a10ad6c60f34733ec4c226d7eacba3c21ad4b1ece30e422175aea1e1af062cc9

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
Size 6.5MB
Sample260828-r2jfpsdc65
SHA256 a10ad6c60f34733ec4c226d7eacba3c21ad4b1ece30e422175aea1e1af062cc9
MD5 6e600bc1ddec5d34656cf6c965970656
SHA1 8080d987f8465f02365dc326e0a373347627df2f
SHA512 7338d43080039d75da1d671fe4dd83d3e1572dac54791441384ad81457e5185bcaa76f97a614de44221e63cd9dbce31ee1b264d8e2cf480b3abb957b6fc8375d
SSDEEP 49152:U+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2Jwqp+s:3p7F
TLSH
T1B5666C04F6EE0861E5B761714DF7C27A89B1B9618731CACFE688872E1E33BD06835752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qap`g`v~dtlq	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\qap`g`v~dtlq	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
6056	svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe
5892	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACAACACABCCCBCBBBAAACBAACBCBACCACBBACBBCAACBBCBBACBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe"	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABBCCCBCABCABAABBAAAAACCCAABBBABBABAACBBACACBAACCCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe"	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2976	sc.exe
2984	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe
4820	cmd.exe
4704	cmd.exe
2844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4428	schtasks.exe
1760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
5892	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
5892	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
6056	svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe
6056	svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
Token: SeDebugPrivilege	1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
Token: SeDebugPrivilege	5892	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
Token: SeDebugPrivilege	6056	svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1364	2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe	92
PID 1364 wrote to memory of 4428	1364	cmd.exe	94
PID 1540 wrote to memory of 2696	1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe	95
PID 2412 wrote to memory of 4820	2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe	98
PID 4820 wrote to memory of 2976	4820	cmd.exe	100
PID 2412 wrote to memory of 4704	2412	2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe	101
PID 4704 wrote to memory of 2984	4704	cmd.exe	103
PID 1540 wrote to memory of 2844	1540	svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe	106
PID 2844 wrote to memory of 1760	2844	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_6e600bc1ddec5d34656cf6c965970656_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBACCCACCCCAACBCBABCCAAACABBABAAABBBBBABAABABCACCBCAAAABCACAACBBCBACBCCCAACCCBCAAABAAAABACCACBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBACCCACCCCAACBCBABCCAAACABBABAAABBBBBABAABABCACCBCAAAABCACAACBBCBACBCCCAACCCBCAAABAAAABACCACBAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe" start= auto displayName= "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe" start= auto displayName= "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCABABCCBABBCCBBCABBBAAABBBAACBBAAACCACBBCAAAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCABCACCAAAABCCCCBBBBBCBACBAACBABBABBAACCCCBCCABBBCCAAAACBBCACCAAAACBCABCCCABBCBACCBCCBBCACACCBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCCABCACCAAAABCCCCBBBBBCBACBAACBABBABBAACCCCBCCABBBCCAAAACBBCACCAAAACBCABCCCABBCBACCBCCBBCACACCBCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBCBACCAAABBBCCABBCAABBAACABCCCBCACCBCBBBBBCACABAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 90a9d507cdc5f6c98b5e12ef4135cb2628c85dd5da81c0b490c646b7507223bb
MD5 3101d139270d33a18681ea0af0b4f65d
SHA1 de16edf335935918feeb793c1da0805be9b870e5
