0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Size 9.8MB
Sample260910-ac3plsscre
SHA256 0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05
MD5 12e7eca4f1734d559a6d6e702a0218ea
SHA1 0f6ce7369b789b5c9a868650b5e7e1d639963d62
SHA512 043624f2e8dbc625354e930abac6cd4da68cd697cde678351234173f423202db4d82330fe8ae1f198404bce8de27563aae5a12f7f2598c1e568d81676d862afe
SSDEEP 49152:U+ES+E0+ES+E0+ES+ET+ES+E0+ES+E0+ES+EEDd79WCj+ES+E0+ES+E0+ES+ET+b:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabg/
TLSH
T108A66C18F9834076E86B40B04DDFE2BE9620BA229B014EDFF7CD475B5D23B916534B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
2204	svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
6056	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBCAAACCBBABACAABCBCCACCBCAAAAABBABBAAACCBCBABAABABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe"	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABBAABBACABBCAACAABCBBBACACBCBCCCBBCCABABCBBCCABABCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe"	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3768	sc.exe
1912	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe
1228	cmd.exe
2208	cmd.exe
1244	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6048	schtasks.exe
3472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
2204	svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
2204	svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
6056	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
6056	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
Token: SeDebugPrivilege	3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
Token: SeDebugPrivilege	2204	svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
Token: SeDebugPrivilege	6056	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2308	1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	93
PID 2308 wrote to memory of 6048	2308	cmd.exe	95
PID 3328 wrote to memory of 5620	3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe	96
PID 1272 wrote to memory of 1228	1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	99
PID 1228 wrote to memory of 3768	1228	cmd.exe	101
PID 1272 wrote to memory of 2208	1272	2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe	102
PID 2208 wrote to memory of 1912	2208	cmd.exe	104
PID 3328 wrote to memory of 1244	3328	svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe	107
PID 1244 wrote to memory of 3472	1244	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_12e7eca4f1734d559a6d6e702a0218ea_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAACBCCCBCCBBABCBBABCABAACACBBCCACBAABBCACCCBCCAAABBCCBCACBBBBCCBBCABAAACABBBABACCABAABBBCCACAAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAACBCCCBCCBBABCBBABCABAACACBBCCACBAABBCACCCBCCAAABBCCBCACBBBBCCBBCABAAACABBBABACCABAABBBCCACAAAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe" start= auto displayName= "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe" start= auto displayName= "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBCBAABCAACAAABBABBBAACCCACABBAACCACBBBBCAABBABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBAACAAABBCBABAABAAACCBCBCBBBBAAABABABCAAABCBBCBACAACBCBCCBCBCACBCCABCBAAACCCCACBCCCAACACCBACBBBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBBAACAAABBCBABAABAAACCBCBCBBBBAAABABABCAAABCBBCBACAACBCBCCBCBCACBCCABCBAAACCCCACBCCCAACACCBACBBBACAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCAAAACCBCACCCCBBBABBBAABBBCBBBACCCCCAABBBBCBCBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cc0d8a9bbb6be2cb3c27a684db5a5543fcb1cf1d261d829d27f11113f7c42f3d
MD5 0fb175825be61cc9b817e0f4102cc7a4
SHA1 3fc7af26ee133d2a40af3e7171fdea074b1fdf6c
SHA512 1a40fe0686afadfad12de243bf766b5e4e0cc2a10a861b85146c4819dd7e2e23e840fa9b9d8e2489d889d09b00c68830d0c7500c67c31a44398c10274b0567bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\ETLLogs\qap`g`v~dtlq
Size 10B
SHA256 a6e515d9f5f651900fa2e5ea959b8a7fcfada4cb8d17975c450fded221d3f1bd
