77ecefdae22e8dcd389b8e14b4eeb91aa15e27da5ba385f27a8e17452a9cc1e0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 20.0MB
Sample260905-2cdt2atelh
SHA256 77ecefdae22e8dcd389b8e14b4eeb91aa15e27da5ba385f27a8e17452a9cc1e0
MD5 a1efd9db8df2f154d12a20c0ea7c0dab
SHA1 e2ff72b61237320194f0399d920a8f8f92395f13
SHA512 2711e62b40947ad816c18d763a624f1403e5d9918f5c9e6304feaca45bed922e9b58f2b336f7fa597ae821c16de937684acc0b72a8242431bdf5a5973ba9ecff
SSDEEP 98304:Jrar6rarar6rarar6rarar6rarar6rarar6rarar4/fh6ImzzJoDfuBcMv+A73X:tGmGGmGGmGGmGGmGGmGG4Hh6ImzD+F
TLSH
T1E5277C45F98344F1D9270170489BD2BF9630BE118B22CBEBE748975FAE33BD1693A611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1000	svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe
5088	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACAABCBBCABACCCCABAAABCCBCCACACCCBBCABBCBCAACBAABBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe"	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABAABCABABCACBAAAAAACCBAACCBAAACCBCBBAACBCBACCCBABCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe"	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2408	sc.exe
6104	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1992	cmd.exe
3164	cmd.exe
4204	cmd.exe
1232	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1264	schtasks.exe
1544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
5088	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
5088	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1000	svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe
1000	svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
Token: SeDebugPrivilege	5088	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
Token: SeDebugPrivilege	1000	svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1232	4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	92
PID 1232 wrote to memory of 1264	1232	cmd.exe	94
PID 1244 wrote to memory of 1776	1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe	95
PID 4736 wrote to memory of 1992	4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	98
PID 1992 wrote to memory of 2408	1992	cmd.exe	100
PID 4736 wrote to memory of 3164	4736	2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe	101
PID 3164 wrote to memory of 6104	3164	cmd.exe	103
PID 1244 wrote to memory of 4204	1244	svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe	106
PID 4204 wrote to memory of 1544	4204	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_a1efd9db8df2f154d12a20c0ea7c0dab_coinminer_cryptbot_elex_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACAACBCBBACBCBCAABBCCCCABBCBAAABCCCBBBCCBAAAAABBABCCCCAAABACBCABACBBCCBBCAACBAACBABBCACCAABABCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACAACBCBBACBCBCAABBCCCCABBCBAAABCCCBBBCCBAAAAABBABCCCCAAABACBCABACBBCCBBCAACBAACBABBCACCAABABCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe" start= auto displayName= "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe" start= auto displayName= "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBBBABBACBCCBCCABAABAACAAACACBCBACBBBBBCABBBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBCCAAABBABBAACACCAACABCBBAACBCABBCBBCBBBABCAAABCCCCBBBBBBACBBAACBCBBCABCBBCBACBAACCBBBACBBCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBCCAAABBABBAACACCAACABCBBAACBCABBCBBCBBBABCAAABCCCCBBBBBBACBBAACBCBBCABCBBCBACBAACCBBBACBBCABACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACABBCACABCBACCCCBACBACCACCCCBABACCBAAABABCBBBBBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 2fed6bd6bc492eda4f9e83cfc320a8b5540e7602d35f1698ebe3c6b240717b0f
MD5 fa1a9aaaab3d5f0517e04466ede4e053
SHA1 7797adf14363d976966da3d545a13a296d6ff448
