eb92b08466b7e6478f72a11b5dbc69e36e9e546cec413e4dd941bd5512b3f653

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
Size 8.7MB
Sample260814-e2mf5svvcs
SHA256 eb92b08466b7e6478f72a11b5dbc69e36e9e546cec413e4dd941bd5512b3f653
MD5 548e03bbbb1f6ae745a569a15d2e95e7
SHA1 bbf4d0439e5d1427b256ea48ca11fa8140dce8a7
SHA512 7549ba9de59cc5a34ba4bb23d3763ea3bbad387a5a09e9700417c4a932938305689faa36c3286080cbd7a899932cfeac130d858f0658354bd9690b147529adf4
SSDEEP 49152:U+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+Eh:Rp7N
TLSH
T1CD963B09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
2976	svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe
3856	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBBBAACCBBACBCCBBBCABBBCBBCABBCBCCACCBBABCABACBABABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe"	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCBABBAABAACBCAACBCCBBCBBABACBBCACBAACAACABACBCACCBCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe"	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1936	sc.exe
5856	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2564	cmd.exe
4772	cmd.exe
2552	cmd.exe
952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6096	schtasks.exe
5252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
3856	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
3856	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
2976	svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe
2976	svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
Token: SeDebugPrivilege	4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
Token: SeDebugPrivilege	3856	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
Token: SeDebugPrivilege	2976	svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4772	4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe	92
PID 4772 wrote to memory of 6096	4772	cmd.exe	94
PID 4108 wrote to memory of 2100	4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe	95
PID 4140 wrote to memory of 2552	4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe	98
PID 2552 wrote to memory of 1936	2552	cmd.exe	100
PID 4140 wrote to memory of 952	4140	2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe	101
PID 952 wrote to memory of 5856	952	cmd.exe	103
PID 4108 wrote to memory of 2564	4108	svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe	106
PID 2564 wrote to memory of 5252	2564	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_548e03bbbb1f6ae745a569a15d2e95e7_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCCAABAACCCAAABCCABBCAACABBBCBBABABBAACBBBBBCAACCACCACBACCCACAACAABCBCABBBAABACACABBBAAABACAACBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCABCCAABAACCCAAABCCABBCAACABBBCBBABABBAACBBBBBCAACCACCACBACCCACAACAABCBCABBBAABACACABBBAAABACAACBABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe" start= auto displayName= "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe" start= auto displayName= "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCBBABAAACBABBABACCCAAABCABBABBABCBCAACCACCCBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBACABCCABACBBAACCACBACABBAABCBBCCCCBBACAABCBBCBCCABCBAAAAAABAAAAAACBBCCCBBBCABACBCAACBCBCACBBCACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBACABCCABACBBAACCACBACABBAABCBBCCCCBBACAABCBBCBCCABCBAAAAAABAAAAAACBBCCCBBBCABACBCAACBCBCACBBCACCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBCBAACBACABBAACBAAABCCAACCAABCCBCBBAABBCACCBAABBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 a6a2b5e1fcd5fc5996e5d3570db38f1cf09a50ed78bcd889c6e98b041e5bd90b
MD5 6771c8b5aa79136972e8f174e6e3a7ce
SHA1 0dd97910b9096df603d53e7bae5111f1d16e9789
SHA512 0702efa5f64afb9dfb7d6d37cc86617be949e9fc57b1b65341b8e59d3d9a7c3eb458b8742f55b4608b24ff68c838d5012264458c37012205a78ff0180154d78d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Crypto\PCPKSP\qap`g`v~dtlq
