e78b246b42d441e07b73c167d97a7c296191a996f21986cc377a483068e47e9f

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
Size 34.3MB
Sample260811-nmvcwaysf1
SHA256 e78b246b42d441e07b73c167d97a7c296191a996f21986cc377a483068e47e9f
MD5 2b19de88a9fc19865b1cd9e2c09d0685
SHA1 86e9322025796640ec0a7755c4d0ba9f5f4886c3
SHA512 7fde7b23de872d8b9cf4953f77cff592974001880f2a9cb331c0ba44b9760a6e2de2a2c54ca50871e5df474797b319d4600453d984d3c8c69ed2f7e846469982
SSDEEP 49152:U+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLEU:ep7V
TLSH
T181774B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
916	svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe
2772	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACCCBBCBCBABABABACABABACBABBCCBAACCBCAABBCBCBCCACCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe"	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBBAACBBBACCAABBBCBBCAABABABACABBBCBACACCCAACCBCBCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe"	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1432	sc.exe
2020	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
616	cmd.exe
3600	cmd.exe
2576	cmd.exe
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe
3160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
2772	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
2772	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
916	svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe
916	svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
Token: SeDebugPrivilege	3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
Token: SeDebugPrivilege	2772	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
Token: SeDebugPrivilege	916	svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 616	4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe	94
PID 616 wrote to memory of 2868	616	cmd.exe	96
PID 3544 wrote to memory of 944	3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe	98
PID 4108 wrote to memory of 3600	4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe	102
PID 3600 wrote to memory of 2020	3600	cmd.exe	104
PID 4108 wrote to memory of 2576	4108	2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe	105
PID 2576 wrote to memory of 1432	2576	cmd.exe	107
PID 3544 wrote to memory of 4132	3544	svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe	110
PID 4132 wrote to memory of 3160	4132	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_2b19de88a9fc19865b1cd9e2c09d0685_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACABCACABACACCABBACACBCAABBCBABBCABAAAABACBBBCAAABABCABBACBABBBABBCBCCBACACCBCBAACAAAAACACABBCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBACABCACABACACCABBACACBCAABBCBABBCABAAAABACBBBCAAABABCABBACBABBBABBCBCCBACACCBCBAACAAAAACACABBCBABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe" start= auto displayName= "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe" start= auto displayName= "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCCCBACBCBCBBCABCABCAABAACCCBCAABCBBBCAACBBABCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABCBBBCAAABBACACCCBAAAACACCAAACABABACCBABAABCAABBBBCCAACBCCCBACBBCBCCBBAAABCBBBCCBBCAACABAAAABBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAABCBBBCAAABBACACCCBAAAACACCAAACABABACCBABAABCAABBBBCCAACBCCCBACBBCBCCBBAAABCBBBCCBBCAACABAAAABBAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBBBBABAABCBCCAAAACCBABAABBBAAACACBBCAACCACABCACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 50d19fc7271ed5d2f59ccda2d44f51304a316d80e09c4bfce04d28d931a55f90
MD5 5f338e55e4b64ef3f744544bfceeee1e
SHA1 674e6f8571351998aae342c53f972ede3ed8dba3
