12232c018d4fe94347b6ace31fd36bfc590bd607a9fa8b4c092a672b146a9ae6

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
Size 21.5MB
Sample260819-cgnscscl4v
SHA256 12232c018d4fe94347b6ace31fd36bfc590bd607a9fa8b4c092a672b146a9ae6
MD5 2b65015784fae32248dc4ceaed432762
SHA1 7a00820a9e85d809ee29310be1eaf191214be3b3
SHA512 4f608309bb8c06ed20940b7f7f2f4c6a259155a22c35f61ce5f7e46446048a16dfb91a804cedddfc1057e77f471451829ea785e8de9d03bccf7fe2c9ced8aab0
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EWX:Qp7l1/tr37wB
TLSH
T146377C09F94740B1D92B50B04DCBD2BFCA307E1587228DE7FA8DDB1B6A337A16838655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
1092	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
2588	svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBBABCACCCAABBAACCCBCCCCBCBBCCBABBABCABBBCBCABCBCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe"	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAABCCBCBABCCCBBABCBBCBCAACCACCCBCCBCCBAAABABACBCACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe"	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2788	sc.exe
3584	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
632	cmd.exe
2448	cmd.exe
5568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
1092	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
1092	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
2588	svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe
2588	svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
Token: SeDebugPrivilege	5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
Token: SeDebugPrivilege	1092	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
Token: SeDebugPrivilege	2588	svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 632	3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe	92
PID 632 wrote to memory of 5792	632	cmd.exe	94
PID 3300 wrote to memory of 2448	3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe	95
PID 2448 wrote to memory of 2788	2448	cmd.exe	97
PID 3300 wrote to memory of 5568	3300	2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe	98
PID 5568 wrote to memory of 3584	5568	cmd.exe	100
PID 5948 wrote to memory of 6012	5948	svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_2b65015784fae32248dc4ceaed432762_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACABBACBCACABCCCAAABCACCABBABABABAAAAACBBACCCCACACBBCAAAACABBBCAABACBABACBCACAAABABCACBACABAABACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACABBACBCACABCCCAAABCACCABBABABABAAAAACBBACCCCACACBBCAAAACABBBCAABACBABACBCACAAABABCACBACABAABACBCCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe" start= auto displayName= "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe" start= auto displayName= "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAAACCBBABCAACBCAAACBCCCACCCBACACCBCCAAAAACBCBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCACBBCBABBCCABCCBCBACCBCAAABBABACAAABBCBAABBCABCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cd32c63142ec0ea9c32c4f5448b249857b9fbcf005cf9fef31391977b24fad61
MD5 f8a80457976abaab625533f1b0115d8d
SHA1 86a8fd8ff5b45b369df2117d15941dd73d521f6f
SHA512 f9f66e77a6962612970be5b72097efa843e1249dd863eda91c97d9839b717975c397f5c4dd3d8cde810ce4442236d6d8644d10f1664f50dc93fdc14c2b7801f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 4bf2960b63b960e9ed8dfd455639adf7568ac0eef2039e840266349310fcbd66
MD5 bd4e534b26ce2e8aab2524624a584e41
SHA1 759f1da9cba40857281b1d07c9d4a4f872d7f27e
SHA512 53f7de095be197e144d8f2056979c86cfa0f2dc75c925ce5376ef2d83d21895f7ba4d80a5fd05b9ffb8c68828b18bddf777461ac91b0b87b8c7db191bf99c5db
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 30e2131d38b402cf7c2ec0950e52e43e8259ee47b7c63ab2935f59414aef7de5
MD5 2c7f8f22cd159af986722667923b3dd7
SHA1 0170b9ff82938a62bae9116a001e8a5680bff3cf
