a728bbfb8920d9cf8f872e7813e47c6cd358e602f080a0ae6cc70a04bb133319

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
Size 28.2MB
Sample260818-c2afgafa33
SHA256 a728bbfb8920d9cf8f872e7813e47c6cd358e602f080a0ae6cc70a04bb133319
MD5 12de8cc81fee4336c8db7002e12753ad
SHA1 ce1b9310ed4e7098878f81b7130a45c02c796187
SHA512 b924bc5c9dbd32fe510eb8813396ce69a05838a1bd288a8ee87d58a8f25e174cd755542a9e0c792838fcfd6859354335db5d271be5c46f9fa8fd6f8a62914129
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlsv:i3Z3E3Z3E3Z3E3Z3C
TLSH
T12157F106FD8640B1ED3A61704CE7E27B49317E3AC031CA5BF5C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c53e-25.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c53e-25.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
840	svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
2436	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCCACBBABCABCBACBCBCABAACBAACABCBBBBACCCBCCCBABABABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe"	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABACBBBACABCAACCBCABCACBABABACBCACAABACCCABBCBCCCAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe"	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1944	sc.exe
2424	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2460	cmd.exe
2880	cmd.exe
5460	cmd.exe
2316	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6060	schtasks.exe
5104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
840	svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
840	svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
2436	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
2436	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
Token: SeDebugPrivilege	5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
Token: SeDebugPrivilege	840	svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
Token: SeDebugPrivilege	2436	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2316	4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe	91
PID 2316 wrote to memory of 6060	2316	cmd.exe	93
PID 5316 wrote to memory of 4940	5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe	94
PID 4116 wrote to memory of 2460	4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe	97
PID 2460 wrote to memory of 1944	2460	cmd.exe	99
PID 4116 wrote to memory of 2880	4116	2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe	100
PID 2880 wrote to memory of 2424	2880	cmd.exe	102
PID 5316 wrote to memory of 5460	5316	svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe	105
PID 5460 wrote to memory of 5104	5460	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_12de8cc81fee4336c8db7002e12753ad_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABACCAACBCCAACAABCBCBACCACABAAAABAAAAACBCBCBABACBCBCAAACACBBCCCABBCBCAAACCCBCBBCBAACBBCCCABCBACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABABACCAACBCCAACAABCBCBACCACABAAAABAAAAACBCBCBABACBCBCAAACACBBCCCABBCBCAAACCCBCBBCBAACBBCCCABCBACCAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe" start= auto displayName= "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe" start= auto displayName= "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAABAAABBCCBCCBCCCCACABABCCACCBBAAABBCABBBACBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACBCBCBBABCACBAABACBCBABBACCAAACBABAABBBAABBACACCAABBCABCBACCCAACCABCCBBBCBBBABACBCBBCBCAABAABBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABACBCBCBBABCACBAABACBCBABBACCAAACBABAABBBAABBACACCAABBCABCBACCCAACCABCCBBBCBBBABACBCBBCBCAABAABBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCABCCBBCCBBABAABCCBBBBACABCBBCABCACBACBBCBAABAABACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 e58ae7777e4804751aadb97c9822f83710d7f6d4bc3c7dc5a6c7a1bd13809cab
MD5 f2bce9ac46c0b8a692c6a3d85a9c31c5
