04a68bb370b5c7275e942c5eef532aaca32904c3c5cadd3fa7d2fc853552d3a9

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
Size 37.7MB
Sample260810-1qtxqszanf
SHA256 04a68bb370b5c7275e942c5eef532aaca32904c3c5cadd3fa7d2fc853552d3a9
MD5 bbcbfd4ccb65970560ff7149feca304c
SHA1 12bc4be1802bf7c46784861b4fcbce49066f3931
SHA512 3a17e5620e84ecb38b1f49b29c5e219b9fbe9c599ecc0c43880e97b30b94ed8d401194a903451dbcdbf481d6ad6bb349eedd561c57ec29a2f8c9bab9131e3e09
SSDEEP 49152:U+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+E+:Bp73
TLSH
T181874B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
4380	svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
5656	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBCBCAABBBBCAAABCCCABBABBBCAAACABBCAABCACAABABBBCBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe"	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAAABCCBAAABACBBACBCBBAACCABBCCBABCBABCCBBAACBAACBCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe"	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5832	sc.exe
2160	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3536	cmd.exe
4552	cmd.exe
2924	cmd.exe
4384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4300	schtasks.exe
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
4380	svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
4380	svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
5656	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
5656	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
Token: SeDebugPrivilege	5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
Token: SeDebugPrivilege	4380	svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
Token: SeDebugPrivilege	5656	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 3536	6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe	92
PID 3536 wrote to memory of 3664	3536	cmd.exe	94
PID 5940 wrote to memory of 5332	5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe	95
PID 6092 wrote to memory of 4552	6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe	98
PID 4552 wrote to memory of 2160	4552	cmd.exe	100
PID 6092 wrote to memory of 2924	6092	2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe	101
PID 2924 wrote to memory of 5832	2924	cmd.exe	103
PID 5940 wrote to memory of 4384	5940	svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe	106
PID 4384 wrote to memory of 4300	4384	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bbcbfd4ccb65970560ff7149feca304c_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAABAACCCBACABCBCCCBCABBCAABCCCCBBCABBBCCAABBAABCACBBACABBCBAABCCABABCBBBABBAAACABCBBCBBCCCCBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBAAABAACCCBACABCBCCCBCABBCAABCCCCBBCABBBCCAABBAABCACBBACABBCBAABCCABABCBBBABBAAACABCBBCBBCCCCBCABBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe" start= auto displayName= "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe" start= auto displayName= "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAABBCBCBABBCAAABCCCBAAACAAACCABCCACCCAABCBCBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACCBAAAABCBCBCBCABBCBCCBAAABCCCBCCBBACBBABBACABAABBCBBCABCAACCCABACACBAABBCCBACCBAACAABACCAABCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBAACCBAAAABCBCBCBCABBCBCCBAAABCCCBCCBBACBBABBACABAABBCBBCABCAACCCABACACBAABBCCBACCBAACAABACCAABCBCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCBCBBAABCBBACACBBBCCAAACBCACCACBACBCCBABBCABBABCACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 1cb4e72c128dda436ddf84dfed19b57910fe200e0dfcc055ba97dc1214fe3ebe
