0da11a765cee17493bbcfd291c5fb2bca4030fe4dc183a91d1c0652ae38d3d68

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
Size 2.3MB
Sample260905-d891cawdkc
SHA256 0da11a765cee17493bbcfd291c5fb2bca4030fe4dc183a91d1c0652ae38d3d68
MD5 8f315f76645710d1f73374661a313089
SHA1 79248bf0af2acab979d955393102a298b8d66ef9
SHA512 af6351f0a2122159fc3f7465a30ddc3031d42d0afc5884c6ff9edb31a54a177d4ddb2cae6124d890017fa49061c0118955ce9aae6a0148cebca9245721142a4c
SSDEEP 49152:U+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCiW1PszNsQd:1p7ep7ep78W1PszZ
TLSH
T11EB57C11B7D14031F5B328714ABFE379597AB9214F348ACFE3880A2E5E72AD1993471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
1140	svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
2352	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAAAABCABCCACCBCCABABAABCAABAACCABCBCCAAABCBCBCAAAAABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe"	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACACACBCBCCCACACCCCBCCACCCCACABCBCAABCCCCBABBBBCAABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe"	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4480	sc.exe
2144	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1808	cmd.exe
1732	cmd.exe
5568	cmd.exe
1548	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5268	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
1140	svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
1140	svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
2352	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
2352	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
Token: SeDebugPrivilege	4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
Token: SeDebugPrivilege	1140	svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
Token: SeDebugPrivilege	2352	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 1808	5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe	92
PID 1808 wrote to memory of 5268	1808	cmd.exe	94
PID 4100 wrote to memory of 5164	4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe	95
PID 5936 wrote to memory of 1732	5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe	98
PID 1732 wrote to memory of 4480	1732	cmd.exe	100
PID 5936 wrote to memory of 5568	5936	2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe	101
PID 5568 wrote to memory of 2144	5568	cmd.exe	103
PID 4100 wrote to memory of 1548	4100	svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe	106
PID 1548 wrote to memory of 3436	1548	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_8f315f76645710d1f73374661a313089_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCACACBCCABBBBACCCABAAABCBCBCBACBBBBCCCCBACBBBBABBABBCCCCBAACCBACABBCCCCACBCBBAAABCCBCCABCCCABCACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCACACBCCABBBBACCCABAAABCBCBCBACBBBBCCCCBACBBBBABBABBCCCCBAACCBACABBCCCCACBCBBAAABCCBCCABCCCABCACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe" start= auto displayName= "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe" start= auto displayName= "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBBBAAACBCCCABBABBBBACCCCBAACCBABBABCBBCCCBBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBBABCBACBAACBCACBCCBAACCABCCBCCACBBBCABCCCBCAACACACCBACCACABABAABBBCBBACBCCCBACACBCCCCABCAAAAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBBABCBACBAACBCACBCCBAACCABCCBCCACBBBCABCCCBCAACACACCBACCACABABAABBBCBBACBCCCBACACBCCCCABCAAAAABBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBAABCABBACCBABABCABAACCCABBCACBBCABCBBABCACCAACCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 d3dc885f06d0189228aae84e0af24b17761b3e905cdafeac2ef6efebac060f50
