cd6c152ffe219844fe7de0f8a92926865dbc398e700f7c5cd4c56234e5f55700

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
Size 18.7MB
Sample260910-cjpgnscn6s
SHA256 cd6c152ffe219844fe7de0f8a92926865dbc398e700f7c5cd4c56234e5f55700
MD5 e4c0e7f0d6fba7ecdb8937912d17b4ed
SHA1 b5830d7d16f03587f9a3390358315d48c581882b
SHA512 75fa1b4017aef1fab511e3ab2456b8262a6d33b17c1571487f42c8c60d4a08c4d974beb59a12f47503846cdf6ea81b805457ee2e95b52ac072857ce247983b25
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECiH:i+++++++Nn7O8
TLSH
T191174B09F6DA04A5E977617049E7C27ACAB1B9518732CADFE244C72E1E33BE0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52d-18.dat	UPX
behavioral2/files/0x00080000000182bd-394.dat	UPX

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
4076	svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
2616	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACCBCCCAACBBBAAAABBACACCACBACCBACCAABCBBBBBCCABABCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe"	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCBABABBBAABBBCBCCCACBBCACBBBABAABBCACBACABBBCCABAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe"	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4364	sc.exe
2032	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4128	cmd.exe
3440	cmd.exe
4248	cmd.exe
2912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3416	schtasks.exe
2172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
4076	svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
4076	svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
2616	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
2616	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
Token: SeDebugPrivilege	4076	svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
Token: SeDebugPrivilege	2616	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 4128	2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4128 wrote to memory of 3416	4128	cmd.exe	94
PID 5824 wrote to memory of 4316	5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe	95
PID 2392 wrote to memory of 3440	2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 3440 wrote to memory of 4364	3440	cmd.exe	100
PID 2392 wrote to memory of 4248	2392	2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 4248 wrote to memory of 2032	4248	cmd.exe	103
PID 5824 wrote to memory of 2912	5824	svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe	106
PID 2912 wrote to memory of 2172	2912	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e4c0e7f0d6fba7ecdb8937912d17b4ed_coinminer_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCACBCBCCACCABBAAACCCCBCBAACACAAAAACBABCABBCBACCBCAABACABAACCABBCBBBBCCCBAAAABCCACABBBACCAABAABACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABCACBCBCCACCABBAAACCCCBCBAACACAAAAACBABCABBCBACCBCAABACABAACCABBCBBBBCCCBAAAABCCACABBBACCAABAABACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe" start= auto displayName= "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe" start= auto displayName= "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACCCCABBBAACAACBABCCCAAACBABBACBBCBACCBBBCABBABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2032