SHA1 e5127e1fe113b7c5de127a9d1ae5ced42df8c7e4
SHA512 0e36430097d9d93211a7db9c98dd8df2e2be749d2f8d934e8a06b9fde4e23ce2a0f4ad0355d9548ed512bc60fe9020f115f80964b70e69aad6e32f61deacadd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\WindowsAIK\qap`g`v~dtlq
Size 10B
SHA256 52c43ac201c84c25b6f259522cb3edfa072a937476d882949ce1c33e4fcf2e9c
MD5 c5cbc38fd04247088c70738ca10ae2b9
SHA1 40628158bd84cdb22cd6d904500c794b0d79be95
SHA512 6c7659b9596d6acdd854173aa7b8c862898b04a75e2a4c11d1b216fbcc1f0f2b64bc88fb1aa9b0167d52380cbc41b4f85b18e1c6ba440c11d1b468e81b7dc727
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.26100.1301_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 1ff0b83dbb95f3a23bd8ac5ab408ff23e21f981115d635bad4bcb6b8b3f24c68
MD5 a19b12803654aba792510de318419201
SHA1 9efbe26ea93587fd07de1acf6038ccc75c2e3b89
SHA512 f4328eee84689c74716f5fb2747ca1cded4a5c456ba69fd09ba72c63221713bdfea52c771c5a2cd651b6a46cec90159480163d19b1cb92e0285b0d5bb73b05a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\Import\qap`g`v~dtlq
Size 10B
SHA256 06ee5d304e5edf6c59a359b92c1242ec4b24074bf280adf616bc46e95c30005e
MD5 9d290494649ac81b5e799de55c0ddd4c
SHA1 649dd988d5631fd994fc6438423abd354c3dc398
SHA512 9f31afa279d1d5b9b9adf1b29b3ffe1d86676df2e2960016920451c44a0d469165db66cc8c81ba1311b6c1a367c9ec336748193c7795eacc734f1e77ffe0dcad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\ClipSVC\qap`g`v~dtlq
Size 10B
SHA256 220b331667584dc4df3471f626400b8203a2fb37a289d64e8fee165b9b48bdc2
MD5 2d3a186a6b4155a578797b5d30e28e11
SHA1 7b9f688df8f20bb678bf258374d52ff74fc0469f
SHA512 e6d65674564ede141bfc58dbdfca4456b6a1c90ade41f4bbee0d42da39bec552ddbf16773f0c8e1884e34b91b45231eb84384493686eeca406bec2ec57e01aaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 04731ed81d1c37e4621c878d5881e42f180a50e716b24e338c6ab9a3cb11eb85
MD5 f963c842dd05fbdf7b91319c86e6fccd
SHA1 1a977238bcd78a5c9fe6658f3bdd70dc85d09130
SHA512 06e4a69815e39cad70a30cd797d07dd4d869dd1b1563b8cb568971a1a151067f0aa2516c6beefc099ae5086a6ac91d92ee96b2d2ca4626fe112f7c66d09402ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 43f2f77f92e5cd75caf1be82b7387758ef1905035c73b5a7e11b30f233189abf
MD5 a73414c8a903be10774a07d03e054857
SHA1 806a3eca7fdb08095141dd513bca711e455ffff8
SHA512 9e00869cc5cdf9ebbde8b1815c788bdebb834a53180b5ea8c9643ffcd02a34ca4930a3ee876f6677ef89f323c9c1f7317d3bbb1b55463cfc9a5074f2bf20e2c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 4ca9627edc9d37ed15ebad5104a3a291a912eb2d79f6e4b25dbc8ef7c03ca098
MD5 2c8dd020f2603caa65875c594eced906
SHA1 5a8e330fda4eac8bd1cb3e366f2fc742b711046f
SHA512 e9e081fa9c2b30a1219ea1194ebb798c7aef08f8dd6c10f98be107cf05479a4de73283d25a4bd84f809e6c6b1fffed74053afee4361e784cb4c1ff873d81a4fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64\qap`g`v~dtlq
Size 10B
SHA256 465be47fa29f73fc1cd722dd24e59b11b26999f67cd552273137c6b714c35be3
MD5 7e52d855394d9da7d518cff9f9dd4540
SHA1 b8cbe2e45522a61e8c8a7d35c474deb8b7e3b571
SHA512 1cf549c3b7022631ff7cdfb42f810327563f16d10d2316d4fd64c599ba5b4a186050d74694153e185e3050ebdd1f2f72f247507d597bc45a84aaa407b67c7467
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\ar\qap`g`v~dtlq
Size 10B
SHA256 5cce71d08f4dab4b672b3857e97bbf3541113d485728a747dbcbedb24b490b04
MD5 47ebb2cfb4e3be3f441b836e27312111
SHA1 d25323390b37bcc2d9ccdc1d0c11aeb6c210dd5d
SHA512 da2589ed5e239f19deffd775831157481369d2f7ce50b7034d2290fba8bde8ed9e72532f93181d9fe7e6a473bcb66fa0fed74e9b28a408d08f3d45f029a19fa4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 47bdb91fdc24dc5b74a5ba813518bb654c09f8c78ea636f72bb17069409cd8ff
MD5 68fd43b2e5d6b5efd5a185f839044165
SHA1 28e9163c058cae998ccd6025c19e4caf7ba673a8
SHA512 de83388497ddc4ea35d7d827f6f756972fc499a9268693042a618fd4b4c2223fec661183098be4bc4eaff7e4e70afa932d795de5efb6c27af669029eaddacb22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 fe7de776c1169b697fd9e993f954f8d0ec461e31c65e215deed2ea17b7a10b52