Size 10B
SHA256 bc517e98905431c4b4514f09b8ea5d01995473f9a1fcc97b24fe52cfab90f6f6
MD5 9f55209e8f62134e9f213d007cb5baf7
SHA1 33c1700d574e0a18c43a5cfba41c71c72e60885e
SHA512 53809ddb2540df9fab508fe83be359a2d7e7be0da444fec34e690f0364004fd7b520e02f48c92a96334784e3e39525a62e63ef3e85c71d39cec7c50c72b2f9e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Settings\Accounts\qap`g`v~dtlq
Size 10B
SHA256 5c9d60e9334949d2797ea6bd27f413adc728c0c1629d0c4b4510e1a1446e6aa3
MD5 dabf7f4238c1480691387060c5cdee14
SHA1 3752cf2c44142db2debb0388ae75d0e97ec84080
SHA512 6e79fa67ac1bae6d44eef83421be296902c1a25345d176999510a5a0b7b41a60d4fad26ad76cbf8b2470e42e13e3b41a54c89fec3ddddb4c2b4316821105989e
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 9.2MB
SHA256 3a5053061f70cc2b421cf088ec682aa8c323e7844d33c94075080776797c7ce1
MD5 ac67bc88a1fadb2bf4e86d864a2134b0
SHA1 6a7ad1e3b51da234eeaacd5d588c3d5fdab8f645
SHA512 3708967c47e83bf91ebf3e8c96a01f601b8422de9c6a703c3cef863899b5a74386f0378f35d61207c8d5a5c7511f68f81bf10aad196e5cd75fca7a6e55bf2f62
SSDEEP 49152:U+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+EU:Rp78gZ2Hb9t+2xv
TLSH
T1ABA63C09F94340B1D92B51B04DCBD3BF8A20BB2587128EFBFB4DCB5B6932B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 f4ee6513d62c81f9aaa6c8607f6f9e582c030debe1f819d0f33b400953e1c157
MD5 efca79810f45cfd047071098f18483b6
SHA1 15093482c0ad14f3031fbc13548e4ad543aa49b6
SHA512 7dad138e34c226c75d643c19a243636dfa054b11168cf9d46ef63e6f48d6788ddc5c32959c34e7fe503ab613cc7b32b175971f8241eb6c128f3626b663adebe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\as\qap`g`v~dtlq
Size 10B
SHA256 5437deb864322897cabb608f1cdd5a24da0673462e8e6a4acbaa41b06c49223c
MD5 7ad45512762fd2cfa2edd28a5b56f0b5
SHA1 adc3c040216940c5cd1d84a567b475bf258ad9a0
SHA512 03fb609445f5377465ecf93bd394627107cc78a9044f1a9c31dcf46f388982d9e3868f36944831a1147fb023ff92e3356f676880e1cc85ba2b6c71f8243a9508
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\qap`g`v~dtlq
Size 10B
SHA256 4a28972ebbc20de5a63819f49574950ba07177573479dac360eff5c82085cb3b
MD5 da99d627fe68f815b89395b78d1faa2c
SHA1 0078940fadf8725b63d2fa1cea70f98301e6ab99
SHA512 7455308128505786eb9d0e696b36b9da3ca8b5f7fb9d36c23c32bd91c5ca29f9b6b8db459110d438c84124d662a16490b4afd1c813c500679094bf986cd8328a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\RoamingState\qap`g`v~dtlq
Size 10B
SHA256 72168c6ee0bc51fb2b300231a1cf8bc6b3bbe2820db1819bae02de2b197664b3
MD5 76d3725b8157b5cb5f77fd99c7a03f24
SHA1 f2637084ad1e1ccbeb98aa8fc846b5c156673b6f
SHA512 9de144278fa66a4fb3d655eeaf623cc5a06cce9124c01db37a1c21604205cf000b6c65a9914c007f38c849a3c27d27f97611b89bbfe11d1bfe89174ebad1fb9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\qap`g`v~dtlq
Size 10B
SHA256 4434a64449d6f6c4357e6c3b14eca59f195880154e5ab6e8a60973aa26a8a674
MD5 3ad4e8fa642aed205125e4f904e04aab
SHA1 3c42d749ffc88a8500c5e0d691d995b9be0e87c3
SHA512 959b61586e1b9049db0249ffac30b43a124dadf5c56a05966aeaf708adb566949c6a494b6b7d3b8c50ca884157a18ac336d255779b981b747b293e9b7686eea4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b97b3794110e6505005ce58ab8877005f497a239c96e101e627583fa3011319
MD5 8c4cf3d01aabaa87cbcb371213ff9bc6
SHA1 ec486cc58ab6efa0d692bb4f8c98e5e4215ed4e4
SHA512 ef30000b6b529e483a7e6a6a560a1e386ad9fdbf9a4efa32f4ac0601a4b6c2f6230dd75c22c48d491e52b7c79c12874a9e482e5366e343f5d5ad920214d00fac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4276f7e890578f4d8aa09a5caa1d2405c8174a59453d7253f9dac371a13bcd69
MD5 f37b843a53a25228816bbc93bfa9fa99
SHA1 ed8327fc0d3b9a624a59c3385b01412a58e57709
SHA512 4cf7fc67131f4ae89fb721822a822facfa48aef3a3e7e8b9a7b173e3f88d3939e58831ed0fbe6a815cffd405728a6e8f6f49c4d2f4e72d7e5b7887af8757a0ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3509e2985f9e96fb723f9ffb53be425168a77f2802e36c1960fde4f7c31d24de