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABACBBCACBAABAABBBBCABACACAABCABAACAACAABCAABCABCCACBAAABCBABCBBBCCAAAAAACAAABCABCCACBBBBCBCAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAAABACBBCACBAABAABBBBCABACACAABCABAACAACAABCAABCABCCACBAAABCBABCBBBCCAAAAAACAAABCABCCACBBBBCBCAACABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCAACCCACCABABAAABCACBAAABCAACABBAAAABACCBCBCCCAAACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 235b3428df3b0398621bd0014e7ad1d6bd665aa375b959a74c1d55d59074b00a
MD5 4e88b70f9305f6e5dda9fc19462bb553
SHA1 3188b3c788ec4628ce3cba245d9e6918fba2e15c
SHA512 303a49fa60088448c816332297a0306028ec214e113ce96c95075876f3af60223dee5633a8c7c03d13a582a6d076d3df4efe3d53f0218ecb9be60a58be06445b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 68acaeaf5fbe27fa9c06a0f9f192eaad79e5708f8916bda2f426f7fb0d66acf9
MD5 5a4ce3b9356e93be3946c814f80f9630
SHA1 23dbdb86ee42d753413722727a9e63e3e68e4ab0
SHA512 583168a8eddb7e061a8407027e10056649cf773545a5077158fe0e1cfee332857bf69debc5715fc7b3f9b51d928e4bb7f56265ec4912b99fe1348cfb882ae930
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.21302.1000_neutral__cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 c7581dfab49cd607ffba13fe463766f978813e2f0bafec0cb01c70a00233e124
MD5 bd18cbcc8bf146fb6a2744f57ff35414
SHA1 4c3c11482cafbe94dca36e9a2a6c5cf68f6448d8
SHA512 57e12c3a5692b2c960af587a181ebf92ac1ec0fd3ee43d7c260b6a9cd7a54c01cf0fbf746307147b424ee249f133f7bbc9a59854539ee1c0ad8f6a806b8ef13a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\AppRepository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\qap`g`v~dtlq
Size 10B
SHA256 53b3649bb187cfc7952cba89d45e6558297eab57fb05dd82519a8e3611209440
MD5 1cde41dd9794b9b0ea7b0cf6ed0f6840
SHA1 03a9f716dfbadaeb831b29f3aefd36418c92acbf
SHA512 acc88037e46ae37bf341e8e899ffc4b84c8c85f3897c0b0993d2d10a83eb209331b07b19b0e4afa84a13ba8f4a2ea78576138d6f9a3861858c6e6b5e7238ae8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 d01c5eb14913e6d1524eb5386aeb7bc37717fb4c477d10b193a1f35fd2b5beff
MD5 02a14e68fbf03e2684fa3affabc92cf3
SHA1 de70dcbac1e52795e754bc797c8f7300a4771702
SHA512 204850eb89b9e884d9651272e591ea37f5c32b80b24a13ae21482af46a78ef780a739f315f6085abf0c982e5de937fdb4e606e9bee5e3ce18e603bb89868f85d
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 19.3MB
SHA256 bf1fa451c5dfaf672ed1ce19ed1caac5f7f2f3373074c6aa499e00d41391dc9b
MD5 08de3f15da1ef574ff45d62781906b58
SHA1 517641ecf9371c2188e886cb92798e60631851e5
SHA512 098cf8583df4ebe168c16b7a459f3965fdc9e6b3ebdd8bb642e5e0855f76504a39553bfe7f8bd080aeec472d5e2c50f57590bdf3f7c3aca63fb060cbfbd919db
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECiu:i+++++++Nn7ObgZ2Hb9t+2x1
TLSH
T1C5174B09F6DA04B5E9B7617049A7C27ACAB1B9518732CADFE244C72E1E33BE06C34715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\qap`g`v~dtlq
Size 10B
SHA256 e32a1d2a68ef7c7a7b20a978d6878176814ee44ce1b1983d809b676f94858d51
MD5 14ddec0535e183251e5dd59d551cdd48
SHA1 5fd90c48b03c1b784eda3737783229554e0ce5d8
SHA512 2ae6189bd98484fb2ea7cc0b5acc227a36f9da4b582c0999f18f2387f9bdf4031fb47f81970e87aa71a1c055590c5c4ddb5aafdc042f9ea119e697d07a97f33b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 3a84e00c07ebb6d8761b6e22324740544ceec04c376bc0d5376ff7cf63a36b7e
MD5 85a0d04ed4bb6fea2569d5ca54411df9
SHA1 a31cba829db8a73a95bdb8eda908264ea691a3c3
SHA512 95414af5bca79579707f288a056f6262a70a95a3af82afa33f7807e94b16d1c6cc45f93f207b397f026e5301436b3bb2898ff9a821475a8d3680fd80135c5f78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 31bb73539e8ed84a0b60ec8afbb667d22eb678b1bc36974d8d4f2a7c0151cebb
