
PID 4056 wrote to memory of 5548	4056	cmd.exe	99
PID 5804 wrote to memory of 4656	5804	2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe	100
PID 4656 wrote to memory of 3076	4656	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_29cb77a717c25a377090ef7b3dd7a17b_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACBBCBBBBABCABBABCCBBACBCACBCCAABCBCBACCABACCBCBCCBBCACBACBACBABBBAAACABCCCABBCBABBBAAABBBACCACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAACBBCBBBBABCABBABCCBBACBCACBCCAABCBCBACCABACCBCBCCBBCACBACBACBABBBAAACABCCCABBCBABBBAAABBBACCACAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe" start= auto displayName= "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe" start= auto displayName= "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBABCCABAACCBACCAABBABACBAAABCAACBACBBBBAABCCCCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACBABCBACBCBCBACCAAACBCACABBBACBCBBBCCAAACCCBCCCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 f2fed007291b7742e7193c6073c66d662dcf9ce575ec36fc5eca81f2d1395fa8
MD5 37fd1efd3851a78b95ed1a45356f32c8
SHA1 148e4bea8e3079b034969f15ebe083b7c62e85f0
SHA512 4aa1f06d20e604f483e124738ff35525feb701e5ba3b8c47fb4af05479f5d66cadae1c3b612dbd8f2be1d87a63e4accf9604aa7ccf3362d433edde018287b3b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Office\qap`g`v~dtlq
Size 10B
SHA256 8191414e518177aa8b0896234fc02ba58aae174e90920205fde098de93691833
MD5 dfd10f561934972973d1af182092f57d
SHA1 6d0ab433d3593b1e77e1d52d1fecdb7fe105e1b9
SHA512 a0107a96749807101168fad02013810ec9a07e8e20841e89dfb90b843f9ad0ea67440c87423cc96bd05acc1f389ba9a5eb81ec72dbf65e60000beaf53b44dfd8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Clean Store\qap`g`v~dtlq
Size 10B
SHA256 8b67283f9307fb922a1cc42284310c3da221be51e0d0bcecbbb5cf580adb6a20
MD5 22f9d88eb4764db08770b0c62d3a3c32
SHA1 a69a31e0189f16d5ad9659676d5316df6ea52a34
SHA512 c34064fc2b08f189358c79ed8b0286cb0c7153d68a858754cd268af2c4db99e11231f8807d765a6331e56c3df13906c7c1b72cdf5b0930569dc98fa25079c99e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\qap`g`v~dtlq
Size 10B
SHA256 fb7108b40d1418f5db3dc031481ec824dc45b26043b66cfb17ae3d838749c001
MD5 2417d4172473dbc34b216f8879882517
SHA1 e6205419e950e6cb3282ca02c876460f3b5e3299
SHA512 d7a3bc2d5944bd168753b4a041cabcc1a4cd2f9515849f56dec50b4b6e28230776839059b528d2d65307875bc526335f7779c4db2e7ce1c0d9e797a48b10289c
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 1.4MB
SHA256 6d3f890bb15b7d6a53462ac6b937e7f8ced94615dd5614b7a9f4e7aa0818dda6
MD5 c5e0bc60192b2c6bad98157f89554206
SHA1 7608c0f0b1e2ed23251a75bede6de1172ea54fa0
SHA512 e04444f7319345105b42b523621714144fbf7a2801882cb0d3cb313179541553598bc78fa09c4618d87a7a02f0cbcd4262ece68f194e46ece164012157b6c909
SSDEEP 24576:m9+EM0q9+EM0qL9+EM0q9+EM0qtafDd70iTWCbm39PZfePv3r7fm6t+jqp+3l+z6:U+ES+Ey+ES+EzDd79WCbgZ2HbbZt+jqk
TLSH
T124659E21F5424032F9B605B28DAFD3395D38B7204B158DEBE3C89A1E6E719E1A637317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51\qap`g`v~dtlq
Size 10B
SHA256 d87d89dfaba02c642533743b9667495cf7e3b96b6ef46b40403003e000282959
MD5 67b39746df347cd13778c3f4010dc63e
SHA1 f156267ca0013e407ab6d755737131ab5585c555
SHA512 35deee763e1b828969d703d9ecc67669fccad9a06bb844d8fec0f0303acf795f426d8debd1289574494f6be2d9bfbf23a16ca34ab7be67f4a52d63befd070311
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 ccb23462b586f82bb2a4ea917a786d5e1232b1ca48e50b49f8e619003db5e756
MD5 06762001d4da93e8cd882cf323e23616
SHA1 4abb41db99b79db67837b38fe5da5f3801be06ea
SHA512 d92e11e3b85d0e903d8c163e76bff9a6a288d846de24c4ff630054da6ac5ce11019f7dc4a0b6dc16646710d12cecf11501734ac8eb168ac4a99cd97aca73588c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\qap`g`v~dtlq
Size 10B