SHA512 3d61c450b1af0e6e8fa5ab3c16241dc11cb60d5259c0fd0f183862ff085c16d5c401ea44f494c927d1a08a9466da9989e9c65da9f52e9dd4c678b2d507d1002a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Search\Data\Applications\qap`g`v~dtlq
Size 10B
SHA256 5c45b8df9867bfa31bb9a9b2c105ef641ee7f8b19b4f9388b33d5c8c2c0412bb
MD5 f7b398783d653029bd5cf389fffaec44
SHA1 636de73bfa91f6ebd58020b626e305ea0f925141
SHA512 fb4629ad513bf601a6cc20531898b7e172070779eb4940e1f75c768b1b45fc47d7cbbd9771a31f2db93434a2791641c3db37bcf89b85a315d0b332cfd10138d5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\qap`g`v~dtlq
Size 10B
SHA256 c984af00eaba38430dddcee518cf1f7fede51b3d18acc871ef0668e1ef026696
MD5 1e96c0e62918d8ca0c9767787b47b551
SHA1 020c20f44c5950439cad801d30b2ab2325361920
SHA512 9c91b8820a8ae6f5b4ba85e82b5d61e2a0a812e58aab114f5b633ef962a2c57d39b0d8b79a5687276781cba7422a40bfda552790a8de55e58cbf6e4a76eb2548
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Oracle\qap`g`v~dtlq
Size 10B
SHA256 52620f661c640f7059e905cc74765f1cff51dc9e1fa631117a538a462521b235
MD5 1609dd695e2d27b4c0f3ad8390683376
SHA1 d766fe1b1e4c58f4d01a852f422f6a2bcc5fec4d
SHA512 862c1b1ec3fe306ee7ec76cb9c31c1543567d24adb74297278cff30cc8e34beb9f66e1baf7b79ba094e423ba9d3488a5a1dcd79c726c37e31c061cf845ae1837
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 7.1MB
SHA256 2075750e4391ee655a884e6a647813bead046f27b8ef9a275802e61bce0f7b11
MD5 4338318a2a6f72d8e1c02ad3e1858b18
SHA1 47fbdfc2135e0da961d17fa580913eb818cf76f1
SHA512 12da739fd81b555d8c46fd36dfa4fdbf33387d8a3f15239cc20ca5fc292bc6380f4f36d207e4eee21cf5bd8a963d7824e49d6ab936d78195ade12a353b25839d
SSDEEP 49152:U+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2Jwqp++:3p7UgZ2Hb9t+2xO
TLSH
T1FA766C04F6EA0861F5B761714DF7C2798A71B9618731CADFE288872E1E33BD0A835752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\qap`g`v~dtlq
Size 10B
SHA256 0b798bf848e55472d97cd6ea46c30dfc337ef7bd02ca2cf0fe4186e0d8fa26dc
MD5 b665fa9e973b57820a41bdaa7628159f
SHA1 594fb27ded473c58ac10ae49a83e1d5f2979b3d0
SHA512 a9c5dbcb694a66eea5508ba6babda678af035927a1cc7fe860f8cb22ccd23a5d3d90d599559e0dfcaada7f63a4475cf78882a5fc5fb94d3ab25f44e193e923ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\qap`g`v~dtlq
Size 10B
SHA256 a65e4c33b61c1842b4348393be2c4041ac1bf8fb2e065982334d5a3d20f7054c
MD5 4a598a967d94c7a04ab0b77d93952de0
SHA1 71360dbb4be301e054c082dbcb6a5e08f3b350ce
SHA512 d55f668c5b86416d75f1fb20433bd58c740b9fdcbaf8080ee4ae478597e56baf404a57c2fb2d898e198787cd1f4f58e0a60334165376d34c985f341af851faac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\qap`g`v~dtlq
Size 10B
SHA256 fb887125b0e9d213322615e7845468629b9f005249065e9da00565f831c5d4be
MD5 a4b5bd8f59e0cfe5d7dd46ef7f1c3aa6
SHA1 89251a4004e615514d6537b2c2e74ed063ae73e3
SHA512 0e1b7a19070374d58afbf82547064707aa8a3f4b9b5f8d7a6dc4fd64b00f5dbf0420a0d12f0b1c3912cd9f0317d04cd6bffc36f5beb57004114f40ad9280d8f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\IECompatUaCache\qap`g`v~dtlq
Size 10B
SHA256 07e345c12c3f9c655eefc09980e1c54669593d417388ebb2e4cd1603d0a64704
MD5 d9c047fee420343d8354009c406ae95c
SHA1 e03be9b5570b216a840f33aca82337ef70025e19
SHA512 26ddb729540a8ddc572a2b155d11565d7ee323d964624b33ee4d4e743f19e523cdccc7c0609d343fbd38741ff900b079fa3d27991d162dff371e3db6a9831c91
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 694664cf800aba1cf43160b3db58449ce4335e69f214dd16d9f848cb5fa0f440
MD5 4301697597bd773ebbf8d8074a3b97cd
SHA1 1225b2f30e100f2c81bcd71116ac08d2f3b2e913
SHA512 fd60f7223ed925a3d5eef12b496b3e401d31540d46e5932ea6785c24d5b47f5116e35238b73267fb3dd06a6b1f83a9898d76d647d7ede958ffed91d1dd3aa0e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7cad3e7598bdc871bbc1195f053013f21e7f17de760202ad30136f5642d88ee
MD5 be8e6903f80f584639c8c41ca54dcf72
SHA1 c9599b40b6dea096bbc02e1262886f7414a51dbf
SHA512 3b45ff5f99353267d6846ebb48984109fbd55a81e1eda320d74baea0a473b77bd05fd6399822e763fc5fa0bf7c966453950164e1ebceb612ea706ba3acead3a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ddff5049604267fc5b40e85605ca61e01604c83bd74575418b1d8938265848fe