MD5 6744f7122eeb699c8e95ae450b3bc0e7
SHA1 4f487518ad2e4a845e7b05796b6b4905566bcff0
SHA512 79d3e774cfc8881af93e18c1e48e120b4c72d004362f5219f68d117616466efdb739fa3893e96d415cbe1cdb0b0301d7afca9f2f6de4d7fdf77a59b17c614873
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d096b8f24801f0fc5ca3eea24a195f2becd01343e364f4660a736f91ee30cfa
MD5 17267179a07c87a1df29b040fe606f80
SHA1 af110b557e9fb1aeb03330d69516ba99aa51726d
SHA512 cf5b2f7e4f71446829b89bdc2a271996b55d6d1db68bdc7cd5afea30727c2f368146a848247df6bf590bdeed0cddf7817101702e016cede60b1a38404fd8a94a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4da9e73a5fdb5430e252643907702bdbabe113bd46fba44078d31e48d6da0a54
MD5 9e6fc1e11945e4c009ae114995bbd8ee
SHA1 bc17e37fb342285cb83eebadf359252b42ed769e
SHA512 4b69a696d5527d037dbdddbf4711dcf2c79af25927d5c34f54d465b47477399538107b9066abf78f00fee9c7caaf45bd7b5791a57ef699528bacbaa3f8ac3256
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0c336f093b83cc6b3a06ef61b59a0f05902d92bff00cc05ba70dfeda4530cb6a
MD5 d13e113d7bd1acfe2a1a15178f5a7ea6
SHA1 32fe81e7c6d577d5b881b0737e3bf939ea01b51c
SHA512 dad76c8dbe4ec4b1deb7ca947377e6224ae812a1f074d8b8766c36bba6ba433c1712814f18b2d49adb8cff21540d5fc1f8025c81d7c0112952a9e39029d9c1c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\GameExplorer\qap`g`v~dtlq
Size 10B
SHA256 f0950bc18c45e30aba596067352f48e8fc4dadb06fbcfc881f5e58a3a2fc7809
MD5 763eda3ff8ba30d3c07e5a77bcead12b
SHA1 d1239360763fd0b1a29433027ce27c3282b91ac6
SHA512 7ed243e25971a919919eca9b9ed497a2b55b19d27fb413525421120633ea90d41ff6689e687e5c4a5c99e73aaa343c075d1a75a1a12900bac03ffbd1de0269d5
MD5 SHA1 SHA512

Submit Download

svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCBBBCABAACACACAACABBABCACCABBBBCCABAAACACBCBBBBBAAC.exe
Size 8.7MB
SHA256 eb92b08466b7e6478f72a11b5dbc69e36e9e546cec413e4dd941bd5512b3f653
MD5 548e03bbbb1f6ae745a569a15d2e95e7
SHA1 bbf4d0439e5d1427b256ea48ca11fa8140dce8a7
SHA512 7549ba9de59cc5a34ba4bb23d3763ea3bbad387a5a09e9700417c4a932938305689faa36c3286080cbd7a899932cfeac130d858f0658354bd9690b147529adf4
SSDEEP 49152:U+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+Eh:Rp7N
TLSH
T1CD963B09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 e1e11404ed55402ecbccf81731f868c392cb66458877aae6ff1b63a2f2e91b9e
MD5 c269967385c67b637a738cdd3d62b9d6
SHA1 e2fc538529e6a68edec6d6506e6f9b46a0dcafad
SHA512 1d82c11f3da2bd2728e4bfaf7048d905e8f4643da7ae81fe50cbe818186d1f7d8d278b56342064fa852118f94e453e61ee95bf6043c068409eeba3a22d7e811c
TLSH
T1B021D751E8E6E837F933ACCB561DDB821CB8769F58587A9023084228BFD5D308E558B2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 82eac48645a60ddd602d6ff48324b1ec2f252daedd3d9128b24385e686c55d1f
MD5 56c2ce5fa3d9382876f5390814d12e95
SHA1 3c38d31dcd4a1a504440db9e347d9c4062f696cd
SHA512 16690eda8c2f20a794caf9e47337a63902b517db8a86e2acfd19520531c748782a6e5e91cf9ee3df8881a3ff094d794a1ba0c7a6c5238b65139db5094121d7af
TLSH
T1CA21B621E8E6D877B933A8CB962DDB821CB8769F9C586A4012084228BFD5D318E558F1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 55f6bf19db868eb6b6c0ed5b6da618b9a51ff50cfd2f512405df67b5299e8df9
MD5 30ff1cb485d7aa0175c122c206eace92
SHA1 bbccfd2a01870547a39adb4c6ec00def06713ffd
SHA512 c36de71277efa8a49e50b9163f01e3e99101a916156b975e3add671d721e968e9671ff217a84cbac0a455b1c308c5ee4ed8692a19592e01da21f412354764ae5
TLSH
T121110811E8E6E837F933B8CB561DDB821CB8769F5C587A4022084228BFD5D308E554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2976-2396-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/2976-63-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/3856-75-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4108-33-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4140-6-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download