MD5 3fe3d9b41966628fa5057ea64f85fdf2
SHA1 d04f526f552388ccc3f383513c27e540be52de6d
SHA512 43dee890a1393a7f5cd0f3ce48f4127c1e8f3991d65c9cb4daceaf4c7f3cfe84fc565770b6c4eadb61c0222f24acf784e5bcdf889904765bf91deececc01f438
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\qap`g`v~dtlq
Size 10B
SHA256 9cdb388c62cb7bd02cbaf3a37bff13fab61cc42665b1f3c9138254167ba9b3cc
MD5 5ea6431ef7bceeaffbc7b2022058bf09
SHA1 d5456a28b706b4d57526097a656a79d034c75771
SHA512 8a1a1d7773cce2bbd36519afdbf7ad9acb290e2006d9c84a3b860d9948db3941a077f3b5fc17d92f48fb3658d58301198552e5afc6c7c3a6076fd98297b020d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\qap`g`v~dtlq
Size 10B
SHA256 ee5fd75a8e350aeb0e77774d256dfe1d4bc09b3875cc89dfded309f518eee850
MD5 757456eb0345eb5a4114abfc12ee7380
SHA1 1ea19b69cb1f2f3da0d7c0a64152f02eb8635599
SHA512 07bbf546b084e468fc01fbb4ea3f833c5f4bafc8bc7ce0df6d5f167a9f7ebca22fd55d54c2913d581b5030c77d390ff770bcf175bd3ce0b7f67de0e02b501e4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 290005a56f632beac78938943e71e36b26a2ff21ded1b466e1347374f79244d3
MD5 9cc52ac60e0fd3ccec7564ec0ebd0cd2
SHA1 f24d637d4007b8be29e5e9f8abc7a77f7e3cecda
SHA512 fd8707baaed33639cc500dbf946dee93a381627766cf3513633808e3da2fb815b99c2f902afd10b3f3d1b8bae87c19393b04793d628516646f619ffd727aeb8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Workspaces\qap`g`v~dtlq
Size 10B
SHA256 512224e96e359e60fe9f41a74b858ffc10ee4dd8a6a570cb0ec5d8c4adc2bfe8
MD5 6236a7c2ce667eae6463c3faf5943af1
SHA1 b4e4e40fae140f1cb55c80f1b95b2a1116750deb
SHA512 d877260bbc71aa27418c7408d0478ee5e2deaa6b9e51778872a946adbff5333cda857aeffda6c04eec76b9c442c56bbd1d2d6561c8e1a8fc27df8b967ba28e36
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vi\qap`g`v~dtlq
Size 10B
SHA256 f56119d46196180ccc186a6407a8f2bbb53e694b31845db156349ae50926e932
MD5 80607aefe9116a107a93e47748fc8903
SHA1 4e264bb3a02c87bbc2df3deab4ef9993c8856f0e
SHA512 1b11959bdc83045d354968c6160519cc773b3c81a036495d02dd5c606c78a7480dc196ba33e3e272821add41a9254d46cff8bc24c07d3d75981b04ecf9c98f3e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfcb9a8f6073d51115d8ed7872134610f19e77d59c7fadee0021bc12c58f80bc
MD5 7d79cb4a7c16a87e43222f1254a5ee55
SHA1 8c9e581e11c7769e3fb3969ab72bafe748c96fbb
SHA512 603b97ec5ddfbf15e6a3aad9e43ac29c019c821ec3304a21595b7a7a986b758f4d63a04aa6cae713c0b997434c5b391c8674f4a6936decb7b0f970fbac2a9550
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6fd6c580f679adb9415439ac6b55299ba96eca18dffd63f32e730c9d654b411
MD5 06cc9233e2a4e240bc3b4e67dd888a08
SHA1 c28175a9cc1cdf374f21024a1522e6d60baff6c1
SHA512 83065eb8fcca38dfaff6e48f7008b7b630453168c12b09fd93dfdc6dfccb77c26eaa224ac2d5d94d8930d86dace4aa3a242047bb1f3f97c49e4faa50efc0e2c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb37afe52a3b75b0d73fe1d5225a0e4bde044c07dbd5c5cf44c387f6e586f0bf
MD5 0d1ff07515a93e6adea517e5061a8dab
SHA1 fd8bdc5b87d2ccbaaef6e97cc066cb92a9e796c9