MD5 174a5d51af7d113f390797251a011099
SHA1 12593779e87c6a4cc95dac707b8ef23caf6af682
SHA512 eccfc140c684f16c25e1acd1b46784a56c3de9587b931b298f4dd48ec86d3281e4815139bdf225a845a421b4e69c51dc23b2065d0e769a8dd4eedca53279a089
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Scans\qap`g`v~dtlq
Size 10B
SHA256 31300c46a819058e51644074232a28eaa8fefe3ed52aedd9408a2bf521fa3c0c
MD5 01d282006a1d9dedf739ffb4df7cb6a1
SHA1 4e49c3dbb51b78043e368e85a2ab834f968a3b71
SHA512 ab01d45e9a5533b80144af3cfe4676e57d29e98871484d4c4271fe0c095572a626477144799ef7b7287f3eec926efe9c0f86dba328ea04313a008821ace18b27
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.AugLoop.CBS_1.572.2254.0_x64__8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 178c586d2b6da1038936325d1ccb427e62b5a87a8d70364331c1c68000c6f145
MD5 43f5b56e39d8d36dd6e3868a471ed019
SHA1 51bee2516a18455a7d1842808a1efee152bedb62
SHA512 045423d989345af1eab71d105ce7216cb353ef7e3087a4a8921f1c641fa0d562776a5b5cb6b64675818a77cd1732d9807cd1d8da1ec3d059cab328fb717c40fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 ec36215fcf55f02cd46a2d963ca66f7fad8f7f28b34a67bcc59f584f358abfaf
MD5 54d4546f6c5017f829ff5f432145d474
SHA1 663e9ea2790772b1f91a6824800b9464fb47a651
SHA512 f35f592e24e25b2b02c5bce62747eda8cba79ba21dff3e966f7c512e12426cbbc8ef691eb5e04a64af07afe9397b7d956155cf1b3cca677f4804eea1bfc46ed9
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.4MB
SHA256 a55ae0641ff8b0c91bb7ae7c3aae91dfe94b8d3ba9a855e0d84eb40fe9ee5b4f
MD5 87f8f3e9e06c246f5025e1d128593575
SHA1 5f00a6c3955025fdfa26cf216a630c12a3d3368d
SHA512 5234b02c7befc7711dea1780e8a4974635c800b4a99834dc7e03aa3df482d8c5b5816562861fade0500aa6382b62128f3fbe11a62b187bda67021baa822ab59b
SSDEEP 98304:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabgygZ2Hb9t+2xu:BOOOjO4q7+zUhasygZ2ju
TLSH
T1D7B66C18F8824072E97B41B04DDFE2BE9A20BA229B014EDBF7CD471B5D23BD16535729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 749759f86c481f350d837c42a23bbbabff6fdb22c0480b3408d70a68efd41a36
MD5 dd0fd570713f45ebdd1c1bbfaa14592e
SHA1 16af1277c01d9d484f1f5e7c73d4b2e35410779b
SHA512 0b0c2e88fa3d7fc6b08776d351eab416a8c4a34759565885788e7e026e085d0517bffe2a155b80aa92391440f9c2ca5608845b38229e00e993a20313c59eb8c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\qap`g`v~dtlq
Size 10B
SHA256 71d275c7a74ad0fc2e72e2083e7022e49811adb759f68acd04764cbccd895c8d
MD5 0278a8f09216674ac043d414313c9b3b
SHA1 ea5f25865c307984f2a9a002958a646c425dd9f0
SHA512 c7d64ef237d580cdd1fb9460498b5a897a93aee5c7fe934849546d96d82bcb086793b5d655a3bc79515cf53e0c6cc7f0c3e8ec59eb969ec612691f30dfb97416
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 3cb1a7c220bb4f1d672f2d965e9fef9207e15d284761584d1b045a42d46c464e
MD5 0eb4eff467096f55c22f6413a0ea8878
SHA1 01371a085dcd5957e1322d56846f46e13da3768f
SHA512 5536a9ffa463909ee91125f0c09ac7fa7e37d84ad5043a4427e734accf74ad10a141884ea4155a4d84e6c878033219fe54062587478923cc7f05caf32d5cfe3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\qap`g`v~dtlq
Size 10B
SHA256 effb73d385c67fb46acf0d1977c1eba06a67ff6d69aa25b646140a6f78c4542a
MD5 58845adc21a700a3db9a4a638dd965c0
SHA1 1de88d675550f0b5f7a6e052e43a837e57941778
SHA512 ed66ab9286cb2b707bc8c33fb13ba0786a987174043a2906708eed4979125b76d370339fdfcb40ff52d5a371e12527e8c501ef847d99bce832e7a49a9c4eec4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f62226a665214d0d7aa23dd75156e5310be5d84d994f642c101b338b43e9bab
MD5 b77b636b099ae6b806f6964459a132a9
SHA1 f8134f76c1933f9eed2d1e424d9efd98b8bb7b7e
SHA512 d71756c8e3d1f0ca776d3ae5cc45b6a2f50a5ca8a69418005c3b7af074600385aea8f694d124d4b09f7edafc4bda789a3c678e95974c637bd3a1e103da300db4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61e8ed897f8a63b2d13fc76270efaa8b87c477109d204b8a0a83c57ab14b065a
MD5 18acd5577daba0e7eaaffed752be6afc
SHA1 9ad286a0b531f50aecf94bd7ce0adf7b95dd71a7