SHA512 861f0d32a1c81f9d3fc74f40a54e9d05e4e91dbdf6366a619bd614e6c3d277b879d561a4c8bac582f79727d37d844bd66f04916eb0b65c858bb28729df195dd1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\NcsiUwpApp_1000.25128.1000.0_neutral_neutral_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 d1b47a5de196037b8edb1e81e129caa989808f615a7a71bfefa78c2812b6092f
MD5 c67c88f269d7c5a831fd6c5261042bdc
SHA1 d5b13b03c7c3ff73845d7ab35ccead17a3ba6634
SHA512 9ce730c4e7ce94249820fc6d735cd602b86d383a18200bc19d243208b74fe40b91561e74e9353b09b967aff83df334b224b77b2ef89c50347d18426fceda57e7
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 22.1MB
SHA256 a18e0996f7a6a0c0f782479f8b111a29d86ecea15ded90777bd4d9635f371049
MD5 32df753225eda46c3c9e3119e8c63791
SHA1 2797eef3f37c2071179d854fef110077b8c35180
SHA512 2a016a7ffb1ef0b3a576ae218a9900c94e6377c2bc9ed87d0a1de6008010b5d64db80135306450ae9f370a36161ca3d3f0dc711239efb85735aad40dc71a9961
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EWv:Qp7l1/tr37wggZ2Hb9t+2x2
TLSH
T18F377C09F94340B1D92B50B04DCBD2BFCA707E2587228DE7F68DDB1B6A337A16838655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\qap`g`v~dtlq
Size 10B
SHA256 b11ff187a21212e50ed1396b031a76971d7cefea56c4dd17d4818c67921d725d
MD5 422643eebf63dbc86ce075997e76f942
SHA1 ed79298141017438cf20f23bd68232456053d9be
SHA512 36b81c124fb7d4355ea8d2b162852d823f674f51a11d44933056bd1bc56f21aaa3ee38b8abb738f17343f66f274a6b5c103d3861bc49d94fbc2898fb53c54f99
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 3a9560974b4649defebe78f95be6be3fe1264785469f3c786c011007ee2829ea
MD5 070dfb099861c963b31e09159e8f500c
SHA1 a4bdd276b89dad16f0b590e6c4ab386d83ab2b33
SHA512 d654bf0c629313b64078244a26d7e7662854fd36e9b4a3427cdbe5152ed427a1652dd83079d0e9f7a9251af0aa442c9d301e61ef43816b996339cab4bb523ec5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 a31353242f070b599fbfa214b180c60f884d6fb157b204cadd71312649ddf83b
MD5 5e0661a0e2528685f699618f98b14190
SHA1 816ce69ed2227769b82349913d4dabf215bb1b6c
SHA512 005d8b2eadc757e8ca72f3fc23e6e7888bb125e0c646521949ce0b4e9656264b36fb36badf6860a740bb473b3cdcb5017b9dee33c5506636fca2c97ec44895e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 76bcacedd64680a5ecdac804109e3c5123f055b9407fff77ec1504360bcf19bc
MD5 243eeefe90fcf0f90b03b53cb74476b0
SHA1 4507ecafadbaaf38111e347823a8bf0d6b3c2646
SHA512 4252e0fde6be92f26a59a6cd6a7c30d3f800368ae30ebcc180f27e269c89fd30d144c9a79cc906dd7ac7454c7f440ac2493f84a309901d65d171c1ee1743f011
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 870bda5a11b1591341b31c6af19cbe0d26a14102ca7e4ced05340d7dc0c55d1c
MD5 b06c47d7e202fa34df8f7a92c25714fe
SHA1 5d9b136f89592b3ffffe2f13121308f9ec6cae42
SHA512 055be9c3db1fdebff9897ad99d2d11dd03f39c97ea30dd0a88b21d2b4efab701765915e88bea51a6a7a01e804c87bed8d486459720076a4242a276fd477e9916
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 ab126a9a084054fd9f561f4326751ca5ceb656f494ee73b657b3ed1e83deb55d
MD5 446d4d9750faecdc4750e31706299352
SHA1 a3d79f40cc74a93edbcb5a50155cbabd04dcd4b4
SHA512 1aed9abb55bb610d101d3543a7065ba18d246a722975e571ab4837ce987baa9476668566b273f87216da69913bb685aa8d7d84d720d21d20df648a08492bda3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 0cd03b4039b26eb97be6c099bf1b3693919203b96b0873f0476606db408cdb5b
MD5 83e4cfa3502f33c17acbb94336ecd98f
SHA1 d35f7782861d894fada929edbc854f53faf035ad
SHA512 c39138625c83fbde5ffec69f51e219e4a00edf8bbb1014a482513b32e0ff2384beae66ae4d1dae81b2392ca6efedf9ae225c3730741570b6e149046b9b12ac69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8TT423M4\qap`g`v~dtlq
Size 10B
SHA256 4d5212650b806031d82dd8886ee329503d04459c6faf181c92ccc87ad51363ca
MD5 5177e87f59ff877492fd21f90b4bbe09
SHA1 447a0bf51b068efcf6764921fbbc282fe9aba560
SHA512 351beb19f9235b23210612b98cb6b7a69fcb7d55b44a6b43d66c75c2734c63d2ce01d04ae9f6b6c0868fa8ab278b87510344229724f54530f869ba8dffeb34a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\qap`g`v~dtlq
Size 10B
SHA256 b25e1001b641d79745da76f1fe8f60ad01f3de507be46c5ccbaeba30427623ae
MD5 3c899087c1388732bfb868aa73b0e8e5
SHA1 a8bfcb098bc9e8a9032677b3a1bc227f314f1bef