SHA512 0bd69dbb22e0acfd86f990631bf31f13ef4f845fd0017c7e0b80ee5d6f667a2d507740fb1fdb0b712f7bd3cb6880fc60f0fb0556739e82de57628643258c5f3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a210426604a97bf730285b366a0c7d439a75c4bd8c40e3122830b0c538e2c138
MD5 8107704555e03dd0642cdf8fb9cb60fb
SHA1 a9415e4f84edb0df7bd5d466ce878933a2a500b7
SHA512 e70091d3bf2792f6cf70673bd128d1189ac35f81aaad0e95b34293624842f5ba66410b4cdf1c165a9a2e3f2a774e2a343a0789191caca0567bd97dbf8a052463
MD5 SHA1 SHA512

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 33.4MB
SHA256 d538c12d78c6ad192cf13554aef04d63acb637f9264e6d77f786ce682c46a2f5
MD5 af7480cd9a11a7e0161d2fc0ef375dfd
SHA1 2aca8db6a752b02011c6126a0f7183782abf8153
SHA512 9579a4a90c3800c107ec00a9d1fd573b933e5514e9f19614e12eb244eb3ccee43ebd3ffc9ccb059a534372a3fb2af8b3da5ec21753244d83d9d777e3a9c1db57
SSDEEP 196608:Lss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFssx:V
TLSH
T15E777C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 7.6MB
SHA256 5258f290964280bf7133240cef8d79eebc594cc3fbe6cded04ebc1bd218b9ae3
MD5 e96ebff0b40109bdd36d18866565d12e
SHA1 49e32ce0819db75fb829aab35ff12d5de19be2c3
SHA512 238667f0bda9ab80a6e192127b8710c6cdf069efa048aae99e22310bd099afc4d3da8f2bb3b140c0009369356c3d8d21afb47980d05a6e81b1cd064004665eae
SSDEEP 98304:1p7ep7ep78W1Psz7p7ep7ep78W1Psz7p7ep7ep78W1PszenQPPS:Lss1xsFss1xsFss1xsza
TLSH
T17C868C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 14.6MB
SHA256 29361ffe361dae3d8f132b152bc9c2981c63b72bc9e68b3d0a04dbde05c036ef
MD5 f441f0a553ee3b35e7f8bdd7b6cd0570
SHA1 63ef89b8d4e57c443b246c4a75fcf48948ed786c
SHA512 ac49bf70259649cec220fd8c40ba2e77b459f56080512d176bf40faece28547f4d51e3dc82c4582b74584d58edb34503cd75032e87fd983d130eab258e7de792
SSDEEP 196608:Lss1xsFss1xsFss1xsFss1xsFss1xsFss1xszs:w
TLSH
T193F68C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 19.3MB
SHA256 28de6ec6e65faf002428ed8292f742e8ac477eca866d1abf7396210c72928967
MD5 dddd602f2b9d7ef8e0f392e46ddb6c1e
SHA1 61d37035bd10b82f34cf71b03d1e235a2c9ebbd3
SHA512 2c0111bf2501b62c2d45c82d41cad291306d2abc5c00f74a2ae97f30ca66b1bd677580e91a97b9c166aeeabede003f497ca37e272b568bb222891b85e3c571b5
SSDEEP 196608:Lss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsz6:8
TLSH
T1B8177C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 24.0MB
SHA256 3dfb4e1df630282ffd9ef6ca3bbf0380e7d49fe9a8b8a880453e764a29f6e5d7
MD5 7f79dc3f0a5c08c4da71ddb1f7ba8d45
SHA1 e265661aa456b846bcdbb6ae31e8330ba81808ed
SHA512 5dfc2d6812498d393b31d55fae53ed865a5a6c797d798ce5ba9cb73830845aaf9de222f2d1b518102b4a24b482ca584737d69508feeccc3057ee29dadfc70ff5
SSDEEP 196608:Lss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xszf:f
TLSH
T108477C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetSave.exe

Path C:\Users\Admin\Downloads\GetSave.exe
Size 28.7MB
SHA256 ca6306398e09928dda79f5a8a2f5f93e9610cb41ee95bf4dc684504a2ff5cc52
MD5 883accb267fc5b79f0b9ad91524e4b35
SHA1 cc7ecbe5360895b4120bcb0912ec528e23beef4e
SHA512 0a93dde2c61038d0fb93e0e094fc3a18a9ecbdc999e6b58249697fadc9c805258ab3d8c0b0f5606827db47c114fa3f170e476f83df40e6e49d7f099eb167b4db
SSDEEP 196608:Lss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFss1xsFssq:O
TLSH