SHA512 cee94869babee2ed9c29b4938e8dddced30789f4dc673732248b30209424dbac4549f68070c793d6992314ed866faf0c44ec8552ee8cacb3eb99ab202544925b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows Defender\Platform\qap`g`v~dtlq
Size 10B
SHA256 45747a85f4b9d1f25e401f2790d4f24017149242128a1de4c45c467d6b0d9444
MD5 761348d8a848738c35839e25c2f9487e
SHA1 73c4ccab48d5dd8951d32ddb3e5a9e3e436da777
SHA512 9ed53e92dae0120daca737a4bb835a4707884ffb613c8a1bcd0bc77884f827272de04a90fcd1773c3d62de124cd9f69dddc259f426c786f5e77ae2b2783003e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 8b4f8e397bf11d17f9135459e8643c141b01f5bdffafca8a6763e01aade8ddce
MD5 3c819a2ff042cc71d6b61a2c019c72ee
SHA1 e96b592f9b5f2379f7ad7639ad363c1bf0bec852
SHA512 81dbced100cf6856878e490f38f2182367b9034769ec69005bc440c82743184e883fde3f7349e9920052e97e204de47e92e527f934298cb05b1ccdab017b59a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{4C903F19-B4C3-4D0C-8CC9-D444C511AF1C}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 3672f507a4d6145f61f40c4fed48f70cd270a44196969c16ff30c6a60b15d036
MD5 e0a501feb887247b20c007e486a86195
SHA1 cf4ab0b7830749ad986debb1629788d1521feb33
SHA512 5f7a6459911b1a3c6e7ffb434502f2139f57943424f19410bba11ca682cf134ff877dd55d5dce9f50e8d47474e54619f10ff4f6795cfb10b6da485a34fe1a4cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 3bc6dd74ee14ea411c4e0998b89ef1a5a5c9d455d175cd6213347d51295a601f
MD5 e6a196d768c38bf81b3c482336c6dc55
SHA1 de6d49eee09f90c96b79862635b62c927f33de29
SHA512 f549b8a067a81b833669abce928e8d1c36cdbdc420175282e476250ba8c71dfe4a6b41d3ab135ae35ccd1aeaa613f787af3fb7fa058a6e498ea3d7070bad850c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\qap`g`v~dtlq
Size 10B
SHA256 245ba4ff69e66d3eb2242dc519f86b413d97a75fa3e70ab3de933637a209701a
MD5 99120563ff9543fdda1fa6618f26cd58
SHA1 48d5ded5284c164bf0b944ebdcc7139d00c2407c
SHA512 c3afd9a906c5258ce450ce9f0cd5240b90c4d037e84ea19e5b165615420d6f161d92a963c56f3f22fe3dfe4e98837869552cd97d06291bac2d016ef898ed874c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\qap`g`v~dtlq
Size 10B
SHA256 f9545efd0c191eb28bd86ab771c2695f8ab3cf1f752257cc5b9967bb55203eea
MD5 2427f21c667f4d328e33113c317406d7
SHA1 dd14d3403a2880ad2164b9fe7cf9fcc4802ddf87
SHA512 8286c28d433f071149ebc102b290fbbda28a46b01d9c70a91d1102d6fe8c962594c62381098b5fe35bc82a9bcb366f9a1416cf8907d1e96b4595f7fed4caabfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\qap`g`v~dtlq
Size 10B
SHA256 f0293aa00409306638a4e2b6f9452908f03b907ac684fef5beeb07ea3399d000
MD5 f27232f4955a1be2043d0a80029132c4
SHA1 61eed27d51c372b1f4466a9ca26024814008fb69
SHA512 d1b8977f5b318da29952b275504cec405da324e9e263c8f8dc702bbefc3a9cb449fa125239ffbf61d3566abd60c8e52c1f1b8152c9164ff315ac9aead44daafa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crowd Deny\qap`g`v~dtlq
Size 10B
SHA256 da1b0b516725ae6e3ddd659c2a837c71428e4a1a1af6e2cbc4faa5133ede24b7
MD5 87d167ecdd8d680743166b12bf656be9
SHA1 33f810cb1a0805402fff1e89cb301117a9335b0c
SHA512 d0fd0b07f969965861c27b231473dc3d9b6eb80e05d6f4da21ac619999c3f6fc935d416cb4000881de4149321437c4b4ce9e5c646b411a1decbf8af4a54ffde5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adm\pt-BR\qap`g`v~dtlq
Size 10B
SHA256 5fae83e315420f91362aa5599501cea4979d95dc21e493763af107b93c22183a
MD5 763d437fc3d2c45b16da3b0b30667fa4
SHA1 45c16f419001253fbfa3bbab834b8fbcc6942715
SHA512 591d5a092c5a31b54843fbb09c95af8447afd65ff8659c80d99fba2533dca58a8d5f6f5a1f02ac4987e0fc2a0767c6126e4900f2574d26edae387f7a91b4f240
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 58a47549fd96a42278d1eefe47edb6c177bf681dc894536797411c450b4f09ad
MD5 32c2491a24a220fe3ed8017b22aa39fe
