24f35fb04ac62a793c9b306d736321f519a74183f17fde35a3bd1ee202a03886

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
Size 22.4MB
Sample260826-ehg3basbjh
SHA256 24f35fb04ac62a793c9b306d736321f519a74183f17fde35a3bd1ee202a03886
MD5 eaaac98f1f47ce72bb2e65ca4347ccb0
SHA1 bd2a8c9759c9d5f2a1a9d8b3cd83c0552fcc3de8
SHA512 922c091b987fa8793fd10dc2bc10cd191a83e0168f4b077f36e39e6952fccf1023d71d31cad8268729d735fb2f5a13ec07592dbcb973d46fdf10fea0a5531cfd
SSDEEP 49152:U+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+4:m1/tr37wC1/tr37wVp7S
TLSH
T195375D09F94740B1D92B80B04DCBD2BFC6707E1987219DFBEB49C76B6A33BA15838615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
5660	svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe
5956	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBCBCCABAACCCCACCBACBABAACCAABBAAABABCBCABBACAABACBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe"	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBAABABBCBCCCCBCABAACAACCCBBCAAABACAABCCCACBABACABCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe"	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1056	sc.exe
1224	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5816	cmd.exe
1488	cmd.exe
2208	cmd.exe
1020	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3208	schtasks.exe
1316	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
5956	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
5956	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
5660	svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe
5660	svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
Token: SeDebugPrivilege	3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
Token: SeDebugPrivilege	5956	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
Token: SeDebugPrivilege	5660	svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1020	4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe	91
PID 1020 wrote to memory of 3208	1020	cmd.exe	93
PID 3976 wrote to memory of 4432	3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe	94
PID 4216 wrote to memory of 5816	4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe	97
PID 5816 wrote to memory of 1056	5816	cmd.exe	99
PID 4216 wrote to memory of 1488	4216	2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe	100
PID 1488 wrote to memory of 1224	1488	cmd.exe	102
PID 3976 wrote to memory of 2208	3976	svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe	105
PID 2208 wrote to memory of 1316	2208	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_eaaac98f1f47ce72bb2e65ca4347ccb0_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBCBAACBACABBBAAABBAACCBACBBBAACABAAAACAAABBACBAAACABCACAAAAACBCCBACBACACCABABAABABAAAACACABCAABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBCBAACBACABBBAAABBAACCBACBBBAACABAAAACAAABBACBAAACABCACAAAAACBCCBACBACACCABABAABABAAAACACABCAABCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe" start= auto displayName= "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe" start= auto displayName= "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABAABCACCAACAABCCAACBAAAABBBBBBAAABAACBABABBCBACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBCCACACCCAAAACCCCACBBCABACABCCCCAACCACBBBBAABBCCACACCBABABCBBBACCBCBBACBABCBCCBAAACCAACBBBBBCCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABBCCACACCCAAAACCCCACBBCABACABCCCCAACCACBBBBAABBCCACACCBABABCBBBACCBCBBACBABCBCCBAAACCAACBBBBBCCBACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABCBCACCBABBAACCBABCCABCBCCBAACAAACBCCBCCACBAABACBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cd2f35a69db15e988884a130ed4f702ef8b75ad22c4a3db3bd128b3537909445