SHA256 afabbc4e0872b3989a0dca0b720ac8e042f608b4947a0a72398a89882d76ec11
MD5 f4a0ef1a13b955b0a9ba1fc9e80630a3
SHA1 4475ddee8a7b4a3cd299623e5f329d907cb45148
SHA512 4160e9e0a61df678f853b74ecabd83fbeb7f0a90a864ae317bce5103135b23a28630bed1b37010f6ab55aa973be580c71b1a3ae7fc7164efc03a76587353979f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9b9ac9d494c6b113db5e2b4d32a2efc9cac979cf5a0e09dacefc1b2298b8935e
MD5 106288445be6e900cc427e5c95f4837c
SHA1 386ace99dc390b692e0b78d3394fb0806a6c1b6f
SHA512 1440542df8ed421aaadde03551afdcabf79586c65a795c0719320e4e543c6a2befe0d2f3a237b95a9bbad6e7d466a721b1c9ee99fdaeca006454aa96759164bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7635835c91e412e734cbbe3b3c39f86b611486f8fdf210ff4b2d1618ab547576
MD5 576a50632917fdaa302b3d5dd1b2873e
SHA1 bf0d140c89879b2aef65fcaca8ab99e600690197
SHA512 ec287bed7e667e93d948cf58693163116675896e84fe778fc804cf39e0724765317737eb2c904b11274f12d86eda088f737e890c122da807301a5e2a2782901e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84d71965fbc2ff7d1f0949a4f35a41d1f4dea3c63fdc131e4a5ad05cf1487894
MD5 ac2c98e53fd90a1a4e6753f288025adb
SHA1 c58f99e3efe80c03030933caa1885e17997b119a
SHA512 d173003178a3fcf4159450244040eb060eae8e1d98e31c2ba75b6afcb9ad915cd90fec5b3a7fa6e4466d6f0fb8af5d1a6229bb6a065b2132c0ad8e316b1a528e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e54f16dcee95a4a6245e6ac585936a16d14992ec6c9a6cfbaaff4248ffc4526b
MD5 de70125597fc4ce343a571a1a061cceb
SHA1 166f1175d43d1941bdbde589b2a4c2bb7a1f55f6
SHA512 00eec2ceecd111d335fd71468a813603e85ca0480d692858f4912e1396ddce50de7f8a4bfc58dc2eb7f121d263390e7da0203c1bf43964af3e0d1362aa6f449b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 42763bdfa765b4c56bf3e5ef49fc1e34444b926cf00dce4e283517d87da1d7fd
MD5 91c602ad0ae62d24ad129ef23337fc10
SHA1 ddc35d848b81aa3ae1aa25a68a70cc16722fba95
SHA512 5ad9f8840300c3ecdbac647dde172853f03db618065f9081593bd5b067be583ea95faf5879ca6145fb93cc593ce4e8b25c6768f76d74fda6addd91f61acb06dd
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBCCCCCBCBCACBBACABACCABCBAACCCAAABBBABBBAAABAACABBB.exe
Size 790KB
SHA256 05472f8875f6c5f9de676732a99c5cfc454e93a51fcb61c38bd81e9e72d3edaa
MD5 29cb77a717c25a377090ef7b3dd7a17b
SHA1 798de4f45800d5f3b589ffe5c78030eeff55e6a1
SHA512 74ebf938dda50095138f55d7c73d4f43893a4fdf5ec6b6d4df3c887d5dc795195cd8817bc418ce8baa2efd9315ab931932b529e663cb7c738b23a0b8cebd0d81
SSDEEP 24576:m9+EM0q9+EM0qL9+EM0q9+EM0qtafDd70iTWC8:U+ES+Ey+ES+EzDd79WC8
TLSH
T1C3056D05FA828031F87714B14DEFE37E4528BA218B258DDBF78D4B5B6932BE1A434716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 097cffccad8de93f360b4e19df3df0f7250a0c86b5b0a13ba37eeebeb5d59bdf
MD5 646206439f5cd84b57b5c7a2d4ce9c03
SHA1 8b91940e7cb715f29096fc9925f6dce08008b976
SHA512 5fab4522fbcb25a5c7f452f1debf5dca8b8fa632f9b576199254056ca8dd390a65dc33aaac637540d2e3039650247176a20615229719c0ea4ba13d6e75ce2e29
TLSH
T1D011C851E0FBD4B7F93328DF5A35CAE618A437CE18986E141318C26C6799C35CE968D2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5722fa0d342630f7861e1160aed49bcaf29b7a23f65e02660ef28672be6dcde6
MD5 8cd102609ded6258f24411ef3770b855
SHA1 5cbf18327c824644853029d25d25b3634c031c69
SHA512 606983080f66610cd5ed9726033850bc8847fc9779013d3fec70ce604dac7a8248cbfd43bd31e5ddc64bebeddbaa40df630e6f386117f0bbd090ba7d6c14af2f
TLSH
T1FC21FC51E0FBC4A3F53328DF5A35CAE618A437CE58985E142308822C679DC35CE968E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-31-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/1448-1314-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/5696-78-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/5804-0-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/5804-7-0x0000000000710000-0x0000000000731000-memory.dmp

Download