SHA1 10e548e410338abcc6d6e038708619e02f1e1f9e
SHA512 22cb96c63a781af7e899d33904ec715370059de4bd184242df5d67849606207c1ef6b36c6fb288b79f2b8d6c9aad099f1782bbee221b409f6688fc43d2069bce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatCache\Low\qap`g`v~dtlq
Size 10B
SHA256 12704a27922dbd3c3f383aa959adaa757380fc41e88cb6b0dd696f16f2950876
MD5 546281800ea7d9965ada82bc939f413c
SHA1 b93aa426d582ffacf4f61792907ff74c10da1b9f
SHA512 dfd73d09a4718830324697670f0224f90c1c66b9a96b21df3ff46ffe5b216910004b5bf91dd82087ac976c3423cfc94e629e0ca512ed468349de72aacfae9567
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\ifnlrd35.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\qap`g`v~dtlq
Size 10B
SHA256 eae8fcbe2bbd7932f1fae84b58db94e391daac18c948c905efd656d8ac039bf0
MD5 cf8d889d2be1ae876e0c14d1d1f4a95a
SHA1 d4f1084016e55417739703de75e1e7f50c2fcbe7
SHA512 ba3cf2fc0bb18f3e3992662fd0cd9849117b0f0f315e97a595f09145fd758c0a4538973f5e92a863e268e62d2f5cacf2d91f13a6e5947b03fe24064e258aa8e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36a712173927ec8029f1d0eb044c7fc5c94e843c01e43cc1c1f44de9bc660334
MD5 934f020ed5b4b4f078b54fd0163f7845
SHA1 37354f5d1074824c1f2a1ff6dcf11eac4af7b7d7
SHA512 30419be2644c37574f16ee5b29459ffaf2bd30959ad84c8c424c25bf05812dac12ac4dde1ac37a79c6fea03c15b3e450d2d9797079315287ff2f7a9ec38e9b88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a8ded9fff3a98ccb32104981c5b15e816ca9d478e594eee7ba1e5650462f0d0b
MD5 9bedd790ade94293560acf67f79f27ae
SHA1 40b5e31708ee172e6320a964cb52fad706f02ca6
SHA512 8be7ac0b3d4446e87312b28022dab601bcb71c34c67763eb69d2fb98a44f8ba694018d9ff619cfde9d76f3770f9649f977b94749399f3242bc72a2f9bc1d69fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0664113c22b9d42cb5dfe2b865aeb9bc01d03c2d4eae2748071471550b01d04e
MD5 170226f345ac5c24c77660dac009aa9a
SHA1 6c35b3c75126b178610286248dc032bdea5f2196
SHA512 9e804844733609d732fa0e3e855869074669ec2fdc23d6c10453cc1a77dcaa8277a46f68a2a029577bc5eaa3cf785f60ee6dbd2ffe25c397c17a29df51dd5444
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4919e21c49f697fc0641783057ba054596a32f55cb8cb78b24968129c8cf68e3
MD5 e25ba9392e1d7dd11525397c2cdd06d3
SHA1 cd51326a955d67b724875c0a245507083f20a540
SHA512 e7aa0183d38fe983a431b2739d3e16b966fbaa8172c1e103273969e3a21e4dd4334094662acd849202d10d2e9ae4e8c67e4c3f6edae950d31abbff1e4bde608f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b302abfe1b8f69a47cc4c4abf6a726289e5714253aca8d5f01959d8e029db617
MD5 1acf739c7343e115150686d74e8e46e9
SHA1 f15091bca36d66fecb1fc35f2460b938d2afa6da
SHA512 9aeed8695f4c8a21e5378a4e02d5ddb58b071ffba648cc12e4d2e450f2d919895e6cfccb64858a23c00007c33290f5806c90c5a87d545dbe6c3efca79dcb814b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2888d7f5967fce88d9395702bb51c9532347d8cf3542fbca4a7039bd16330a4b
MD5 6946a00abac6e1d0d2890699867ab4cd
SHA1 9ebf789642402acf5d8c014be8ff61ccc5a175c7
SHA512 e71b1cc7fe12e0b655a331b71e1e73984231e557a2d105b782323678b37e4977ba117cd60570e4ffebd84ab8533ae9a079c1d964da185ee84d8687055eb095eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 9c548e8cc8ed77827c7d07dd67e4fece539c030a69dd81f8036548185d058aae
MD5 f5b8fbc3b4dcfadddd9105df5342c36f
SHA1 a153b283f4fa70d016db6b108d7eca05e88a7bdc
SHA512 669f5bc5272e4595c92aa20545a9f116669d10ed72935f65622a202f40faa36020b8f1b8df446f886499d4f203ba9d7f87df4338c14605755c5b559363ce0075
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bf907cb0899e0040a905f2bcddef784d61b270a4e153503f1b4b1dd1de35b629
MD5 ee7a2046f3e7d2eb1c4df8b1115bd5e2
SHA1 8e857a966fc1ce8cf732f1fe314f8e80c2806549
SHA512 7140ced44d5e21dae2f4b86c0b7be94b83f5232a770fb4eadd088d19a092c9c4dd165c7a06c7f0b7d527809f700be9cff1ab9502f3665591d00f35755d025a78