MD5 6dd6d3a23998cea898f5e9517b4318c7
SHA1 9a8cb1be5f4e8534e517c8212e3b4a31172c88ec
SHA512 864bc94a91fc6979b095860df044eaeef9d4cc057c1fb7e0f7e9eceb1cefb5a0934a5ca0fc720c7eeb962334aa4e9e4117978e296f4b1f7fd9b9835e6db986e7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 378c62d9597c678fede7a8f85be06683ad2281ccfae803c46590011cfe00ee07
MD5 d57a162085c3a261e51f7e984b5ee462
SHA1 6ae5003c4fbe2d663147e7ef43f06e28b8cc9bde
SHA512 561164c709eb583e586fb9f7e69da0644773e598597c96bceece3877a1e75b312a23a89a5020d8277d4e8cb427d461b4ee1bab3e31b9c045af824437cc689688
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dfc17a6ad4913560feddb345267a04eb07a2927b273fb7e213125853c717e2b
MD5 62c497ef2565fead53b371065e617951
SHA1 9e0b00a99066569134f9da5e45422775d1ef1040
SHA512 5f0de7fde17824bdad60fc1aaf204a5e254d5af7c645d896b6085fa2e180463940f8c9cc919ddf0ab17f1c9c630abd9960c828f2d349c0d7044e21b0bf98e3f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa5b83f2fc6deb3c397f72ddaeaa6d2064bcc0f7946d8f7facfbed74d0256d73
MD5 0ef65b707bc90882236f3dc90a1f57e5
SHA1 92f79231ea6c2b07705a88e92dd5ffd040605fdb
SHA512 ffc780d0c8432b04f0559beb6b54730347237ff3e0e12ae70ecdb41ec6c898709c94a00dc1e2acef83d198ed250c343afe67e4670decc1680623bd19d8678f3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3384f2d6cb1bd76c9dca67a76b1539f55e25c8e5c6d341fc354f77709d08fc69
MD5 c3536ca111363b85885fc1747ddd5a2b
SHA1 3c00aad865b2f4c27ab239c9a2000c8adfaaa141
SHA512 166543f03c05bcefe72ea8bee74275323e7864508517609fc5dfbbca9e9146bfcefacef79bd20aa53468ee6ac3cea5db97ec719fdc89c4b42ea0c59bc1621f61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17d5d384fd5d83737f7dc74a8df2e9896878f443041a800684d961e0d4de06b1
MD5 a45490dbf9b744d8581bcda54c0add23
SHA1 57aac1716d7c99ef45bc09c9fa01623088a8898d
SHA512 5c5df222e7cdb93d28a6913d57fcbfcd2127f6648ec00f8c654fda8b957d9fb9a644767586a888dba28604148a0f039bdb0e37e8b77f51e0d9a49b4822ee143f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb39abb2aa70916f20701de80a28ce23882f3867b597b860cbe8b8f594521a3a
MD5 9a7086b423c08e7566cdd25d01be242c
SHA1 436894f89a7eca65926c861a4791c2d0e5b1429d
SHA512 731771e9e2b63a24327141b514f2d4d5dac07599beddcc47a5173df810d69958212345011452d135633b0cddfb4f9b10cff38e6a374360b46d74111539ccce60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 818f4f3bb348ceef4660c087a7a5ad1b97e4d5085571414601a2d36758dbfcd1
MD5 6e124dec88bf839cda7c2fbb52dd0229
SHA1 ddf1b750eb495f8619f6d35702eb9c895007f0b3
SHA512 cdfed95b30a6241c39349bd8faa2b526e2ecc0c0d7eb034cee1ceb91c28554cd980da6b1491715a0dc710c3eca2631715e60a8aa2611869729e684a7eed23719
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 06a4f0f2ce54e860e356fbff58f413f1dc33d3e6a0e52ef50d32180a47959bd6
MD5 c4d37ef39dd4c9d80c9fbbe341d1da66
SHA1 514c74b8a95d0accffeef089bfb4845b507b8261
SHA512 ddb5fc478f6a11953996bbc544056a35ea90bb0ceb89727296885958911003909d3f2c6f39d3466df547c8e7daa5c77825fc001ede013e35ba2b02b87f3cb875
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Music\qap`g`v~dtlq
Size 10B
SHA256 872acde48fb2adb38bd12a1dc442b97e0579da0a4dd6a51e439beda6f5bfbf8d
MD5 a0c53b5837211953a6d11fa5e157c8fd
SHA1 99ddabfb3bcd872cce581e76d773c7c962818c5c
SHA512 d41e6fd13df13b402064e2dc6dd9b8ccd4f086a8f1a189c302438c8a6c21dd218bab248fda1166cc04be797dd5aa130114f8eb8454744084a3a7803b44d93426
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\qap`g`v~dtlq
Size 10B
SHA256 9f1df21d542fc66e31fc9b77e6a0b52c95e5fd49b060440224ffa12001c88a9b
MD5 5bf3861c89dd1859ecf7c3577701c803
SHA1 8a849b3a7cb00ce45ec84342a09db0f374bf991b
SHA512 ec8ec12e40859aee0e08eb1d10b2c0c99e7133ec0cef26fcc943654f23c491dbb9bf91e6d5ffa8b9afe47be1e2de2f78332eb42123df1a959e2bb261c2aa4b60
MD5 SHA1 SHA512