MD5 c7d66af65d4fe7cae1b1eda2a166b68a
SHA1 c7c9a0ca73752f360db9a30a5549e5acd98c61ba
SHA512 a2fe7e53fe043a14f3a8c8376fcf19f171fea47e721f00fe985fae53a00209b112742769456d7c7dcff1ff21dfa372d0a7d4e5af7ea1691fb087c1c5e104af1d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\AppV\qap`g`v~dtlq
Size 10B
SHA256 91139e1e8e92efe5f272e03700f7fd4aab63562a055103a9ca0ec5abae480e1a
MD5 e69bac2221fa7dc10fcff7dc0f516ab7
SHA1 b7f23e88d7dbb63614215b4f345f8defb9df0882
SHA512 7af73b49e388182447e27718c519bdffa3578fca6c3483619b6ba2603542e13eed1326d62a71e9200811798ff054b0e5b524424926ce53e9ecbd066b31bf9016
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Templates\qap`g`v~dtlq
Size 10B
SHA256 f795109535dc44e76f92fa8f60b102426369b7de27d506febd8d1dcc176971b2
MD5 e722043d7995885dacf1a52c430484f2
SHA1 0bb282a4e37f1ad567a838cbac136897331e1523
SHA512 3bcd6ccf354b930d8c73b4fac0aad5b33e54db4a6dae2ed179d1236d0b4f5c84f03efba03d0aa8fbcef28091e9e8e3b856692623562e311334be387ee080ff78
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 23.0MB
SHA256 bdea0064e73a8fb93f9e21e6da38a163e5867d9afcc8cdaa10fd21a39ded64e6
MD5 fbecaab5b786bf6f651c72f9bc86845c
SHA1 9a2f2589c6833e68ae9af07b9231778099d7439c
SHA512 ad0c74a6a7c0687177649d6917694fbf72037a23e97cab0700f8b661120a54c598109706992f07c5d5b23e8e35fd1daf94b9508f471739a8b75d26365a6dc995
SSDEEP 49152:U+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+f:m1/tr37wC1/tr37wVp7VgZ2Hb9t+2xz
TLSH
T142375D09F94740B1D92B81B04DCBD27FC6707E1987219EFBEB49C72B6A33BA15838615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 b133661b52ed602d7df59dd7194856e5aa93ffd71a290aeaed79096919612971
MD5 fd22b0b15862314a16c3d71f15144f0a
SHA1 9eda619eca7209cd476ebf1cad40e0173c32a761
SHA512 bd8fe408aa394e62fb61754384862ed837c2084e0a90bba004748fa00e0eac20b384d762f60f0c35d9b1881ad4cccf994ab5dc0669e3a84af230c5848a114b96
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\qap`g`v~dtlq
Size 10B
SHA256 2627132500433b65ed30a408a4b302a66e8e9ea4f7914cbd5b1f4e214db1897d
MD5 4503c2135cd7435a5beb47fc393be810
SHA1 fafb4457bce7085cff37c7d6af205df1ce2ce3c3
SHA512 0f56b49238737a00f43b21d1eb43ace52d57e66983c4be927c52a1f8e6f160082ad2ac3b92ca942941f4683bb03d97d5ba3b3bddcb6f954039d2dfc61dcd36da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\qap`g`v~dtlq
Size 10B
SHA256 b037063775ff06855e2b4d9b19201c199d2a35a7b955ef4d6924b5be92fa32f4
MD5 217a55b0c95614b84ad7bf205c44eeb6
SHA1 568216f7e40bf618f65d3e4ba8563e72bf366b49
SHA512 5e607f76d19d576c6b1587c417fb3cb58017384413ea43a38df9bbe6fce0cb1b6dda2587046fd07509e59cc8f3cb9881d26a0000c8943ba8e4a8a83515f1b8a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 b809d21f7ce11b70a5845d0540c16cbc36eabfb8f9e2ad301ebe6aee75d571f4
MD5 bfbd54b7322410e23e7726afcc54f60c