MD5 363304fe7a75be0e594ee713cb2cf62a
SHA1 b923e97717884949dff79ad9176536988c92a5e9
SHA512 97e79828cab730a082257586d820114249bce275546d3ab4f80bb026bad21a3241bc6314b1b74d372bd26531897651b170cf95704d65ee4e765e2e732393003c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft OneDrive\qap`g`v~dtlq
Size 10B
SHA256 2c1cde7402db707de49013b734364e00ad3a3262ee028ec544fb0bdca332318a
MD5 19b7c248faf57bad9418255b547dd345
SHA1 9a5b55755320f0fe71beb278051b43a5341d0598
SHA512 81e63d3decfce132ddc391425a472afc5f4520deeb995f44da621dade8d0080e9589ffd4bb2183c8392fbe375454e3ab79dedcefaf1101a2fda00c7ecb19ae11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 ae233ccefd0da99488e3f7a65cdac2f8787d2cf1fb124032b861c6c60d9f0d2a
MD5 0ae7057951745bafbd9d107b6728c9d5
SHA1 0848de5545ce6186195cf9f121c0e6db39754736
SHA512 622ed69e01baaf9e2a57453e3d15fcd59637900996896cc3c500efd401bc28edee2fa069fe38b3f67068810f52704a3488ec7bd640aa9af6f05b6c3dd350d804
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 8da6ffe187f885d031aa57edbb971cfb045bac0d74e7e1f30b7187ca7d0e402a
MD5 9e249174b54dbe7f583dd6daba90216e
SHA1 cb49dd622463037e61d35aad0d975c711e3b9671
SHA512 f75657f8f28358fda07ac1f90df7adabff966e0da0c43542598e44cf35c3c8c82ae82f2d5e19e3e6275f214ffa5ea58dc0f8d70aa5380638dbee3ad18ef369c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Scans\qap`g`v~dtlq
Size 10B
SHA256 484b0d151112de66d3274427522de70aa044780891b38dc19fcd904b6b51677c
MD5 28a91785d4cf07b240f1b739edf1af1d
SHA1 392beec56190861f8f21ce1f6b241aa2d7c9e0d2
SHA512 f85789a39633a4389b2f73f8ba1e41bbac2b545aade0e6e77d6060cc0127863b80c579661b8cb5fa7601c84cd3835b05bbdc78cc6d4d90b3745ae56e592d37e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\qap`g`v~dtlq
Size 10B
SHA256 07020bd791cfb143eb180a10c753bfd804ffaa65f29a369dd0c8d2d726996fbf
MD5 111e76dd6b9ffa21a8c7440482898af8
SHA1 8b17ad7067a93e55993f2e89e4effe8b7bf4f332
SHA512 bfe16eb3c5d0e6d0919e31aec0d0c5a0f7b89a8772b90086744fccb7f8e137c536628199042cd526730eeede175a3c60203753d1564dedeb32197b31876da24f
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 38.2MB
SHA256 f848e462c356126223bba83c874cd3440562fb70737be465f61d2d962042d468
MD5 f95b67393187f4d480dbd4b70f6f4d71
SHA1 92480d1a5ba7637377d139a9133b8e1b0a7ee21b
SHA512 fba33a7fd2822da39e11968f4973cca580f6b1cee3b8ead9b8ad026c7817fa515dd5587c5c8393d06f8960253947304cf73a14ed83005f89169461404d2cd5c8
SSDEEP 49152:U+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+EZ:Bp7qgZ2Hb9t+2xf
TLSH
T1DF975B09F94340B1D92B50B04DCBD2BF8A70BB2587128DF7FA8DDB1B7932BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 883294313d77ce947d9785ffeaff3e4ddf295dedfb709969fffcfd629c31866a
MD5 453588754a32e3e3fb8d69f62aef014f
SHA1 9d9f2731d6a6dc449be17587387f1152be73ba2e
SHA512 4e4d4c6d90871ea7b167d644e45311b746cb5881f498b0d752ec31146dcf830c45e1ab3e254c9580474f88eeb73e55c3e49fb535c195d85de01ee4cf72c22f3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\qap`g`v~dtlq
Size 10B
SHA256 376ca544f16f023e51fff33b429e557ac93c6f9d7c021993ee41c4fe5d876b85
MD5 2244820b925dfefbf1bc66aa8d86fcb9
SHA1 273060c6777ed9cd64ea96e3b85404b6fc01318c