MD5 961c425b45c26d1f95a17113fc9fc0e9
SHA1 0874277a240ed9bdcc8db39ca385d2b2c9af3e7f
SHA512 b30f5321b575d03ba776f444d56e3a8e482f5057fd44d23225ed117ef3973258840391305de75a014b0aef77aa17aa9c6496df2e566c475ca0d790321e1effd0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bcb758c1e8c8a544639677d9ebd8614fe91bdf49afc62a9971d6ef213e684b2
MD5 83862a88e2c771e19b76c300a8a55f30
SHA1 3b77dec136ca5620c3ef96c657de43588a657671
SHA512 845186d60320e1f91726d03437f4f2611ef2d3421b8a65f6e772e381e0efb7a239e5e55dcc03ce415a2ea9a5911945511cde48dd15584a901e0539ff7fea3438
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 87e0f7fb8dcb91e52c83eb23b0642ec23a9f1d5995fa212c7e0f705355328f2a
MD5 570abc2583ba4da7b50d26b9fc27e6ec
SHA1 5f809c9e196b02b261618b95d0237ed360595fa1
SHA512 3b16cda038bbc07d3154ac15520a43a3839631817ff32e4296c795245418400a304c74d2c361f3ce27f04b74193b00824005f27a50d19ec97a5c767a54d9879a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5493a06437d7e8752318efcc22e3b2cf1074609fd916b642d04cb36f5d0e7306
MD5 32377d8257ec7deba0c554d5da9521eb
SHA1 3309f818eab42427592e251fe3546718c5b75ff6
SHA512 023580e3ec23b67b04d2060d44fb55b8b63a3d4e853e81de8dddcde46e593d9d5da4631b3a0f986c411eb24b7cc0f951b48ca5135a05f8f28903a87d235a8114
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\qap`g`v~dtlq
Size 10B
SHA256 ea6beaa512eb3398707530357fd8f9f8269bb68f0901ae9433bae44780a6cea9
MD5 17e4efc8a5ac0f6b717662190ea1f667
SHA1 20aa99379154bb9fe56bc2e84b913e01c85e710a
SHA512 657298907b7fd1cbac34d8bcc6e330c18a15dbe29bfcf5758e55aba79eaee19fa0d50fd0798f5b7a5807a8271321b3c0d83aa39f97106d6be853a9063ec0c3dd
MD5 SHA1 SHA512

Submit Download

svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABCBABCCCAABAAACCCAABCAAABBABAABBBCBBBCBABCBABABCCC.exe
Size 6.5MB
SHA256 a10ad6c60f34733ec4c226d7eacba3c21ad4b1ece30e422175aea1e1af062cc9
MD5 6e600bc1ddec5d34656cf6c965970656
SHA1 8080d987f8465f02365dc326e0a373347627df2f
SHA512 7338d43080039d75da1d671fe4dd83d3e1572dac54791441384ad81457e5185bcaa76f97a614de44221e63cd9dbce31ee1b264d8e2cf480b3abb957b6fc8375d
SSDEEP 49152:U+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+EO+EM+ECiw2Jwqp+s:3p7F
TLSH
T1B5666C04F6EE0861E5B761714DF7C27A89B1B9618731CACFE688872E1E33BD06835752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 397ba3caae1d3e824724512bfd05bc7ff670eb499b8a63a5004a87b778cdb50e
MD5 8f9a6a38c1b60c345c7c700114a94407
SHA1 388b211c1d7c30693dbe43355fdd3446c5420e4a
SHA512 0dbe2a440549d56763b2e0e51062d000a414927510baea574fb1f86960d8586780d2f3e162aaa160778663538999f9a6daa8c9f5904b5088a105700a92c2f34f
TLSH
T162213E21B4F4C893E533A8CE6625EED63CA437DB9CDC5A89530D811876E8C21CD898E1
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 f9dea00f467266c931ffc08ca57c62ee321343fd6276149dd90826a0abd63d55
MD5 024d3d7b1810f930bfd1e716faa0af71
SHA1 781f960a0190d8df52559bf81df0198e9cd82b75
SHA512 e309b06caef7f3cd8b83d5c1e544326c178bf07abbad8753176e2328c5b669927fb07643a75f666af19dd40f4e4cbafdd5aebc1f4ac835463df9202a412be940
TLSH
T14001491174F5D453E832685A6616DED63CE437DB6CD86A8D23048219B6D4C21CD994E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 18793a83a6715b85efaa0c938dbfacba14b7cff3996f2ea2780e00dffe19e010
MD5 c71f79703221a278c28a7789af4a4337
SHA1 2d612d2248295d0450d12da027e6bbbd3c02c9c8
SHA512 276f18f96dda87375d1092363188e9b610f6d381ed67d64f589e5e5969e032da40d18971b82d3c82b69b13a25de1ded240bd304df185586f7d3380c60fc5d473
TLSH
T18A21606174F5C453E832784FA715DED73CE437DB6CE86A896309811D76D8C21CE894E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1540-33-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/2412-6-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5892-994-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/6056-63-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/6056-3778-0x0000000000710000-0x0000000000731000-memory.dmp

Download