SHA512 a4683479bd1e5c4728babc1d393cf36667dc431624e7646a41102dd24890b9ee35c7745f6ff619905d08dfe88dfdaec60f8dfddca5b33225f6f984029d1a82fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73e8feec529dafc531dfd5e453adb76e1b388703b4401e14ee2b7e1541e94de0
MD5 9a53647319562a05ed49b7847d05c887
SHA1 4994ea499522f31cf1cbce9f6562793f516b54a0
SHA512 9da3aad1b155f48cf2dc76857a9e0d5bedf93211660b114182c98dac542cc139ad7b2cad6f0b9a705d6c40be643dc21b4dca943e25239678fdc778dab915edcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02cbd3c978acc4cae281f9ec47f264c855808432dc234bad836b066791534812
MD5 e3405e7a240c633d2be3558436eedcc4
SHA1 aab494e8f547ba604affb60beeab10e3ae323dcc
SHA512 fb0ddda1f58a98ffbcdafc10df9d798aa661f57dc25b96f98e1e747378b95a0b05d3299449c8b9c4c9e816f60361bdce21293b318f5436b6c02ea54bc9be4f7c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f505ffee5aca82dc61aefe3e1b43b19fa76c6add3efb4ad0c1e994c6ed14f1cf
MD5 c9bf345df69ea4f4584cb58e5bbeb6d7
SHA1 49df2eade72e12e530449f361bf14900755821da
SHA512 4bd0fc9bd8b0e4395409fe79076038ee0ee956d5ce64931563dbdafa613b6c24a093cb5c53622a86a5ef779c0c060e7961b6276c2d9b0b5a741ce2b20e4aecb7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 49a7d5797240424869e2cfddd798c2cb810c61e7da985af3cacd4f674cca87ee
MD5 b5d6c72ff4c1f34dada63abdbda350e5
SHA1 6536eb595c3bd18954a8474f299da5399da58caa
SHA512 5d435cf9468024dbb83381126c12f45bd8a5610bca3a28ee0f5ad6f4abee8fae3649beda292f3c36c90a1f64f56c0f96047d1de99ab9beb2fadfc91d711fc5eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5ab97d2ab1d3479840ef7a6a0b52f37a82ffb6890f34ed07aa45f106e5385e00
MD5 cfc4b1bc8a16ad3b9520eccfe8bea49a
SHA1 c88f5b75adf2fa294a89a27a64fb7a3540475576
SHA512 23fd8e38c143450538e3a8c8b87f3cc8b1a0d802f9021ba9f6a878ae34f2a8b68c07ab2d32f5289b3ec63ef24dd084fae6c396a5a2c50232bd912e36297ec62e
MD5 SHA1 SHA512

Submit Download

svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAACBACACCABBCACABBBBBABCCBAABACABACAAAACABBABCBCCCCB.exe
Size 9.8MB
SHA256 0b9af787c8139d72feae911df197ebbd7eeca94e1e4486d2149f4195be251e05
MD5 12e7eca4f1734d559a6d6e702a0218ea
SHA1 0f6ce7369b789b5c9a868650b5e7e1d639963d62
SHA512 043624f2e8dbc625354e930abac6cd4da68cd697cde678351234173f423202db4d82330fe8ae1f198404bce8de27563aae5a12f7f2598c1e568d81676d862afe
SSDEEP 49152:U+ES+E0+ES+E0+ES+ET+ES+E0+ES+E0+ES+EEDd79WCj+ES+E0+ES+E0+ES+ET+b:Dp7Yp7Yp7Yp7jO4q75Av7fbUhabg/
TLSH
T108A66C18F9834076E86B40B04DDFE2BE9620BA229B014EDFF7CD475B5D23B916534B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 5a10edb49bd580bf7d5e47a5ea1308a879762a45a0a4920774924a0ed620a810
MD5 cdcf23b8865dbb0da31f6d4a0532378f
SHA1 cb5a7631243b2e197f9869eb40aad708cbd493f9
SHA512 79035363621814dd4d0b17785233c2ee638ef3f7d8b5f04671c201ab3932542c3cba5ffbef06addc90c6b9dc12de1d3a73c88b3712cfda09de9ce9c8b86ba558
TLSH
T171219160B0A6DC57F13368C7EB25DBD70D98375BE8589F4412094218EBE9C36CE198B1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4c32df1e41e4fb69f95116e52951cf5530f03ba84a8af89207abacd34e28e31a
MD5 085fec7e75775f62885dbfff833ec215
SHA1 e46d8eb10f4a071c704f31b9bd17d1e52c3c2a4b
SHA512 4680060568f57fa891305f55fb3e3ef88b44730a1a0378fcbaf8fa7e648be548ba879512cff078d2af6ca5de0087ab10a1f341153dec8a2f11233e7f30e8e4e0
TLSH
T1CE11A050A0A6DC47F13368C7AB25DBDB0D983747E818AF542205421DEBE9C26CE159B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3656f5673470e57a3e0e188b19ea3e92bb9c7affc75fe04065b39ac1137f69fe
MD5 cdb5712f013fef149f9035a847dfc50f
SHA1 ec86044c9aa0553b69d4c02fa2a46d9bbe3a83d9
SHA512 1d107a28dcc850a59b48fb56da60ee2813bcc6b264faf3c236648099ae462b3a6aa2a02c7321a898ec1efd008afbbcfe5e6cc106c58cc70d8df95732a85eb89a
TLSH
T1B921D560A0AADC47F13368C7AB25DBD70D983757F818AF541209421DEFE9C26CE158B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-6-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2204-482-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/2204-63-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/3328-32-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download

memory/6056-2921-0x0000000000D00000-0x0000000000D21000-memory.dmp

Download