SHA512 1c9dd7411f81f97f2255a850de861852c1349113d5dd4efd82a53097f1c60c1b2a94a02c5b45bd25a82ffc439baf4750beafa567ccd9fa18c14100f6e92c574a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\qap`g`v~dtlq
Size 10B
SHA256 7235b0b1df39084777bcdcde68ffa147d9f5d69478d63cb110679b07361151ac
MD5 b034ec02c549f9b650b0305ddab61437
SHA1 ac5b3c16b8f8fc3dedfe1c5d4a4498ae46c19c88
SHA512 4a19310921480af394dc7186d7de4101a1a685d23f3265209a585b44965278657ea07c217cdde0169045630a4574d6d1b7edc333ff8ecdadce715739bc8e67ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 c659ab1d38f977df5f658b091dcebacfa36a32dd2afc49140fe7cec5844d53cd
MD5 ab32b0fa3d80e375b002c25f362a2892
SHA1 e0379168854bf1e8d82aadae162b21978cbbb0f8
SHA512 e231f66ba5aabf5c5bab89334d7d0b463a5bfcb6cfa7a56731aeb7b076bbfd9d2873522cf67460e4828aee671ca429004f26f3fca38ee38d1d5f572da8e6e2ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 3c034133a1932116593c44406abff37fd7534c9e36139a2e04e11822114a1095
MD5 22978b49723a77503f4af21434fb9686
SHA1 adb5d7d893be0eee8ed2f97f3709d023a750ed69
SHA512 5a439993d4c260439796fbefc1ba6e89beed9cbe00745e3b525015a78997bbc2751380e0fa7afca6cc85d3d764de257d8bd4be9fc999591a79b2f9ca158e5ca6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\extensions_crx_cache\qap`g`v~dtlq
Size 10B
SHA256 c254e70306ae204ac28a9daeee48075118ff1a231fb91ac80e89a6f210ca10c8
MD5 580ebba0b14cd4ebdee50bdac8631b72
SHA1 88605bfb57532dc3cce144f059cf5040851258c5
SHA512 7ae9f72dc94181ebeb6bf89fa5db37772ac33c115bc9c0f1df965175571bb427f9443a4c1f611cb6423058b448aa81db0932ff9c5743530fbf16bcc874389a5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 a127edc581194e3d00192664de5008ec0242cc4055bfcc00b31d3e2f2c75e2c2
MD5 9c24f12eaf92df12c350fa9b167b52dd
SHA1 9edc3fdbb7040b5971767817019e3fb93de69d05
SHA512 85b536446b5ef62533e52596e0243301f13a1721cf8bcecce2256f66dcb815535b6a2a0c54dc7feaf31f0dcfa8ca4125a028179e6040de1354aa1c6db58f8c72
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 fa30377d54c6102e0c0f2ce02ef8ee24d0e8eceaf320138498cda3ef34a8fb5d
MD5 1bff467e0af282fdddfd78ff8b67d31c
SHA1 75035a433d0788492e172cdc117bb64615ae90d5
SHA512 9e35486252033e980896543c9083ac5de7dfc0d1698d241489b7a2bbd1ff8bd2049e9a8a81d69476d911fa892f8624e85f41ce5374ef7132c32671a6623edd2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d718a0d15668194127ea4b0f04b50072b27257edfc81db06ff2ae1fa94e946f
MD5 043333926fa3a7ff8257471ac86b8743
SHA1 d52c2469ce37cbed3e50dc7dd29f1bc71fd76fc5
SHA512 4cd3d7517892810f90d9683120f984f53606ddcabbd650659cc2c007fb6f42fc8654e11196faa806ef3468b41a67265f731b580d32e36856ec38797c141b3ab6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d75341ee496202b6739bb6fff91f9f672afbe962d99088e36ed70c2f5c8f62d3
MD5 c43d5ab506323f9e323826c06cc88505
SHA1 e4a09481e5cb2adfff2f95916f672d1ad2f9c381
SHA512 a24f94e95450b04e27d332493b0ef11f2d2dc90ae4db49f9c73574d497fee68ed14f30135c6aefe7cd0880bbfcafab4f0804e247f3814ea12e090ace657f0d25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8334f936128e1b5e3ed03a30fa3d4fce8835415b65ded29cabdda90a6ec39806
MD5 a878890e2277078c8426f4c0f8769ec3
SHA1 237315530f300a1440169620c8088bd2a6c0d13d
SHA512 9fd903d33360e87c63373d52fdde152f9dd066c95171e3774a3196e0b4f35b56736f3aa043a509f1ebee30d4ee9ddd80f40bb13fff5f024a2514692478c14cb5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 08380f6808b423637ae86d904aad4866441e22f168e664c94b157d22be196b14