SHA1 62d59d2fd9c9ec542157f8074671463e9bbdd522
SHA512 661fce6660500b113b6038f61cc7bf0aa134407b7c42032cb81898f7f8ad75565139b6a0e7b1e627544dad125a4a8dbe41fc1e0bc9701003efce12b3b932431a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\qap`g`v~dtlq
Size 10B
SHA256 245956450215d88445ff194db590691d38d35cb69f983d16c6c9d0e485c96d71
MD5 bdced6785a9082ac647a5f5daf4b9022
SHA1 cce7b6469242b1a1d77bc6f8be9deafcc3eccab1
SHA512 c2380b61da886060e80d0352ec3f06242159b62038849426e0883167047829df1c5b9fb173d4dedbbdd35eedb0b2531065b04c85fa6ef31d6b10cb96d670d5c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\be\qap`g`v~dtlq
Size 10B
SHA256 672c1960ddc8536af39249f0edbf67da31af117af5efb095024f9149c3b8d1d0
MD5 02edeb9b283c2d078eaac33dc7690da0
SHA1 c97091777a9a0eb2d80dbd1206a0f4aaab0e7f13
SHA512 78210a20eebcebb84c79b41ae546ae1d03b11131d9c463fe51596bf0bc5c419da6132004cb5f68ae68a38dcb045f6700f5657c3acf38196b17967afae5174c56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\platforms\qap`g`v~dtlq
Size 10B
SHA256 6c04f2116723f961ded6ac587416dc936a2b497eafa2e2fca3231f1261db0138
MD5 fd5f366235d42ae41ede6cd64b55ad38
SHA1 a0899373bfa709bd45e049882075a8ea8ee1a418
SHA512 7e0aca46593027e2cc615ae0ec724b5904a8f0fe65fb1264490a967f45cc1535f3aa700fabdddb79378db820d969feb15fc3446f77ae579cf89557637c05b558
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\qap`g`v~dtlq
Size 10B
SHA256 6d398c4bfa8d01291b3369e8d3ebc62f17e5219be66097143623d9c176e72ec2
MD5 061e1ed0fbb07c090a8543c80c09bc7a
SHA1 a8eede04a12e3d0836719cd0d51da5ba10cc3c03
SHA512 545683a143739b32910edf4b0399fb11c48b544cf5ed45e840184b93a456a1df3e9dbb35e2ebb4446cf90460d30651ce7fcad013dcf283e2beecd7059c564c9a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 634af3ca96aa38d9cb2b79bf909d266917e76bef8c35997ac47566c9e8201f45
MD5 ae5a120f8bc86d4019474e0aea613d48
SHA1 34277c9fad8dd93b0fa38ad9977834a8f8c29fff
SHA512 b73112596853268cde33f27d699a1d06a670b89bda30f063386152dc3cd44890956e9add410e9bf622fcc6be640b26a16d595e91bdcc3aa8a56217014eead588
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 462080552efeca8a48b97e80984957746bc02e7b3e54c141a97929b272e82ff3
MD5 6cb564a17bc80f801f1afe5524163711
SHA1 c8722a5e8700c4ea94e91b6c553daf87131b2fd7
SHA512 ef7321c6821541e52565b861f54821786f2289f19d3b5ecf94c2942b61ba6851c04a96ea48b448d3c48396e430365013e0fc7f49ac88b5eb6051266558f58457
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d147b4023bf67829b5eddf732560e5ca730c80d811910f624f1b689cca947e83
MD5 cd8e87219b8e9e03e339ab04e06f5505
SHA1 f6f5fc37b2cf519545334d3dfe3f0343dc535858
SHA512 d4538ff7c94d8d710af25cbe478bb62e94baa942ab0974e7326e97398a9c1a578b6669cbb84749a33a207f3d71bf6512d4034f1394e8d5e3e862c22725c285a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3506533a4690c5ff4d9725984a66125beed7003166e9cc4f32a3502458f3630
MD5 fd36048e06c32fe7bf4c572baf6ef9e8
SHA1 b914ab1eb232e45b93eb18d1a7fa62a16582aadf
SHA512 7c1a66e89da53372a1f8e2d6137d35677e8050f718d5e3ec06623c7f12560c8138ac31e43c384bb1fb7132f22cf60a00d6ab61f54dbc31bbc7e725703ec0dfc6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dc91d0451f730d94383cce31bbeb96e89f4753ad976bd48ff2082ab77ccbda33
MD5 266db29be26ee3c45efb0ca3c6c623d7