Submit Download

svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBBBCACBABBABCAABAACCCBBAABABABBBACCACBCACCACAABCBBA.exe
Size 28.2MB
SHA256 a728bbfb8920d9cf8f872e7813e47c6cd358e602f080a0ae6cc70a04bb133319
MD5 12de8cc81fee4336c8db7002e12753ad
SHA1 ce1b9310ed4e7098878f81b7130a45c02c796187
SHA512 b924bc5c9dbd32fe510eb8813396ce69a05838a1bd288a8ee87d58a8f25e174cd755542a9e0c792838fcfd6859354335db5d271be5c46f9fa8fd6f8a62914129
SSDEEP 196608:kFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlEFlfFlVFlfFlsv:i3Z3E3Z3E3Z3E3Z3C
TLSH
T12157F106FD8640B1ED3A61704CE7E27B49317E3AC031CA5BF5C9BB0A7F37A615829616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 393b8cc08dfdbff248b2a7deda51d9ce8a764813084a7750de221a1623830ac0
MD5 4e7ce61a62668b4b7db14cf9131c1804
SHA1 02d6c7f91d61386fd90cfb2e7348fe0df22d1733
SHA512 06a6c56abdad97ed644b0a2707c8878434dbc41fb34a8107aec26646eca0f2142dc3e1c4b7a8724d5074730e3db3e588b77ad4485964703b08394914b61da84c
TLSH
T13F21385198F7CCA3ED3368CB972ADAC35CEC36D7AC5CBE4462090119AF89C318D190E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 b2645c6a364da99c21d075ae9e0666ac980bdf9d9cf2ff02a273870a95fc9243
MD5 7bb109ac02ad6e3b09df886f8601c619
SHA1 739f67d2ee00e09a0a5d533197680eeef6dc991b
SHA512 d452de33df9a3ffd0a9fa3bf2cf22ddb2e5f246d296cdd468725698d702e95147d3bb2c61882821f9b1dd88bfecceac0e15a07dbb11b47f73a4ff88f6f045774
TLSH
T1D9210B61D4E7CCE3DD3368CB9B2ADAC25CAC36D7AC9CBA4062094119AFD9C318D194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b3102188f0a8b446d90fca0263b35404741a1f6bb8bf10216d716704e6ee9c9b
MD5 05fc0a11a866b6657b0f6add40048167
SHA1 655013ce8d1699d9d63f913a2cea436b68936f47
SHA512 529ba9c8861961d83fa333c3558025fcd5d10fc2f08c43aa64e37cd48c9b74e7ce057360717e41b9219dfdfb000297740deee6f5b9e168d72d504c2f006e7544
TLSH
T1F5113A1198F7CCA3ED3368CB972ADE835CE832D3BD5CBA4462090118AF89C318D190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-96-0x0000000000250000-0x0000000000271000-memory.dmp

Download

memory/2436-1865-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/2436-3866-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/4116-68-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4116-1946-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4116-105-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4116-10-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4116-46-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4116-21-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/5316-106-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/5316-69-0x0000000001000000-0x0000000001021000-memory.dmp

Download

memory/5316-47-0x0000000001000000-0x0000000001021000-memory.dmp

Download