SHA512 896fe9ffece85066a01dc01866616f375797995ca78800bc08509bf6db39892426603508e9d70469257edbb3328bfe11407a5bd1427182f4a96582bc5c399052
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\qap`g`v~dtlq
Size 10B
SHA256 4a570cba6e7c2095957b8ab9f9b40bd9fdabe4acaac397bf534cc50c89a942c5
MD5 021913ac36d44d64b5a681548706adb4
SHA1 9b53ce802367a9ea9f82767fe1e90cc8330b53d4
SHA512 0ccdb95da39708179e8414eed4f63eff61d0234f34e11daaff5291bd176830f67bdf741d563e716bb27839dab14df86480fac67b50d7b9f24dee215196b747c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51fef4cb82ea97bc8a225b69e2c2eb71364d24940f667fd5aba9ed5fd70f04af
MD5 a372e8d6700abdb7859148edd843d4f2
SHA1 5934901c9dcaa1c7df48ba38f94ba9f3798ecf51
SHA512 6a73e91adc38d53fbc734c8a8a26b7cfcfa98621da6a18accd8b490fd1f9d72f4952fb5356219320a350d792f463cd76acb5baadb93a7af18d7a1111d078ce69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb5fdab3f755eb6c8dde45e8e75f562d736d569d29f0af8e1e7e9a533540d8c5
MD5 33eedb6f291314655d4e42f0b4e924f6
SHA1 d6aa4ddc3704be5f0b306b5e8703a96953038fbb
SHA512 88e7237b088dd45ed03302a35915341803f8129bb5ffb91b021395124f81a0013eace98f802514b581fcc8f45fb3bd33848bfb7f9b3b6eb254ba9f1390766cc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64ca897125aa184b998aa49aef5c9b91aa7002767ed5c7cb0809cf532d562777
MD5 497eda7179858986b63e56651fa03a7e
SHA1 d7f69d304543db8a7a9271df64153383a80bdbd7
SHA512 daccb64a3db5185336685b900c7dc7108c1bcc2940fdca982c0f3b99235c5dbd1d5f3c52ae1b342e57b8e17cb8f8acdef7f1e3e56dc316c73290ab74511c0086
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6311b5c474e7627705a88f71560688027780358dd1c0478b672b5c24adc2e323
MD5 078d38354006dd97aa8682bd8b41323f
SHA1 b096e610367d2de9df0798f7e60f4f386e3b0fd4
SHA512 b64187f9902a4ee3f37d62c87160de32abe56749e7208771ac7f2afc1663aeccb0ae563d28cdd3c992b55e00a947b8aef9b79280ebc5a21fd5b93f6dc1fbd79d
MD5 SHA1 SHA512

Submit Download

svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAABAACACBBBBCCBABBCBCBBBACAACBBAACACCACBABCCBBACBCCCB.exe
Size 21.5MB
SHA256 12232c018d4fe94347b6ace31fd36bfc590bd607a9fa8b4c092a672b146a9ae6
MD5 2b65015784fae32248dc4ceaed432762
SHA1 7a00820a9e85d809ee29310be1eaf191214be3b3
SHA512 4f608309bb8c06ed20940b7f7f2f4c6a259155a22c35f61ce5f7e46446048a16dfb91a804cedddfc1057e77f471451829ea785e8de9d03bccf7fe2c9ced8aab0
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EWX:Qp7l1/tr37wB
TLSH
T146377C09F94740B1D92B50B04DCBD2BFCA307E1587228DE7FA8DDB1B6A337A16838655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 03d58b133e28a172d14ee5538a77111dcf12e048a041d8d53271cb5ada593c7a
MD5 9318aabaad52437885cc6c05f9848ac4
SHA1 2067d09c4219c1a7b6d96d1e14ba79b19f88de4b
SHA512 3c4620344436ce5644c763643672bddf5669e3209cf667d35d5810b7e36478d5a096d6e8f8a231a982b9fba27838f9989e099c018d01d98858fdf6cf7cb25eea
TLSH
T198213420B9B6C853AC33B4CB561DCAC76CB532A39C5C6A11230D9118BBD8C31AE19CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f979b641b2c2b3fa80f734956278ddf9b16df60a13466af97c8ddab77ed14008
MD5 0d488a140ca645769e9f700762a9b1de
SHA1 7d1747c397ee7ead29e5e07aac7ad44d8c4446e6
SHA512 95a90ad1e6fac4293eeb2aa94f38b07cb22158c85f31630f5134701f1a467945ede00d40797265bd7ee052bd8962720904ef7b62d69c1a930b66041df548260e
TLSH
T1E3113430B9B6C853A833B4CB562DCAC75CF533A39C5C6A1523198118B7D8C306D198E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 834B
SHA256 de08a3076c2e3587e61a4efd3c6ae71c5a4fbb794b492dc8a2d1b77a2bf5ca2b
MD5 2b73431a311c9b8ef990471ed9902883
SHA1 393671c72e4fa036ce55522b3f99deceb920557e
SHA512 56f1dd718a01e4a7374a872f2b3b99c15f647e9b54a0afc76e3d7e9d928afad08b487afcf6c73c8921a8e0a8b05d41157716ceb5a717c6153ca640b044b20f96
TLSH
T1AB012530A8F6C853AC33B4CB562DCAC75CF532A39C5C6A1123198118B7D9C315E198E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1092-1380-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/3300-6-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/5948-35-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/5948-22-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download