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4f27f17b6fe27710ff3822bc95af65e1b5dc9c5da52f53739d9bb19a20835421
MD5 a1ff3f26d4f60ee9c7b0a7600a717e6d
SHA1 d8ece9dbf14705585d478244bac08abb8df93da3
SHA512 54e6350a52405428998c12252885271ed5126e245d0bb1a4f078459d559f01be57575eb59db4834cffe3ddb95285af9b97cbf5d205217e227ea888fd2e61f55f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 16823911f37ea179096bdb9794b07be1d10974000563f45d389dbfd2ff343c36
MD5 f9aedd67627c3646a0454d6f7140dde6
SHA1 a180e1d84668a3ce88bebeb3fff845b4c4d43290
SHA512 dc76ba075e1e1b51ea095f17c1df1a5ed3494b9921dad039a1e56ad9fc2335f2b83ab40f582e10c59dd91666ad992b87a9631bb754bbd7288aa618414dbf347e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 95eeb83845e17d983fcd555c4724560baa72b1abef29efc2c883408d9f547001
MD5 ad2ae0b557761d7a059a1fd7d201e188
SHA1 5652896ca35db75fb24bd502a45ababbd5e45e7a
SHA512 28b3f488deb3f649e82589b3c8e9a2ca5e39c7cc306013c5c369757c1303eadff76b52b4532de20aef573d70616dabe314ee9e1491d6b2a0b8ed04e7d3e1fae6
MD5 SHA1 SHA512

Submit Download

svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACACACCACCABAABBACBBCBCBBCBABBCABAACABABBABCCABBACCB.exe
Size 34.3MB
SHA256 e78b246b42d441e07b73c167d97a7c296191a996f21986cc377a483068e47e9f
MD5 2b19de88a9fc19865b1cd9e2c09d0685
SHA1 86e9322025796640ec0a7755c4d0ba9f5f4886c3
SHA512 7fde7b23de872d8b9cf4953f77cff592974001880f2a9cb331c0ba44b9760a6e2de2a2c54ca50871e5df474797b319d4600453d984d3c8c69ed2f7e846469982
SSDEEP 49152:U+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLcR+ES+ES+EWLEU:ep7V
TLSH
T181774B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 a0f722bb45fcbe20597f1801c38f26a8ab15fffd60017742e4d265d52632f3cc
MD5 a32502b185f276f7eb8a0ebd392e7031
SHA1 9d06d00fe96d77bf157770d2a968d896464550d4
SHA512 3459af17f7499c441ae74f858f8e4b59e16395707dab5a91d8a096676378f5b82f9e65b9ba0c2ad0ecf292ba856aff0c5fed115af58dc1d3817638a694872359
TLSH
T11D21B4A2D4E5CCA3A9736CCB962AEB834CA4379BE95C9A0053198219B6D9C30CD194E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 0066405b246ec5a1ffd634823b050d12096cf60e9a8342d759f7548c52389bf7
MD5 a662a0bbdbe4edcfffa69eedff47d0df
SHA1 565f8419c759c8c13bccdb8409a87ec7eb2619fb
SHA512 a84f27fc0648c04cd9c3d5fe4df3ffb7ebbbd453fbd5e831c540c236c4bbf5c8b3d83bc5f35bf69ba989cead0f0f1952592c52542e199433740bcb5259bfe556
TLSH
T10621F992C4E5DCA3E9736CCB963EEBC34CB43697E91CAB1053194119B699C30CD194F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 04d6233cdad1b19cd145b34a0235994214dee6bb5f1b4734621d316a8f2cfc0f
MD5 690d896e95923f370325c7f9a3ba353d
SHA1 355160e8fa05b2285e42c4035872fed69279de71
SHA512 e53625a65881742df78b0a13dd34c28565321d1e0cd2d869932e1ffdcc5e36ed43e4b2e94075666be978396b2fc2c01ce64634a3cc11fdfb5f36f02d56f4fc4c
TLSH
T10511E792C4E5DCA3E9736CCB963EEBC34CA43697A91CAB1463154219B699C30CD190F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-2383-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/916-80-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/2772-3402-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/2772-1020-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/3544-68-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/3544-46-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/3544-89-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/4108-47-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4108-10-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4108-93-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4108-69-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4108-21-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download