SHA512 297dfc1c5f7c43c67639c56d7f3bb41f52c37242226fa0b8c55562cff60fc1b97fa49136064bed93338c6652af00069626148eec7235435530e2345ac1215f95
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 919fa7f40b472d5872bb41d82f5d84e56697c6cfde65549bd4d2532349ece0f0
MD5 d8246eda335c43583acf3d7121962602
SHA1 65f8fc9096280c231ca8d6decb94d1c1bab41b30
SHA512 b34ee7318a49c2a396a0edeeee62285a09e3f481c9acd884a92c98a67c6b27c92034c234e8dd55592db480aee2c1e6c10140390a38b9d9afb557e215bbff7134
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\DeviceSync\qap`g`v~dtlq
Size 10B
SHA256 dde580513981e22e5991cc8bc76b40a6a87c4f52f8817e9f608bd61ebb4aec8d
MD5 4cfdcdeb4a1929f29102f58983f9cba3
SHA1 7d78f20e7383f70044d90f87f3c0a7f3605e16a8
SHA512 dae4134f1fc54902b62096c273a09f9d174b3204aaf248b30d97e040a795cc8dd4cbe68e592db09e3b6b32a520c6b598bc9e2e6173530f3304a6351aacfcfdee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\qap`g`v~dtlq
Size 10B
SHA256 f425649304b934f53dc8a90c5aefbf47dc27590b49df09d5bc51a1e25d0e1f48
MD5 05cab8e0b0e556089e33747343e6e604
SHA1 8c64ce9a1b26b7e5ef7968834ba5b7a506788bb1
SHA512 b49cc03dec9763157c368bae3470cc12ac7fe13f3288c280ee0cacbaea4136564cb865c83f85940ba423263f1db00dca40d7e268f3724e64fc38e47f75f75c34
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 20.5MB
SHA256 52d4a61ca48466cff81497f20a540aa5e8db7aac0af1c73660c23594e64c4094
MD5 db0a0404374056fcdc84154d4821bfd5
SHA1 2653d7d1bbeb7ede4dcf71fd264b6a1c59755a89
SHA512 8f68d5ad9a77f02a2fbdb2ddfd24d2a56d8efc4f3b3dacac71cacbd58f752f302042d4726e5c1247cecb428d3bb079fa07e194b58fc17bf55e265f45b85d3a24
SSDEEP 196608:tGmGGmGGmGGmGGmGGmGG4Hh6ImzD+F6gZ2j0:oE2Y
TLSH
T148278C45F98244F1D92701714C9BD2BF9630BE118B22CBEBE748971FAE33BD1693A611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 24a285c51bf57de577e22a2576b0ddb5246a6bd927d9ec3acab4ac582182faa4
MD5 1bd3c51e6fc7395f3788de32b4ad0d74
SHA1 4046d0113cc12cf1d70dd17f52c1169a0cda4466
SHA512 82509384be4c05d64b1170368dbb63f24defd9a11ab6b97cde80dcb709e4b2a456017a38abf835ea5b82ff5ed35a7b94af0b69d9ff49efc4f1009dae1d2dcdfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 f3acbd043807d9cb1182e1f26165d59aea88070fc08cc77e471b2dd54df55d71
MD5 bb6495bfe437199cc6870cde959e32a4
SHA1 19c259ebad8b316809c3e64aab3963927c0f5924
SHA512 4585c8a078d67e39a95112eee23135e11a8f05327dce65977a559c55260cd41b7951e1e14d5c055f162e379530367d01e8b2348ca124f0566aec0ec19b010a75
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\qap`g`v~dtlq
Size 10B
SHA256 7b97b0b804f63ce320cac8222e3921fbcd1726660903c5f2e4b3aabf26ada58b
MD5 e125ce191b082d00cd32e26690c84842
SHA1 3d07bc4cd29d86f7142e980ced69ee2362c395fe
SHA512 5ecaf406634b146fba0476f55757c3b1d3d8225370cbcc0bc411fd74f37fd7995e25b5fbcff0e366f7c8bf61de7715f79d691bff9a7714f3ba3774d24164bdd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 610aa4e340eacdc7ab6ac18a984ce588a7e65e70cda59f3ad17674bb01964b12
MD5 f8d17a69e1e39c5e2d6d576339d69831
SHA1 eb32c50cbf1fa51f80352b087820b4d7293ddd52
SHA512 5697898bdf010f99a9349e082a5bf8fdf791b3b32feb99dea222567539924cb803ad4525a07b2a061e08886206f391ecf7e134623cd3caacd3378eb909436838
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\USOShared\Logs\User\qap`g`v~dtlq
Size 10B
SHA256 15ced4ad0a7a72d6c880f966f1a4075fb643e31405555098941b6846820c50fc
MD5 26b39dc86a185213c11741ba50c234ee
SHA1 1c96dd94cf38fbd425373547ced2892629d552e8
SHA512 833ddb93a319d67bf790e43724ecabf1ccf8b85d6be074d61419780afbe8c9438ee532a2900f9afa13b0029f9b3392d065d13e7081aa991e1962b95cdccf5cb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55\qap`g`v~dtlq
Size 10B
SHA256 42976c69abaa685a8d1af15d675bc4c1e769ebe1984fdd8d0b0a8bc280a56c7a