T1EA677C11B7D14031F5B328714ABFE379597AB9214F3489CFE3880A2E5E72AD1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8bbc2a38cc7ba0087a8b0f098f7f801e23cc35a333aac1b18b9d1df95852b062
MD5 6a9b7beb56da2ff7e9ed5190c94a5100
SHA1 ae34a79f7a7db8776d480b9a3df21932df6e472a
SHA512 4602b453e1c306d3ce36e0326b7ed37b065e79bff43eb3de5fc67a4be4df465f865ba1ce1cc99ff822cb58f4fb9a3e5afa45acd67891a7fbad7de896e4b17b5e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 182a4fdd18a1c1161c59b9ee6e63c58a12d5919edf20792e292370d696a58832
MD5 051213684015501acae36f5947de35c9
SHA1 f76d83103e12b1055180b23f2a46aca150ae9e7c
SHA512 77ad0af873ed3714a012a7b171739ae743182585b2982d254347a3b5c91e36af0f391d8716090b65f5cca3885e90f3128ec97d5626b77a96413e2a3e0a5766e5
MD5 SHA1 SHA512

Submit Download

svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABABBAACABCCCACCCABCAACBABCBCABBBAACCBABAABABBCBBCAABC.exe
Size 2.3MB
SHA256 0da11a765cee17493bbcfd291c5fb2bca4030fe4dc183a91d1c0652ae38d3d68
MD5 8f315f76645710d1f73374661a313089
SHA1 79248bf0af2acab979d955393102a298b8d66ef9
SHA512 af6351f0a2122159fc3f7465a30ddc3031d42d0afc5884c6ff9edb31a54a177d4ddb2cae6124d890017fa49061c0118955ce9aae6a0148cebca9245721142a4c
SSDEEP 49152:U+En+EYDd79WCn+En+EYDd79WCn+En+EYDd79WCiW1PszNsQd:1p7ep7ep78W1PszZ
TLSH
T11EB57C11B7D14031F5B328714ABFE379597AB9214F348ACFE3880A2E5E72AD1993471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 57f9daa6d76f8829859a5eac8d274ecadcdc377451e995db958daaa495346fb9
MD5 221a590d8b5cec8ace3c686a442bee92
SHA1 3bba28c0f151226102d4d902b8d4319cad6dcf60
SHA512 b106441558ac8f30255a3b9fe07e76958369187d54bd688c89825cf9ba706a0e31baee3a1d99a9436597f2cc6304710ff1629180db4d65913c43e50450dbb064
TLSH
T161212E60F065C863F5312C4F6915DE9708F43F8E9C9CEB24934A021CF7A9C36AD164E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 269b769b8b1a49a04bd82d0eb4caca1032c398a9c2e78924f1c0623846e7d4af
MD5 1fb60b49f70ed3ea45f2c4caa02f82b9
SHA1 ea250f49bad51e1a2fdef23bda84c999f784af80
SHA512 a8d9c4308bb87198a32c69f589f6da45396fbe1a99638228f57a86ab4e7ee36c29aff17144f0afa30697d30dd3c4c033463f382fc607e096f04fad7eb3a93335
TLSH
T1A921FC20F0A4CC63F521688F6929EA9708B43F9E9C9CDB2453594218A7A5C369D164E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7d3d45d6c89f80dc70fecca7a85c0d849ceeb13f819b50b638c23ca70d453548
MD5 5193fc36c5148679be4759a9184270de
SHA1 546bb3b1d146922edf5c541108b6f83950894c69
SHA512 0e77d5346fa215354f1a9cd841eb7f79e26eefa5c02d1729b3feceb308a410511a213681b99ca2ad604132ac744de0d0f382b9379263241f4bc26b8c55a52729
TLSH
T11B110D60F065D827F5312C4B6929DE9708F43F8E5C9CEB249399061CE7E5C366D124E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1140-102-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2352-3970-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2352-110-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4100-105-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4100-46-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4100-68-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5936-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5936-10-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5936-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5936-69-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5936-107-0x0000000000400000-0x0000000000421000-memory.dmp

Download