MD5 ce05624061066910944c780eded00df2
SHA1 207cf744bc930b4375289245abbe3771c89b8e34
SHA512 010a93fcf13133dcb85c9b32cb673a07793931678019994fb9b9fbc4ef68cc7c8af43ffe77c7cd258f96b4b76d9e4e7b1693f95bee9396c7e36a082dc32381ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 c100bd7b58d4c5c1768ab134fc88a8cf8a5f662736ef8e9002a4ac1738651055
MD5 b6ac777c39784fdb05e9800d96658044
SHA1 078ff2c0236b0272af297ae407f682e6460258f6
SHA512 9080669a20e5df7f35379895c2ab3a159b80ea61c885d610e3814552a129b4dee570197d8afd720c38c6d33a8f5c4ba71903080756c9b53daa40818e0f8c3f3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\qap`g`v~dtlq
Size 10B
SHA256 ed6a6db0ff8de3e5e5aa8617e840545dfed06ea6963add165986105ae16c3d8b
MD5 6667a78cf76bce240d78d1bc74956950
SHA1 78dade22204b01d90057bb68f139f5df8da876dd
SHA512 418b1c706259360cf4b8f2a5051eb92c391c938385828076bfa60db73b29dd7a3811d102ab193e92efc22b2221aa74a1d3ef0b189d5abdc17934508ac9207980
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 2ebf4383b460852fb8056146df148422b44070816556c299e438523244ad0a74
MD5 62b5ca02094c935a1ec72c0492c8bfa6
SHA1 fa979ea901df52d26c406025c4598a368879ed66
SHA512 d866df07a4e3cd6e3776e4176086ba6c440444854d86d309ee0e47b72fac1e54c85a993c6360fbec25553726095f9dfaa4dea0385f39eb3de20c9f074e251c32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\Backup\qap`g`v~dtlq
Size 10B
SHA256 df22925d47b0b360247d9bd61745df1e150bc57b26d410008187c7b4d6546c93
MD5 6073fa9620cc5bed215cf8a023bd9ba4
SHA1 9543fe45dac39ff924e951a6285526d6913d6c52
SHA512 3feb4c1250b2277ab60bca46ccce24e83250b81f16017f0562733a5d9d040ec8b86f293db3c0c2dd5cf7cf3009ed1e87ed390f1cd3cfcd60fccb88af4222e038
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\qap`g`v~dtlq
Size 10B
SHA256 1eec6ddc87b284155831c936d238096b98118c89fdc3b57e88bfa43d4fb2a82e
MD5 ffcfe666890695ad1cad52190ed4b85c
SHA1 90028eaa799fa8409e53fbd6840a35f0a541affc
SHA512 d9f5f09c5cadd95d3febf3252487f03ed2e23e39b5d3d73b03520b2287b4cf987d18550495848f82812404d90d22fde1e17379f80bb04a078edddb30df844703
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae58c81cb6702b97b25aa7a614cd9032965ad7dea679c550fe013371fd59ab08
MD5 3bf44712e54b1ed341fc430a7169f853
SHA1 90a14d50907b975afc38fdba08b50af45eb4bda9
SHA512 b48875bde6ef819a58b67084be0ab9923604bbcbe7cb36607fdefa3336b2e4dbda53298e95b6e25b9114434297043e3076880b4369f19471c87ae65928c5e327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2044141dc64e8b9ed3121c2718ccfa0dec9fc252d4ddb7c2387f623b94f3b429
MD5 f15a82ab8f9918cc0c222595cb85f305
SHA1 a3188ead4f17a80cf8fa830653168cb8929606ac
SHA512 52620629d1c11fbd2c44fedad25ed5fa10a52fdb474670f96268f68503ada02a4ee1d7e6a9c0efb59c553ed76627afde4a85944d5fb68a3c851476ed4803eda9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 576860e87c606258e378aed21a1eba12f5f5b515c3c79324d93d459971993b89
MD5 c1655205641858bbb91c50062a0322b5
SHA1 329a83040e3f372383a290d0d36a6897b7769f7d
SHA512 0c9764e70ac1f83f5fd8eab16a2c726664f68bd6871b174bd30e0b35b6c27956e9b8bb71f4408d9a53cce02b8434414df1a311807e4bbf7b628939184f1fdd16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 98e9d81ad6e24f2ce38c90ef7128145baa5e9d1637f82c7065adcb162d306c3c
MD5 8cafb04a453fa8a157104d541bdb1c69
SHA1 4380e2c5e9b4822ae537e939595aaa5288638146