MD5 fab9af2bf83da42c46d27e982a02c4ad
SHA1 006f86a1ea0750d7e79feda1a1e5b8aa820e15ad
SHA512 c4be180af0963813b2ff8073b8c0423b31e87b122ad2915c812113ab349d06eb21ef0afc40bddd939db9e4a873520625d5d446ea743328852e3298ee060c3629
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 7db57dceeac529f8a110d245c6b6c9c3d8512d3a2d3b551a35b50e40fe2187ee
MD5 c8a7eda0831c329a66d4cac158525143
SHA1 68d958bff3e6fdac501b7504616753e8ac016bf4
SHA512 35813fe0b5b99cae6ad14fa4f8640c3aa7c18cb4962630a3481e9d42c8a2570d6192560c2c8b57a13e663157ea3b8568288e879bef0aca92f240af1ccdc99239
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 f37b332bc24051a4e66bebef61a26309fd56872cf29e2c75a354fe9cb7fad5da
MD5 4a9b4b7d703519197f2501622423331a
SHA1 6f6ed3143260046ad56e6c1c50fa3d155a85adf4
SHA512 7ae2efa754769fc4f1b103b6915fe3b3d7b036e256459a49b54b1cffe54b111bfd4ae9c2d7dc4ce042dcfcbce0a6399985c62ece5837c994faff43e37add21a1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 c94b87d0d930b197c25497856781b4f985db855884ec1082e97e70f60988c99b
MD5 a85170d4e418aa6fb87bd129b37c08ea
SHA1 2480968bb016c4945c4eb16d1b3e6b7b0cedd36c
SHA512 2af1b0e21c4918b674ec57121a5f43ace3c2dd9efba1b007174280eaffc258183e0cbb4cf5595d156c32f418d427fc391aaafc6ea77568b4f5382c2bf83bb1c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\ResolveGrant\qap`g`v~dtlq
Size 10B
SHA256 752d2cf61495a219dbd659211362160220c960be55c7917bdb468791dc6911c5
MD5 662db5a45d398178e2077485c413fa25
SHA1 8f9cd1182af1f4918e1aad0ed88629feda0ed7f8
SHA512 0bee9a8f8af4fd9e313467bf4bbdc64300bc424d93b78360a7fd7601fba4aa1bdf4ad76480549046ebf29d1d110dd2991de07f37743589a0c3375cf7e611e8ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 758a47b53a3f5c4ff91954c0b2f4093a8deb12761caa9bfbb5053dc8fe3cb54c
MD5 03caa21019e8899570a68d21ee0b03dd
SHA1 78472dde39b3c5f0bf54d2454bbde3659bdfaa3c
SHA512 0063c137008b053c673118452d39464e2ef63d28a5728053fe860cc4dbfe65a9045990d390fa0f6556df4819f955ae913fa47690ede4cccf7fdb9a57e37b34b7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc0662f47b08dfea87e4d8e168f67bdbdc56491b4daf01080ba7335d4bdd9005
MD5 707ab467fc59621ed20f6db3d725c81f
SHA1 45c2f14c9082cba4d99ec41d0051e83beccb220a
SHA512 6d38283c0380b8c27b543305ccd23a3b7f43e95373e04ae22f9dd3baf1b199d2cd91e937b23019c387fe3fb0a34de84f1bfa0dba1544a11b1bcdef13594abf67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9038ae4581d583622b84d8d911eb38d05ea90fe021816ec35e11ac2856261410
MD5 068c10bcd464f07b7b5f109db1f73898
SHA1 b507dd74562a6218617fc64e39ab99ca1f1ec3ed
SHA512 532b59a9975b21ad0466dea8af211aba3c052e470eeec06dc8dd4cf54d8895b933aaabf7f2bdb2cd234978499538d222668b62bc95e574088da83dbab6234501
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1669da92be1ebd6ac75de0bfe70a8bc35a82c16d689e7fb77b56a3e2bb6be84c
MD5 faf766db944f356b31120342ae7be641
SHA1 cdff0706981fbee04745fb5553439fcb30115c0c
SHA512 5f4c7a0939ba63732ea0e62d7629fe76f554c520ea3851c27a96972a48b00ac328cfed9a0d74ebb516e5a0127d6017cb2ddec880d60a3ce5d0f958bc92711432
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 876ad81aea4af79798dea3dcdcfadb8b10d3962172352a88a21571a06813fd9d
MD5 4efc302fc31dc7166a971956ac0f78d2
SHA1 a1cfaad57a6dc449536d8461c64798bfbdbc8219
SHA512 cd5bb4e481414670dbe920fab2bee265a9a35e3813a486868ecce0351bc8e1cb1e18ded60c5b7ca3217e514dbe11841dd00f987b51c5b63d037873c77c5174d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d873ad768482b25c9d108ff5eaaa25530e3adfaf7b2cf4c21c84bb654ef0578e
MD5 03654ba3b03af9b5acbd125f6c8a95ab
SHA1 0e8a9058e2b755fef849bc6eb06490939ea4cc17
SHA512 b34f13d6c05a47afaf9636003d307d6be7a32d072fa1dabfe4dfc748031598afc6c9c1d5f196bd72deb9477358f0123c702319bb5e8dcfcfddb855239afd9dd5
MD5 SHA1 SHA512