SHA1 e5a2ea3b5a9e5e9889786578bb56159f6d09cfc3
SHA512 4f6c49ccfb0980f808d833636a8d6b9ddef6c6460b2f90c082999ab54ba5da9d6e5cc1cf1ed1c9b1b3ab6c43c1bec60179848f8b249a280f457f06c8a5ed38bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Documents\OneNote Notebooks\qap`g`v~dtlq
Size 10B
SHA256 ba6a9cf70a81e3af8cc7d20b5d2540a2aa02e4f34aa9f28f265a9475751e0fe2
MD5 4b56ef4b7062554e14179e92ee670a3e
SHA1 383e616dc8a97a246e335250acf8336c7e6c88e3
SHA512 c13f251ebc915f3ffa3e97601485fcada3dd05904eb8577fdd7a0d6e9bcf986ac2c518b4fbf2bd5cb4550028479405e1a326fff2f88c0f1ae77c15ced944924c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 02e849d137e13f9fa47f430be63034a9132d8a388325331ca84b376d19884f8f
MD5 73655b09dc6dd8d13dc8021d13284349
SHA1 3a725e535eaed68280fa67fa0561f9811512427c
SHA512 9c7cd0b8a72abeacc1aad51e9d2ad61ea921ea8d0af8d6c65ad0f1011c2a98ee2f9007a48933030966d4072c52e4602d8900150d2b1d1e1589242477090232f3
MD5 SHA1 SHA512

Submit Download

svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCBABABCCCBABBBCBABABACABCBACAAABCCBABCCCCABACCBCBBAB.exe
Size 22.4MB
SHA256 24f35fb04ac62a793c9b306d736321f519a74183f17fde35a3bd1ee202a03886
MD5 eaaac98f1f47ce72bb2e65ca4347ccb0
SHA1 bd2a8c9759c9d5f2a1a9d8b3cd83c0552fcc3de8
SHA512 922c091b987fa8793fd10dc2bc10cd191a83e0168f4b077f36e39e6952fccf1023d71d31cad8268729d735fb2f5a13ec07592dbcb973d46fdf10fea0a5531cfd
SSDEEP 49152:U+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+4:m1/tr37wC1/tr37wVp7S
TLSH
T195375D09F94740B1D92B80B04DCBD2BFC6707E1987219DFBEB49C76B6A33BA15838615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ee5ab2442a803bcab166cd1f38bdf8009c31a5a6f8248e553cf56366bd2aa07f
MD5 2c8fc8de278af87118c03f1884d045de
SHA1 f60c411f93543d968b8a7fdd61bf60dda997e99e
SHA512 b21e071fb063bb462540d61f8b8e7858fbda58401426ffad36ebe71ac9fe9372f97fc5f62cb8d0f75c903b7ea33ac80d90766c87f374f1ca314084e33dbbd0f5
TLSH
T1A4212670B5F4CCA7F43338C7811ACDD21C9537AF9C587A24234E8218B79983A8E555E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 17c32667bdc7d4e51979fb27d7da87bc4af56e6262e16d776ee59a3b8674af8a
MD5 b4393faeb1929ea41ab1eeac9ef694f9
SHA1 0134d1debe9b7a69f2172f9c13689523b08f1b47
SHA512 e424e3b0ee28d867a751edcd46fba949495a6ab24ed7230928cc7904a67a240550bc3c3dce4061401a3f92ad72535d723fe75dbe8f713ee09b5ee7aaadc071b1
TLSH
T115212730B4F4CCA7F52378CB811EDDD21C9533BF9C586A20134E8218B7D98368E555E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1d6af4361b14f637716851985e652e82593910cc12eb43f83c91b26471396fe9
MD5 adaae82db6bf20214d74d2fb6aa232cd
SHA1 8b931fc46183905882c635469b034cc7064ba888
SHA512 1aad0a5e195020e19f49c89207e2b483a2133f184f812ed39c045b5205c698e5766db394be83d8ad452484fbbc209363f2a9e8cdfc56bd22f7e4567ab7394cbe
TLSH
T14211273075F5CCA7E53238C78129CDC21C9533BF5C587A24134E821CB79983A8E555E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3976-33-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4216-6-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/5660-63-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5660-3936-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/5956-1812-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/5956-3938-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download