SHA512 6d50c8a715c4b45332e8d1590e83ed8f05b3d453aa6f1e41f04337487f1875627c5b9fba7a5c1226c739585430586b32d2fa11063cf6b149785c8eb42e572bd7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c486d54b1b74eb5fd6dc1229faec60a5e11e5760f9f4b05c6501ea2b5b1d9e47
MD5 04cb72b238c70d03c33ba65b3f929dd3
SHA1 02583069538ff004d8299d8462d7f8678b5c26f9
SHA512 495030fea7f058f31cc2ced58bb19acc6670eb010495176ec56229350f9f02911e91698295b63b68f52fb66a6e88545f415e094b3aac7a3d945f4839bbe453ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9605ed53ed28d7823fc3f6d3df6b2c983f767533f127a1751ef775721f1e255b
MD5 057486d96b6532c225b6fad7365cb711
SHA1 2e4952ada6908b597754de1eae87d9483fc04158
SHA512 0253259dcf34dc67c882b0ae92143f7312e257a9c694f450634d29f0351d60a5ba478c620a1bd286b075923b0a328533d7be4bda24407a4b6f01231bf2eca48d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 af2650b73d2e1c955dc4cd1a895f15ec7626ae9eda4dabccdc75cd5645d26825
MD5 59a570ef9ad2c8fd58ad3b6c1acfeaa1
SHA1 91194b2eb9f7751d1702cc2a64133444d49e79f9
SHA512 0a5476f6aa9dc55cd9e21486dfed11c7cb895ba25117ef7a7b04e034f4339b9746af0e514708d6e5527a90272f40a9a5421b808c570b0717dc7a52a1f9788506
MD5 SHA1 SHA512

Submit Download

svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCCAABBCBACBACCBCBCCABACCBCACBCCCCACCBCBCCCCBBAABBCC.exe
Size 18.7MB
SHA256 cd6c152ffe219844fe7de0f8a92926865dbc398e700f7c5cd4c56234e5f55700
MD5 e4c0e7f0d6fba7ecdb8937912d17b4ed
SHA1 b5830d7d16f03587f9a3390358315d48c581882b
SHA512 75fa1b4017aef1fab511e3ab2456b8262a6d33b17c1571487f42c8c60d4a08c4d974beb59a12f47503846cdf6ea81b805457ee2e95b52ac072857ce247983b25
SSDEEP 49152:U+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2/g+En+EO+EM+ECiH:i+++++++Nn7O8
TLSH
T191174B09F6DA04A5E977617049E7C27ACAB1B9518732CADFE244C72E1E33BE0AC34715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3aca27fa9c428098a2e30ee86e48510a251c5c940e2790ba9e9a42ea18186868
MD5 e4bf53ca1ca9582e873eaf06839877cb
SHA1 797ceadc0153734cedd4e7b31ba552095ddd9e50
SHA512 f8806a30cf3cc651768449c4ff37991082f61eec0414ace5d2018005a8f68e253c019d299b7c8177f09caa07a380de8328c47cb8d541f000a3d13ee29f26ecec
TLSH
T15A218361B1B5C827F522A8CAA219ABA71CF0379BEC5CAF14630C9218FBC5C35CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5b9241ebdd8c6387e13054ebfb5e9e1e7f82386fa17f12841b954615d0eaf33e
MD5 cedc12fae2c1c2d5949ca20d672dd039
SHA1 5da81dbd8638a5368f7ed6ccf758074e9f94083e
SHA512 e366cfcbb922009858ca1395c42bdd8995f5639d036d99ae9910bbaab309e32ab592db1b2ccd185a4f3a50a6b97f9fe1512cbb7d40327fd0b06d607919688eef
TLSH
T12B119E61B1B5D827F53378CA922AAB6B1CF0379BEC18BF146308821DEAC5D34DD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0a21e6164685c7857d95e0eb18739889b2f51d864ef3f3df56b412665e871264
MD5 4b2de3b5dde27070f409a399e6c7f02e
SHA1 e6d2c9058d673b02d290b1c2957a310797db6b46
SHA512 ac8cf9fc9e501717c952e426273a0b35a7feacb261f3ab02a3f8a27fa18ef684a981106338e65ffe0c7bfece52d6345aa60ca389cd8091bc6fe5ce450446e37f
TLSH
T18E219661B1B5D827F53378CA912AABBB1CE0379BEC18AF142308521DEAC5C35CD154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2392-6-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/2616-1542-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/2616-3949-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4076-72-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/5824-33-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download