Submit Download

svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABAACCACBCACBACCACBABAAAACCAACBBAABABACAABCAABCBCCCC.exe
Size 20.0MB
SHA256 77ecefdae22e8dcd389b8e14b4eeb91aa15e27da5ba385f27a8e17452a9cc1e0
MD5 a1efd9db8df2f154d12a20c0ea7c0dab
SHA1 e2ff72b61237320194f0399d920a8f8f92395f13
SHA512 2711e62b40947ad816c18d763a624f1403e5d9918f5c9e6304feaca45bed922e9b58f2b336f7fa597ae821c16de937684acc0b72a8242431bdf5a5973ba9ecff
SSDEEP 98304:Jrar6rarar6rarar6rarar6rarar6rarar6rarar4/fh6ImzzJoDfuBcMv+A73X:tGmGGmGGmGGmGGmGGmGG4Hh6ImzD+F
TLSH
T1E5277C45F98344F1D9270170489BD2BF9630BE118B22CBEBE748975FAE33BD1693A611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5e2ad1cf06635a178618b2b51baece8b97e89a7f1519fbab66c966dd8387725f
MD5 1a0745a31cec1f45c615b54dd22847ef
SHA1 fe8d23ece27f29935bf5d3b8ea74e203595ccf22
SHA512 7e3f891d44be72a36a5725832a0b5752b4a8adb0082de1881d44089b55bc4007bedccf1e702005193d2c840694663f5b782f7a0f16624b5870e731fd6c5194c5
TLSH
T1A221D165B0F8C867B23168CB9216DAC74CA83F9B5C5CAB88130D8218B769CB9DD15CE1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 3e74ea822ed61a3369353c7ea3200e0702957206fa6cdbc692086f2c8f3ce269
MD5 6ccbf23b9ab67d359e9d8f7e2678e069
SHA1 bbf05b9643a698fcc4281f03ba6e57924a8ae31e
SHA512 90e2c6fc58a156794d0f306faba8cfd6c96ae6ad29bf71e857c49918382045bce8af119c0506cdd42b68a4a56d96fec649f7a43626773d89977103b67f30cc88
TLSH
T1E111E775B0F9D467F23168CB91158A874CA43F9F1C5CABD913098218A719CB89D15CE2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 c34beeaf66c50035b82f5a2fb138700139a6a6bee5d7ee94a1785c587ce64fd5
MD5 70f3999b56f6649fc6f555dc1e6cd5d4
SHA1 de673f68d2f594affa25a5e491c861d1a020395f
SHA512 44ce6e8be7bddfa25f7e36c99acf1a44db17d233262867b0e1748a76fc4c87f7b9067e16c93f663f74d9f314d7dcf55568a171bd5623de91b4670f8d43fdb2f3
TLSH
T12521F376B0F9C463F23168CB92168A874CA43F9F1C5CABD8230D8218B719CB9DD15CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-63-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/1000-3704-0x0000000000190000-0x00000000001B1000-memory.dmp

Download

memory/1244-32-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/4736-6-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/5088-1499-0x0000000000310000-0x0000000000331000-memory.dmp

Download

memory/5088-3983-0x0000000000310000-0x0000000000331000-memory.dmp

Download