MD5 f07f971a59234f06d1db85492fd7c9a2
SHA1 61d1dcc985e6857866fe7fc30071dbd7ae69323b
SHA512 b94a255ab3db5092e1e080a44c63119a15e6bc748305c09800dc096a3d8bf67a2d9091f688bdbb4c5ea8b301d4c93ba5a72e5b8f0d549f63feb29ca918981ce7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 550eb443b493fbad6de63b25729d0af2961580256da3b4ccf39a793d7276eb29
MD5 05d789adaa73447b366b4abac33829de
SHA1 0da4ab19e89dbdfe46093851d077c949074de18c
SHA512 180b73bf331fcb16c538020f42a52089128304ce17c67ea9602130f787c3b14a11e00b84e72edbc9a86dbd9726ba25175936e6af729b96471c3ef2fb26f63847
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1403b878e47bc0801b1fe3bac2471d8870b05301d86ee0538ae8e096c0d1126f
MD5 5ae10cb2e088cf5eef5a0bd1f74ea06f
SHA1 457a5f7ed49d0bf279aff3495491da500bfb747d
SHA512 631d46d9abf7c2560d4d6f71ee962db4b540f564b42ed03e11acee694678126d0861980726ec18d32f29827a984e915709db9de34e40f63a442829eef5ea70c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e1de79d067bef0a24e5aa2b3b8535106444686f0fafb1d4c98b6475375209e32
MD5 94bc0ec818fd7f53d1c320b87557d158
SHA1 1b04c4dc4975337195142e700fe1d3d51110b35b
SHA512 d3b318d6b052fd0d2ee0d741b8863c3f719eb2696a568705ea5b11f60cd84c6504352db907496e7fbc4901abfe0134579e3564fcc9b3e12446d361629e27c1d3
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCACCBCCAABBBBAABAABACBACABAABBBCBBABCABABACABACACB.exe
Size 37.7MB
SHA256 04a68bb370b5c7275e942c5eef532aaca32904c3c5cadd3fa7d2fc853552d3a9
MD5 bbcbfd4ccb65970560ff7149feca304c
SHA1 12bc4be1802bf7c46784861b4fcbce49066f3931
SHA512 3a17e5620e84ecb38b1f49b29c5e219b9fbe9c599ecc0c43880e97b30b94ed8d401194a903451dbcdbf481d6ad6bb349eedd561c57ec29a2f8c9bab9131e3e09
SSDEEP 49152:U+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+E+:Bp73
TLSH
T181874B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 4bf900eb9149ba467c6d78bd9c89f2f1452dd5a93397140f346eee14bca7c160
MD5 de578532fd6d348c4490e2a859e82166
SHA1 09fbd32a3abf030eb11f33de13d2135ace523700
SHA512 cb11033452bd17ba67f8457c4b88ba2152fbaadb610dbd6d313ca25e1021b6987084f6c2296ab59fab30014968718f7b6d73a32ea0daf0b50f5c63c402846b02
TLSH
T14421F751F4EACC73DC3368DBA619DBE24CA837DB9C9C5A0453099218AAC5C328E5D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ab46776de28721133b590fe9d90652a4be631761910c514006ea711a14d438d1
MD5 7d1fa401d45b57a909e9c5fedc699f7c
SHA1 135960e17bac5bd9baa08736fa7f812648597498
SHA512 3be3cb8702d7e30e635614e363e3c1fa6cc02729552d21f0c056c3b54b5682f14edf2d1de9aba72c34c27fa828de7b0ee54cdbe0a88e08d5a43c87d6103fa501
TLSH
T1EC11EB51F4EADC67DC3228DBA61DDBE24CA837CB5C5C6A141305911CAB85C328E694F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 3ab27944de477e7549373ff7537a11c81410ad1219ebf46ec98c0bc6f089eed7
MD5 0e0e550d2c5b690d1e9c0b2455904cfb
SHA1 a92e2a9d7ed2a62de5faab34597bec162314024f
SHA512 eb50c879f8367f06ecf2c87fbb1e5dc4668a63642bbdc4c566ac5c4b21d252e8752dd90e6b03c098af76c487e3e543ce06f7fb9e5cf351828bc79369b5c2ebac
TLSH
T12E21FC51F4DACC73DC3228DBA619DBD24CA837D7985C5A1413059118AA85C328E5D4B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4380-77-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/5656-1073-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/5656-2801-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/5940-33-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/6092-6-0x0000000000170000-0x0000000000191000-memory.dmp

Download